Lesson 08 — EC2 Hardening & Patch Management

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand EC2 hardening principles.
Reduce the attack surface of EC2 instances.
Apply secure operating system configurations.
Manage operating system patches.
Use AWS Systems Manager Patch Manager.
Verify system compliance.
Apply enterprise hardening standards.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Lesson 07 – AWS Systems Manager & Session Manager

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies has successfully deployed hundreds of EC2 instances.

A recent internal security assessment found several issues:

Operating systems not fully updated.
Unnecessary software installed.
SSH still enabled on some servers.
Weak password policies.
Missing security patches.
Unused services running.

Although no compromise occurred, these weaknesses increased the organisation’s attack surface.

The Cloud Security team has been tasked with hardening every EC2 instance and implementing automated patch management.

🤔 What is EC2 Hardening?

EC2 hardening is the process of reducing the attack surface of an EC2 instance by applying secure configurations and removing unnecessary risks.

The objective is simple:

Only run what is required. Only allow who is authorised. Continuously keep the system updated.

Defence in Depth

CloudNova follows a layered security approach.

                    IAM

                     │

            Security Groups

                     │

                Amazon VPC

                     │

             Hardened EC2 Instance

                     │

              Operating System

                     │

             Installed Services

                     │

             Applications & Data

Security should never rely on a single control.

Common Hardening Areas

A secure EC2 instance includes:

Updated operating system
Latest security patches
Least privilege access
Minimal installed packages
Host firewall configuration
Secure SSH configuration (or Session Manager)
Logging enabled
Malware protection (where required)
File integrity monitoring
Secure user management

CloudNova Hardening Checklist

Every production server must comply with the following standards.

Security Control	Status
Latest OS Updates	✅
EBS Encryption	✅
IAM Role Attached	✅
Session Manager Enabled	✅
CloudWatch Agent Installed	✅
Public IP Disabled	✅
Root Login Disabled	✅
Unused Services Removed	✅
Logging Enabled	✅
Security Groups Reviewed	✅

Operating System Updates

Operating systems continuously receive:

Security patches
Kernel updates
Bug fixes
Performance improvements

Delaying updates increases the risk of exploitation.

Example:

Known Vulnerability

↓

Public Exploit Released

↓

Unpatched Server

↓

Compromise

Remove Unnecessary Software

Every installed application increases the attack surface.

Example:

Instead of:

Web Server

FTP Server

Mail Server

Database

Development Tools

Games

Only install:

Web Server

Monitoring Agent

Required Libraries

Minimal systems are easier to secure.

Disable Unnecessary Services

View running services:

systemctl list-units --type=service

Disable services that are not required.

Example:

sudo systemctl disable telnet

sudo systemctl stop telnet

Never disable services without understanding their purpose.

Secure User Management

CloudNova standards:

No shared administrator accounts.
Individual administrator access.
Least privilege permissions.
Multi-Factor Authentication (MFA) for AWS identities.
Session Manager preferred over SSH.

Review local users:

cat /etc/passwd

Review groups:

cat /etc/group

Secure SSH Configuration

If SSH is required:

Disable root login.
Disable password authentication.
Use key-based authentication.
Restrict source IP addresses.
Monitor login attempts.

Example:

PermitRootLogin no

PasswordAuthentication no

Where possible, CloudNova uses AWS Systems Manager Session Manager instead of SSH.

Logging & Monitoring

A hardened server generates logs.

CloudNova forwards logs to:

Amazon CloudWatch
AWS CloudTrail (for AWS API activity)
Security Information and Event Management (SIEM) platform (where implemented)

Common Linux log locations:

/var/log/messages

/var/log/secure

/var/log/syslog

What is Patch Management?

Patch management is the process of identifying, testing and installing software updates.

Updates include:

Security fixes
Bug fixes
Kernel updates
Operating system improvements

Patching reduces exposure to known vulnerabilities.

Patch Management Lifecycle

Identify Updates

↓

Test

↓

Approve

↓

Deploy

↓

Verify

↓

Report

CloudNova follows this lifecycle for all production systems.

AWS Systems Manager Patch Manager

Patch Manager automates operating system patching.

Capabilities include:

Scan instances
Install updates
Compliance reporting
Scheduled maintenance
Patch baselines

This reduces manual effort and improves consistency.

Patch Manager Architecture

Cloud Engineer

↓

Systems Manager

↓

Patch Manager

↓

Managed EC2 Instances

↓

Compliance Report

Patch Baselines

A Patch Baseline defines which updates are approved.

Example:

Critical Updates

Approved

↓

Security Updates

Approved

↓

Optional Packages

Manual Review

Patch Baselines help organisations control update deployment.

Maintenance Windows

CloudNova patches production servers during approved maintenance windows.

Example:

Sunday

02:00 AM

↓

Patch Installation

↓

Server Reboot

↓

Health Check

↓

Production Ready

This minimises disruption to business operations.

🛠 Lab 01 — Check for Available Updates

Connect to the EC2 instance using Session Manager.

Run:

sudo dnf check-update

sudo yum check-update

depending on the operating system.

