Back to Checks
aws

Elastic Beanstalk environment has managed platform updates enabled

elasticbeanstalk_environment_managed_updates_enabled
Service: elasticbeanstalkSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsElasticBeanstalkEnvironment

Elastic Beanstalk environments with managed platform updates enabled (ManagedActionsEnabled: true) automatically apply platform patch/minor updates during a scheduled maintenance window.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic platform updates, environments may run vulnerable OS/runtime versions, enabling exploitation of known CVEs, RCE, or privilege escalation.

Patch drift also increases instability, harming availability and undermining application integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticbeanstalk_environment_managed_updates_enabled

Recommendation

Enable managed platform updates with a set maintenance window and choose an update level (patch or minor). Ensure enhanced health is on and the update role follows least privilege. Validate in staging, roll out gradually, and stagger windows across environments to strengthen defense in depth and resilience.

Remediation

CLI

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:managedactions,OptionName=ManagedActionsEnabled,Value=true

Terraform

resource "aws_elastic_beanstalk_environment" "<example_resource_name>" {
  name                = "<example_resource_name>"
  application         = "<example_resource_name>"
  solution_stack_name = "<example_resource_name>"

  setting {
    namespace = "aws:elasticbeanstalk:managedactions"
    name      = "ManagedActionsEnabled"   # Critical: enables managed platform updates
    value     = "true"                    # Critical: set to true to pass the check
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName: <example_resource_name>
      SolutionStackName: <example_resource_name>
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:managedactions
          OptionName: ManagedActionsEnabled  # Critical: enables managed platform updates
          Value: "true"                      # Critical: set to true to pass the check

Other

1Open the AWS Management Console and go to Elastic Beanstalk
2Select your environment
3Choose Configuration
4In Managed updates, click Edit
5Turn Managed updates to Enabled
6Click Apply/Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_client import (
    elasticbeanstalk_client,
)


class elasticbeanstalk_environment_managed_updates_enabled(Check):
    def execute(self):
        findings = []
        for environment in elasticbeanstalk_client.environments.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=environment)
            report.status = "PASS"
            report.status_extended = f"Elastic Beanstalk environment {environment.name} has managed platform updates enabled."

            if environment.managed_platform_updates != "true":
                report.status = "FAIL"
                report.status_extended = f"Elastic Beanstalk environment {environment.name} does not have managed platform updates enabled."

            findings.append(report)

        return findings

References