Elastic Beanstalk has managed platform updates on

Check ID: elasticbeanstalk_environment_managed_updates_enabled
Provider: AWS
Service: elasticbeanstalk
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsElasticBeanstalkEnvironment

What this check verifies

Elastic Beanstalk environments with managed platform updates enabled (ManagedActionsEnabled: true) automatically apply platform patch/minor updates during a scheduled maintenance window.

Risk

Without automatic platform updates, environments may run vulnerable OS/runtime versions, enabling exploitation of known CVEs, RCE, or privilege escalation. Patch drift also increases instability, harming availability and undermining application integrity.

Recommendation

Enable managed platform updates with a set maintenance window and choose an update level (patch or minor). Ensure enhanced health is on and the update role follows least privilege. Validate in staging, roll out gradually, and stagger windows across environments to strengthen defense in depth and resilience.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:managedactions,OptionName=ManagedActionsEnabled,Value=true

resource "aws_elastic_beanstalk_environment" "<example_resource_name>" {
  name                = "<example_resource_name>"
  application         = "<example_resource_name>"
  solution_stack_name = "<example_resource_name>"

  setting {
    namespace = "aws:elasticbeanstalk:managedactions"
    name      = "ManagedActionsEnabled"   # Critical: enables managed platform updates
    value     = "true"                    # Critical: set to true to pass the check
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName: <example_resource_name>
      SolutionStackName: <example_resource_name>
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:managedactions
          OptionName: ManagedActionsEnabled  # Critical: enables managed platform updates
          Value: "true"                      # Critical: set to true to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticbeanstalk_environment_managed_updates_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Elastic Beanstalk has enhanced health reporting on Classic Load Balancer has connection draining enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires