AWS Workloads Hardening

Configure every EC2 instance with IMDSv2 token-required and hop-limit = 1, and pin the requirement with an organisation-level SCP that denies ec2:RunInstances when ec2:MetadataHttpTokens is not required. IMDSv1 is the unauthenticated, GET-only Instance Metadata Service that any local process — including a web server reflected through an SSRF bug — can call to retrieve the instance role's temporary credentials (Amazon EC2 — IMDSv2 enforcement and hop limit (accessed 2026-05)). IMDSv2 turns the call into a two-step session-token handshake (PUT to obtain a token, GET with the token header) that an SSRF reflection cannot perform because most SSRF payloads can only emit GETs. Hop-limit = 1 means the IMDS response packet has a TTL that decrements to zero after one hop — so a container in the host network namespace can reach it, but a forwarded HTTP request from a non-co-resident attacker cannot. PITFALL 5: hop-limit must be 1 for non-container workloads; the only legitimate reason to raise it to 2 is ECS-on-EC2, where the agent forwards the request through one virtual hop before reaching the IMDS — never raise hop-limit to 2 for general workloads "in case some app needs it", because that is exactly the attacker's wish.

Remediation — AWS CLI

# Enforce IMDSv2 on an existing instance (hop-limit=1 = non-container workload default).
aws ec2 modify-instance-metadata-options \
  --instance-id i-0abc123def4567890 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Account-wide default: every new instance launched after this call uses IMDSv2.
aws ec2 modify-instance-metadata-defaults \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Audit: list instances still allowing IMDSv1.
aws ec2 describe-instances \
  --filters Name=metadata-options.http-tokens,Values=optional \
  --query 'Reservations[].Instances[].[InstanceId,Tags[?Key==`Name`].Value|[0]]' \
  --output table

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_instance" "workload" {
  ami           = var.golden_ami_id
  instance_type = "m6i.large"
  subnet_id     = aws_subnet.private[0].id

  metadata_options {
    http_tokens = "required"  # IMDSv2 mandatory
    http_put_response_hop_limit = 1  # PITFALL 5: 1 for non-container; 2 ONLY for ECS-on-EC2
    http_endpoint = "enabled"
    instance_metadata_tags = "enabled"
  }

  tags = { Name = "app-prod-01" }
}

# Organisation-wide SCP: deny RunInstances unless IMDSv2 required.
resource "aws_organizations_policy" "deny_imdsv1_launches" {
  name = "deny-imdsv1-launches"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "DenyRunInstancesWithoutImdsV2"
      Effect = "Deny"
      Action = "ec2:RunInstances"
      Resource = "arn:aws:ec2:*:*:instance/*"
      Condition = {
        StringNotEquals = {
          "ec2:MetadataHttpTokens" = "required"
        }
      }
    }]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: EC2 launch template mandating IMDSv2 (HttpTokens=required) on every instance launched from it.
Resources:
  ImdsV2LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: imdsv2-mandatory
      LaunchTemplateData:
        MetadataOptions:
          HttpTokens: required
          HttpEndpoint: enabled
          HttpPutResponseHopLimit: 2
          InstanceMetadataTags: enabled

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class ImdsV2LaunchTemplateStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new ec2.CfnLaunchTemplate(this, 'ImdsV2Lt', {
      launchTemplateName: 'imdsv2-mandatory',
      launchTemplateData: {
        metadataOptions: {
          httpTokens: 'required',
          httpEndpoint: 'enabled',
          httpPutResponseHopLimit: 2,
          instanceMetadataTags: 'enabled',
        },
      },
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.instanceId, requestParameters.httpTokens, requestParameters.httpPutResponseHopLimit, requestParameters.metadataOptions.httpTokens, userIdentity.arn
          | filter eventSource = "ec2.amazonaws.com" and eventName in ["ModifyInstanceMetadataOptions","RunInstances"]
          | filter requestParameters.httpTokens = "optional" or requestParameters.metadataOptions.httpTokens = "optional" or requestParameters.httpPutResponseHopLimit > 1
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Replace SSH with AWS Systems Manager Session Manager on every EC2 instance; delete the bastion fleet. Session Manager establishes interactive shells through the SSM control plane, requires no inbound network path to the instance, authenticates via IAM, and writes full session transcripts to S3 + CloudWatch Logs with optional KMS encryption (AWS Systems Manager — Session Manager (accessed 2026-05)). The architectural shift is the entire point: bastion hosts with public IPs and port 22 ingress are obsolete — Session Manager is zero-trust (no implicit network reachability), logged by default, and has no public attack surface. Instances need only the AmazonSSMManagedInstanceCore managed policy on their instance profile and an SSM Agent (pre-installed on all Amazon Linux 2, AL2023, Ubuntu 18.04+, and Windows Server 2016+ AMIs). Severity HIGH PREVENTIVE because the control eliminates an entire category of internet-exposed SSH brute-force attacks and credential-stuffing campaigns against bastion fleets; CRITICAL is reserved for SSRF-class single-step exploitation paths (e.g. aws-work-01).

