Check ID: ec2_instance_with_outdated_ami
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsEc2Instance

​
What this check verifies

EC2 instances launched from Amazon-owned AMIs are evaluated for the AMI’s DeprecationTime; instances tied to images with a deprecation date in the past are reported as using deprecated AMIs.

​
Risk

Running on a deprecated AMI undermines security and availability:
  • Missing patches enable exploitation of known CVEs (confidentiality/integrity)
  • Unsupported components hinder hardening and forensics
  • AMI removal from catalogs complicates scale-out and recovery (availability)

​
Recommendation

Adopt non-deprecated, maintained AMIs and perform rolling replacements of affected instances. Standardize on hardened golden images with regular AMI rotation and DeprecationTime monitoring. Update launch templates/ASGs to reference current images. Automate patching via an image pipeline and apply defense in depth.

​
Remediation

# EC2 instance using a non-deprecated Amazon AMI
resource "aws_instance" "<example_resource_name>" {
  ami           = "<non_deprecated_amazon_ami_id>"  # Critical: Amazon-owned AMI with no DeprecationTime
  instance_type = "t3.micro"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_with_outdated_ami. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks