EC2 instance is within the configured maximum age

​

What this check verifies

EC2 instances are evaluated for age while in running state. Instances launched beyond the configurable limit (max_ec2_instance_age_in_days, default 180) are flagged as older than the allowed lifetime. Stopped instances are ignored.

​

Risk

Long-lived instances often run unpatched OS and agents, enabling:

• Exploitation of known CVEs loss of confidentiality
• Privilege escalation and tampering integrity compromise
• Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

​

Recommendation

Adopt short-lived, patched workloads:

• Rebuild regularly from hardened, updated images; rotate AMIs
• Use centralized patch management and vulnerability scanning
• Retire or modernize legacy hosts; tag for lifecycle
• Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

​

Remediation

​

References

• https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html
• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/EC2/ec2-instance-too-old.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_older_than_specific_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks