I'm running a custom server program on a free tier EC2 instance. I'm not a security professional, so while I've taken every step I know how to to secure my software, it's very likely that there's some vulnerability in my code or any other program running on the instance that could allow an attacker to take control.

I've heard horror stories of hackers subverting an EC2 instance and then using the EC2 API to buy tens of thousands of dollars worth of compute in order to mine bitcoin on your EC2 account, leaving the victim with the bill.

Since I have no use for the ability to dynamically alter my EC2 instances from within the VM anyway, how can I turn this off, or otherwise mitigate this kind of attack?

  • Hello and welcome to Information Security. Does your EC2 instance have a particular IAM role? Have you left any access keys within the instance? What steps have you taken?
    – Jedi
    Jul 8 '16 at 4:35

AWS maintains the notion of "Roles" for EC2 instances. When launching a new instance you are able to assign the server a role. The role must be applied during the build and cannot be added to an already running server. In the Identity and Access Management (IAM) area you can define what a role has permission to do (e.g., launch additional compute units, stop servers, delete EBS volumes, etc).

The best practice is to create a role that does not allow the server to perform any AWS operations that are not necessary for the server's intended purpose.

You can read more about AWS role-based access for EC2 here.

And about roles in general here.

Additionally, depending on the need the server has to communicate with the outside world, consider firewalling it off. In AWS, this is done with Security Groups.

  • Darn beat me to it. Roles are a GODSEND! Same with ACL, Security Groups, ELB... Seriously love AWS. Jul 7 '16 at 22:29
  • @RobertMennell 100%
    – HashHazard
    Jul 7 '16 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.