Back to Checks
alibabacloud

ECS instance has latest OS patches applied

ecs_instance_latest_os_patches_applied
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:ALIYUN::ECS::Instance

Alibaba Cloud Security Center checks for the latest updates in Linux and Windows systems running on ECS instances. Keeping virtual machines updated with the latest OS patches addresses specific bugs, improves general stability, and fixes security vulnerabilities. This check verifies that all known vulnerabilities detected by Security Center have been patched on each ECS instance.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Unpatched systems are vulnerable to known security exploits and can be compromised by attackers leveraging publicly disclosed vulnerabilities. Failure to apply patches in a timely manner increases the risk of unauthorized access, malware infection, and data breaches, impacting the confidentiality, integrity, and availability of the system.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ecs_instance_latest_os_patches_applied

Recommendation

Regularly review and apply OS patches on all ECS instances using the Alibaba Cloud Security Center vulnerability management feature to maintain a strong security posture.

Remediation

CLI

aliyun sas FixCheckWarnings --CheckIds <check_ids>

Other

1Log on to the **Security Center Console**.
2Select **Vulnerabilities** in the left-side navigation pane.
3Review all detected vulnerabilities.
4Apply all available patches for the reported vulnerabilities.
5Verify that vulnerabilities are resolved after patching.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ecs.ecs_client import ecs_client
from prowler.providers.alibabacloud.services.securitycenter.securitycenter_client import (
    securitycenter_client,
)


class ecs_instance_latest_os_patches_applied(Check):
    """Check if the latest OS patches for all Virtual Machines are applied."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Check each ECS instance for vulnerabilities
        for instance in ecs_client.instances:
            # Only check running instances
            if instance.status.lower() not in ["running", "starting"]:
                continue

            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            # Check if instance has vulnerabilities
            instance_key = f"{instance.region}:{instance.id}"
            vulnerability = securitycenter_client.instance_vulnerabilities.get(
                instance_key
            )

            if vulnerability:
                if vulnerability.has_vulnerabilities:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ECS instance {instance.name if instance.name else instance.id} "
                        f"has {vulnerability.vulnerability_count} unpatched vulnerabilities. "
                        "Latest OS patches are not applied."
                    )
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"ECS instance {instance.name if instance.name else instance.id} "
                        "has all latest OS patches applied."
                    )

                findings.append(report)

        return findings

References