EC2 instance virtualization type is HVM

Check ID: ec2_instance_paravirtual_type
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: node-security
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are evaluated for their virtualization mode. Instances with virtualization_type set to paravirtual are identified; those using HVM are recognized as hardware-assisted virtualization.

Risk

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Recommendation

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 terminate-instances —instance-ids <INSTANCE_ID>

# EC2 instance launched from an HVM AMI
resource "aws_instance" "<example_resource_name>" {
  ami           = "<HVM_AMI_ID>"  # Critical: AMI must be HVM to pass the check
  instance_type = "t3.micro"
}

# Launch an EC2 instance using an HVM-based AMI
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <HVM_AMI_ID>  # Critical: Using an HVM AMI ensures virtualization type is HVM
      InstanceType: t3.micro

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_paravirtual_type. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires