Back to Checks
aws

EC2 instance virtualization type is HVM

ec2_instance_paravirtual_type
Service: ec2Severity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:AwsEc2Instance

EC2 instances are evaluated for their virtualization mode. Instances with virtualization_type set to paravirtual are identified; those using HVM are recognized as hardware-assisted virtualization.

Prowler logoProwlerprowler-provider-aws

Risk

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_paravirtual_type

Recommendation

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

Remediation

CLI

aws ec2 terminate-instances --instance-ids <INSTANCE_ID>

Terraform

# EC2 instance launched from an HVM AMI
resource "aws_instance" "<example_resource_name>" {
  ami           = "<HVM_AMI_ID>"  # Critical: AMI must be HVM to pass the check
  instance_type = "t3.micro"
}

NativeIaC

# Launch an EC2 instance using an HVM-based AMI
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <HVM_AMI_ID>  # Critical: Using an HVM AMI ensures virtualization type is HVM
      InstanceType: t3.micro

Other

1In the AWS Console, go to EC2 > Instances and select the instance with Virtualization type = paravirtual
2Launch a replacement instance using any HVM-based AMI (e.g., Amazon Linux 2)
3Verify the new instance is running
4Back in EC2 > Instances, select the paravirtual instance, choose Instance state > Terminate instance, and confirm

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_instance_paravirtual_type(Check):
    def execute(self):
        findings = []
        for instance in ec2_client.instances:
            if instance.state != "terminated":
                report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
                report.status = "PASS"
                report.status_extended = (
                    f"EC2 Instance {instance.id} virtualization type is set to HVM."
                )
                if instance.virtualization_type == "paravirtual":
                    report.status = "FAIL"
                    report.status_extended = f"EC2 Instance {instance.id} virtualization type is set to paravirtual."

                findings.append(report)

        return findings

References