Review the available updates.

🛠 Lab 02 — Apply Operating System Updates

Run:

sudo dnf update -y

sudo yum update -y

Verify that the update completes successfully.

🛠 Lab 03 — Verify Installed Updates

Run:

cat /etc/os-release

Check:

uname -r

Review the current kernel version.

🛠 Lab 04 — Review Running Services

Run:

systemctl list-units --type=service

Identify:

Required services
Optional services
Unused services

Document which services could be disabled after change approval.

🛠 Lab 05 — Create a Patch Baseline

Navigate to:

AWS Console

↓

Systems Manager

↓

Patch Manager

↓

Patch Baselines

Review the default patch baseline.

If appropriate for your lab environment, create a custom baseline for Amazon Linux.

🛠 Lab 06 — Scan for Patch Compliance

Navigate to:

Systems Manager

↓

Patch Manager

↓

Managed Nodes

Run a compliance scan.

Review:

Missing updates
Installed updates
Compliance status

🛠 Lab 07 — Execute a Patch Operation

Use Systems Manager Run Command.

Select:

AWS-RunPatchBaseline

Operation:

Scan

Review the results.

Then perform:

Install

Verify successful patch installation.

💻 AWS CLI Lab

List Managed Instances

aws ssm describe-instance-information

Describe Patch Baselines

aws ssm describe-patch-baselines

Scan for Missing Patches

aws ssm send-command \
    --document-name AWS-RunPatchBaseline \
    --parameters Operation=Scan \
    --instance-ids i-xxxxxxxx

Install Approved Patches

aws ssm send-command \
    --document-name AWS-RunPatchBaseline \
    --parameters Operation=Install \
    --instance-ids i-xxxxxxxx

View Command Results

aws ssm list-command-invocations \
    --details

✅ Verification

Verify:

✔ Operating system updated.

✔ Latest approved security patches installed.

✔ Systems Manager reports the instance as compliant.

✔ SSM Agent running.

✔ Unnecessary services identified.

✔ CloudWatch Agent operational.

✔ IAM Role attached.

✔ Session Manager functioning correctly.

🔍 Troubleshooting

Problem

Patch scan fails.

Check:

SSM Agent status.
IAM Role permissions.
Managed Node registration.
Network connectivity.

Problem

Updates cannot be installed.

Verify:

Internet or repository access.
Package manager configuration.
Disk space availability.

Problem

Managed Node not compliant.

Review:

Patch Baseline.
Pending reboot.
Missing approved updates.

Problem

Kernel updated but old version still active.

The instance may require a reboot.

Run:

sudo reboot

Reconnect using Session Manager and verify the new kernel version.

🏢 Enterprise Best Practices

CloudNova standards:

Enable automatic security updates where appropriate.
Use Systems Manager Patch Manager for scheduling and compliance.
Test updates in development before production.
Use Maintenance Windows for production patching.
Remove unnecessary software packages.
Review running services regularly.
Disable unused accounts.
Monitor patch compliance continuously.
Document exceptions requiring delayed patching.

🚫 Common Mistakes

❌ Never patching production servers.

❌ Installing patches without testing.

❌ Leaving unsupported operating systems in production.

❌ Running unnecessary services.

❌ Leaving SSH open when Session Manager is available.

❌ Ignoring compliance reports.

❌ Delaying critical security updates without risk assessment.

🧪 DIY Challenge

Harden a new EC2 instance.

Requirements:

Amazon Linux 2023
Private Subnet
Session Manager enabled
IAM Role attached
CloudWatch Agent installed
Encrypted EBS volume

Tasks:

Apply all available operating system updates.
Review running services and identify unnecessary ones.
Verify SSH configuration (or document why Session Manager replaces SSH).
Run a Patch Manager compliance scan.
Install approved patches.
Reboot the instance if required.
Verify the system is compliant.

Capture screenshots of:

Systems Manager Managed Nodes
Patch Manager Compliance
Run Command Results
Updated Operating System
Running Services
AWS CLI outputs

📊 Knowledge Check

What is EC2 hardening?
Why is reducing the attack surface important?
What is the purpose of Patch Manager?
What is a Patch Baseline?
Why are Maintenance Windows used?
Why should unnecessary services be removed?
How does Session Manager contribute to hardening?
Which AWS Systems Manager document is commonly used for patch operations?
Why should updates be tested before production deployment?
How does regular patching improve the security posture of an organisation?

💡 Key Takeaways

After completing this lesson, you should understand:

EC2 hardening is an ongoing process that reduces the attack surface through secure configuration, least privilege and continuous maintenance.
Regular operating system updates and timely security patching protect EC2 instances from known vulnerabilities.
AWS Systems Manager Patch Manager automates patch scanning, installation and compliance reporting across large fleets.
Enterprise environments benefit from standardised patch baselines, maintenance windows and documented hardening procedures.
Combining secure configuration, automated patching and continuous monitoring creates resilient and well-managed EC2 workloads.

🚀 Next Lesson

➡️ Lesson 09 — Monitoring, Logging & Backup