Back to Checks
aws

EC2 instance is not older than the configured maximum age or is not running

ec2_instance_older_than_specific_days
Service: ec2Severity: medium
OfficialBuilt-inVerified
Resource Type:AwsEc2Instance

EC2 instances are evaluated for age while in running state. Instances launched beyond the configurable limit (max_ec2_instance_age_in_days, default 180) are flagged as older than the allowed lifetime. Stopped instances are ignored.

Prowler logoProwlerprowler-provider-aws

Risk

Long-lived instances often run unpatched OS and agents, enabling:

  • Exploitation of known CVEs loss of confidentiality
  • Privilege escalation and tampering integrity compromise
  • Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_older_than_specific_days

Recommendation

Adopt short-lived, patched workloads:

  • Rebuild regularly from hardened, updated images; rotate AMIs
  • Use centralized patch management and vulnerability scanning
  • Retire or modernize legacy hosts; tag for lifecycle
  • Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

Remediation

CLI

aws ec2 stop-instances --instance-ids <example_resource_id>

Other

1Sign in to the AWS Management Console and open EC2
2Go to Instances and select the noncompliant instance
3Choose Instance state > Stop instance
4Confirm Stop
5Verify the instance state is Stopped (the check passes when the instance is not running)

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_instance_older_than_specific_days(Check):
    def execute(self):
        findings = []

        # max_ec2_instance_age_in_days, default: 180 days
        max_ec2_instance_age_in_days = ec2_client.audit_config.get(
            "max_ec2_instance_age_in_days", 180
        )
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.resource_id = instance.id
            report.resource_arn = instance.arn
            report.resource_tags = instance.tags
            report.status = "PASS"
            report.status_extended = f"EC2 Instance {instance.id} is not running."
            if instance.state == "running":
                time_since_launch = (
                    datetime.now().replace(tzinfo=timezone.utc) - instance.launch_time
                )
                report.status_extended = f"EC2 Instance {instance.id} is not older than {max_ec2_instance_age_in_days} days ({time_since_launch.days} days)."
                if time_since_launch.days > max_ec2_instance_age_in_days:
                    report.status = "FAIL"
                    report.status_extended = f"EC2 Instance {instance.id} is older than {max_ec2_instance_age_in_days} days ({time_since_launch.days} days)."

            findings.append(report)

        return findings

References