Rule: EC2 Stopped Instances Should Be Removed in 30 Days

EC2 Stopped Instances Removal Policy for CISA Cyber Essentials

Rule Description

Troubleshooting Steps (if applicable)

Necessary Code (if applicable)

Step-by-Step Guide for Remediation

1. Identify Stopped EC2 Instances

2. 1.
   Open the AWS Management Console.
4. 2.
   Navigate to the EC2 dashboard.

2. Filter Stopped Instances

2. 1.
   On the EC2 dashboard, click on the "Instances" section in the left navigation pane.
4. 2.
   Apply a filter to display only stopped instances.

3. Identify Instances Older Than 30 Days

2. 1.
   Sort the instances based on the "Launch time" column to identify the oldest instances.
4. 2.
   Review the instances and ensure that they have been stopped for more than 30 days.

4. Verify Instance Status

2. 1.
   Select an instance to view its details.
4. 2.
   Ensure that the instance is in a stopped state and not being actively used.

5. Take Note of Instance Details (if required)

2. 1.
   If necessary, note down important details about the instance, such as its name, tags, or any associated resources.
4. 2.
   These details will be helpful for reference or documentation purposes.

6. Terminate the Stopped Instance

2. 1.
   Select the instance you want to remove.
4. 2.
   Click on the "Actions" button at the top of the page.
6. 3.
   From the dropdown menu, choose "Instance State" and then "Terminate."
8. 4.
   Confirm the termination by clicking on "Yes, Terminate."

7. Repeat Steps 3-6 for Other Instances

2. 1.
   Go back to the list view of stopped instances.
4. 2.
   Repeat steps 3-6 until all instances that have been stopped for more than 30 days have been terminated.

8. Documentation (optional)

2. 1.
   If required, document the terminated instances for auditing or tracking purposes.

Conclusion