Securing compromised EC2 instances implicated in abuse reports

Overview

Amazon EC2 provides resizable compute capacity in the cloud, designed to simplify web-scale cloud computing for developers. When EC2 instances are running vulnerable software, are misconfigured, or have been compromised, the resulting activity may conflict with the AWS Acceptable Use Policy and pose security, operational, or reputational risks to your AWS environment.

This article explains the most common Amazon EC2 abuse patterns and walks you through how to respond to the abuse. It also provides guidance on how to strengthen your security posture to reduce the likelihood of future notifications.

How EC2 resources become a source of abuse

EC2 instances can become a source of abuse when they are compromised by unauthorized actors, misconfigured with overly permissive access, or running unpatched software with known vulnerabilities. Abuse notifications generally fall into one of two categories:

• Content-based abuse — the instance is being used to host, store, or distribute prohibited or harmful material. Common examples include malware and ransomware, phishing pages and credential-harvesting sites, spam infrastructure, and content that violates the AWS Acceptable Use Policy.

• Network abuse — the instance is performing harmful actions against other systems. Common examples include distributed denial-of-service (DDoS) attacks, unauthorized port scanning or network probing, brute-force authentication attempts, unauthorized crypto mining, SQL injection attacks, and vulnerability exploitation

Identifying which category your notification falls into shapes how you contain and remediate the abuse. The next section walks through the response steps that apply across both.

Contain the abuse

When you receive an Amazon EC2-related abuse notification, we recommend taking the following actions:

• Identify affected resources: Review the notification details for instance IDs, IP addresses, and timestamps. Use AWS CloudTrail to track API activity related to the affected resources and understand what actions were taken.

• Contain the activity: Immediately stop or isolate the affected instance. Place the instance in a dedicated security group that restricts all inbound and outbound traffic, or stop the instance entirely. Security groups are stateful: If an inbound connection is already established, then outbound rules alone can’t block response traffic on that connection. For full containment, isolate the instance into a restrictive security group and consider stopping it.

• Engage incident response support: For complex incidents that need expert assistance, consider engaging AWS Security Incident Response.

• Secure access: Rotate credentials and review AWS Identity and Access Management (IAM) permissions associated with the workload. Use AWS Secrets Manager for automated credential rotation.

• Apply corrective actions: Patch vulnerabilities or replace compromised instances. Use AWS Systems Manager for automated remediation.

Investigation and remediation

After containment, perform a deeper investigation to determine how the activity occurred:

• Use Amazon CloudWatch Logs Insights to review system and application logs.

• Use Session Manager, a capability of Systems Manager, to inspect running processes and installed software.

• Use Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring to validate inbound and outbound network traffic.

• Use EC2 Image Builder to rebuild affected instances from a known-good image rather than trying to do an in-place cleanup.

• Use AWS Config to check for similar configurations across other EC2 resources.

For technical remediation guidance, contact AWS Support for assistance with troubleshooting and recovery steps.

Strengthening your Amazon EC2 security posture

To reduce the likelihood of future abuse notifications, follow the Amazon EC2 security best practices. These best practices include the following:

• Use IAM Access Analyzer to identify and refine permissions and grant only the access required for specific tasks.

• Configure security groups and network access control lists (ACLs) to restrict inbound and outbound traffic. Use Network Firewall for outbound traffic inspection and Firewall Manager for centralized network security management.

• Use Patch Manager, a capability of Systems Manager, and Amazon Inspector to identify and remediate software vulnerabilities.

• Implement CloudTrail, CloudWatch, and GuardDuty to detect unusual behavior early.

• Deploy AWS Security Hub for aggregated findings and prioritized remediation recommendations across your accounts.

For a comprehensive security framework, see the AWS Well-Architected Framework — Security Pillar.

Conclusion and next steps

AWS Trust & Safety notifications help you take timely action and reduce risk. By understanding common abuse patterns, responding promptly, and applying preventative best practices, you can reduce future incidents and maintain alignment with AWS policies.

As a next step, review your Amazon EC2 configurations, access controls, and monitoring setup against Amazon EC2 security best practices. For help with technical implementation, contact AWS Support.

About the Author: Harsh Mishra

Harsh is part of the AWS Trust & Safety team in India. He investigates abuse involving AWS customer resources, coordinates mitigation strategies with service teams, and helps protect customers and services through policy enforcement and risk prevention.