Skip to main content

🛡️ AWS EC2 Instance uses paravirtual Virtualization Type🟢

  • Contextual name: 🛡️ Instance uses paravirtual Virtualization Type🟢
  • ID: /ce/ca/aws/ec2/instance-legacy-virtualization-type
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY, PERFORMANCE

Logic​

Description​

Open File

Description​

Ensure that AWS EC2 instances are not configured with the legacy paravirtual (PV) virtualization type. Hardware Virtual Machine (HVM) is the current standard and provides significant performance and compatibility advantages.

Rational​

HVM AMIs offer full hardware virtualization, allowing guest operating systems to run as if they were on native hardware. This reduces overhead, improves efficiency, and delivers superior performance. Additionally, many modern EC2 instance families and AWS features, such as Enhanced Networking and GPU support, are only available with HVM AMIs.

Impact​

Instances running on PV virtualization may experience degraded performance compared to HVM-based instances. They are also ineligible for migration to newer, more cost-efficient instance families, which can lead to increased operational costs and prevent adoption of the latest AWS capabilities.

Migrating from PV to HVM requires creating new instances from HVM-based AMIs, which involves downtime and a planned migration effort.

... see more

Remediation​

Open File

Remediation​

If an instance was launched from a PV AMI, it cannot be directly changed to an HVM-only instance type. Migration to a new instance based on an HVM AMI is required.

Migration Process Overview​

  1. Backup critical data from the original instance.
  2. Create a new instance using an HVM-compatible AMI that supports the desired instance type, and attach any EBS volumes that were attached to your original instance.
  3. Install your application on your new instance.
  4. Restore any data.
  5. If the original instance has an Elastic IP address, you must associate it with your new instance to ensure that your users can continue to use your application without interruption.
Data Preservation Considerations​
  • Instance Store Volumes
    • Data stored on instance store volumes is lost when the instance is stopped or terminated.
    • To retain this data, copy it to persistent storage before decommissioning the PV instance.
  • Amazon EBS Volumes
    • Amazon EC2 uses the DeleteOnTermination attribute to determine whether to delete or retain EBS volumes attached to the instance.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.24] Amazon EC2 paravirtual instance types should not be used1no data
💼 Cloudaware Framework → 💼 Infrastructure Modernization15no data
💼 Cloudaware Framework → 💼 Workload Efficiency24no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3128no data
💼 FedRAMP High Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)16no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)27no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)328no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)16no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration727no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency16no data