Back to Checks
aws

EC2 instance has detailed monitoring enabled

ec2_instance_detailed_monitoring_enabled
Service: ec2Severity: low
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsEc2Instance

EC2 instances are assessed for CloudWatch detailed monitoring, indicating whether 1-minute metrics collection is enabled.

Instances lacking this setting provide only 5-minute metrics.

Prowler logoProwlerprowler-provider-aws

Risk

Without 1-minute metrics, visibility drops, delaying detection of:

  • Sudden CPU/network/disk spikes affecting availability
  • Malicious workloads (crypto-mining, brute force)
  • Data exfiltration patterns Slower detection expands blast radius, raising incident impact and response cost.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_detailed_monitoring_enabled

Recommendation

Enable detailed monitoring to collect 1-minute metrics on critical instances. Use defense in depth: baseline normal behavior, create alerts for anomalies, and correlate metrics with logs and traces. Review dashboards regularly. If costs matter, prioritize production, internet-facing, and autoscaling fleets.

Remediation

CLI

aws ec2 monitor-instances --instance-ids <EC2_INSTANCE_ID>

Terraform

# Enable detailed monitoring on an EC2 instance
resource "aws_instance" "<example_resource_name>" {
  ami           = "<example_ami_id>"
  instance_type = "<example_instance_type>"
  monitoring    = true  # Critical: enables detailed (1-minute) CloudWatch monitoring
}

NativeIaC

# CloudFormation: Enable detailed monitoring on an EC2 instance
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: "<example_ami_id>"
      InstanceType: "<example_instance_type>"
      Monitoring: true  # Critical: enables detailed (1-minute) CloudWatch monitoring

Other

1Open the AWS Console and go to EC2 > Instances
2Select the instance
3Choose Actions > Monitor and troubleshoot > Manage detailed monitoring
4Check Enable detailed monitoring and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_instance_detailed_monitoring_enabled(Check):
    def execute(self):
        findings = []
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.resource_id = instance.id
            report.resource_arn = instance.arn
            report.resource_tags = instance.tags
            report.status = "PASS"
            report.status_extended = (
                f"EC2 Instance {instance.id} has detailed monitoring enabled."
            )
            if instance.monitoring_state != "enabled":
                report.status = "FAIL"
                report.status_extended = f"EC2 Instance {instance.id} does not have detailed monitoring enabled."

            findings.append(report)

        return findings

References