🛡️ AWS EC2 Instance OS is no longer maintained or is past ordinary EOL🟢

• Contextual name: 🛡️ Instance OS is no longer maintained or is past ordinary EOL🟢
• ID: /ce/ca/aws/ec2/instance-os-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS EC2 Instance
  • 🔌 AWS EC2 Instance - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that an EC2 instance's installed operating system remains maintained and within its ordinary security-support lifecycle. This policy uses Cloudaware's optional OS Info lifecycle enrichment. It does not identify an OS release from EC2 platform labels, AMI names, image age, or AMI deprecation.

Rationale

An OS past its ordinary end of life can stop receiving security fixes, exposing applications and data to vulnerabilities and increasing operational risk. Findings identify instances that need an OS migration or a documented, time-limited support exception. A catalog's extended-support availability does not establish that a particular instance has the required entitlement, enrollment, or update repositories.

Ending active or mainstream support alone does not establish the end of security support. For example, normal Windows Server Extended Support and the maintenance phase of Amazon Linux 2023 remain within this policy's ordinary security-support lifecycle. Paid Windows Extended Security Updates (ESU) and RHEL Extended Life Cycle Support (ELS) require separate verification.

... see more

Remediation

Open File

Remediation

1. Verify the finding. Confirm the installed OS name and release using current guest inventory, such as Breeze OS and OS Release, Systems Manager PlatformName and PlatformVersion, Linux /etc/os-release, or Windows system information. Review Cloudaware's OS Info: Source, OS Info: Maintained, OS Info: EOL From, and optional OS Info: EOES From against the vendor's current lifecycle schedule. Resolve stale or conflicting data before making changes. EC2 platform labels and source AMI metadata alone do not establish the installed release or its support status.

2. Choose and test a supported release. Follow the vendor's supported upgrade path and test application dependencies, packages, security agents, drivers, licensing, and deployment automation. Rebuild from a trusted, maintained image when an in-place upgrade is unsupported. Confirm any Marketplace subscriptions or Bring Your Own License (BYOL) entitlements required for the target release.

3. Prepare the migration. Back up application data and configuration, verify restoration, and test the rollback procedure. Plan a maintenance window where necessary. Preserve required IAM instance profiles, security groups, network settings, storage, encryption, and bootstrap configuration when replacing instances.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data