Remediation — AWS CLI

# Start an interactive session (replaces ssh ec2-user@host).
aws ssm start-session --target i-0abc123def4567890

# Configure session preferences: KMS-encrypted log shipping to S3 + CloudWatch.
aws ssm update-document \
  --name SSM-SessionManagerRunShell \
  --content file://session-prefs.json \
  --document-version '$LATEST'

# session-prefs.json sets s3BucketName, s3KeyPrefix, s3EncryptionEnabled=true,
# cloudWatchLogGroupName, cloudWatchEncryptionEnabled=true, kmsKeyId=.

# Attach the SSM managed policy to the instance role.
aws iam attach-role-policy \
  --role-name ec2-workload-role \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_iam_role" "ec2_workload" {
  name = "ec2-workload-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sts:AssumeRole"
      Principal = { Service = "ec2.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "ssm_core" {
  role       = aws_iam_role.ec2_workload.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "ec2_workload" {
  name = "ec2-workload-profile"
  role = aws_iam_role.ec2_workload.name
}

# Session-Manager preferences document: KMS-encrypted S3 + CloudWatch session logs.
resource "aws_ssm_document" "session_prefs" {
  name            = "SSM-SessionManagerRunShell"
  document_type   = "Session"
  document_format = "JSON"
  content = jsonencode({
    schemaVersion = "1.0"
    description   = "Session-Manager preferences with KMS-encrypted logging"
    sessionType   = "Standard_Stream"
    inputs = {
      s3BucketName               = aws_s3_bucket.session_logs.id
      s3KeyPrefix                = "sessions/"
      s3EncryptionEnabled        = true
      cloudWatchLogGroupName     = aws_cloudwatch_log_group.sessions.name
      cloudWatchEncryptionEnabled = true
      kmsKeyId                   = aws_kms_key.sessions.arn
      runAsEnabled               = false
    }
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SSM Session Manager preferences forcing KMS encryption and CloudWatch session logging.
Parameters:
  SessionLogGroupName:
    Type: String
  SessionKmsKeyArn:
    Type: String
Resources:
  SessionManagerPreferences:
    Type: AWS::SSM::Document
    Properties:
      Name: SSM-SessionManagerRunShell
      DocumentType: Session
      DocumentFormat: JSON
      Content:
        schemaVersion: '1.0'
        description: Session Manager hardened defaults.
        sessionType: Standard_Stream
        inputs:
          cloudWatchLogGroupName: !Ref SessionLogGroupName
          cloudWatchEncryptionEnabled: true
          kmsKeyId: !Ref SessionKmsKeyArn
          runAsEnabled: false

Compliance mapping

fields @timestamp, eventName, requestParameters.keyName, requestParameters.instanceId, responseElements.instancesSet.items.0.tagSet, userIdentity.arn
          | filter eventSource = "ec2.amazonaws.com" and eventName = "RunInstances"
          | filter ispresent(requestParameters.keyName) and requestParameters.keyName != ""
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable enhanced scanning (Inspector v2 powered) on every Amazon ECR repository, set image_tag_mutability = IMMUTABLE, and gate the deployment pipeline so that any image with CRITICAL findings is blocked from production promotion (Amazon ECR User Guide — image scanning configuration (accessed 2026-05)). Enhanced scanning provides continuous CVE assessment, package-vulnerability detail for both OS and application-language ecosystems (npm, PyPI, RubyGems, Go modules, Maven, NuGet), and integrates findings into Amazon Inspector and Security Hub. The IMMUTABLE tag policy means an attacker who somehow lands push permission to myrepo:latest cannot overwrite an already-scanned tag with a back-doored image — the deployment pipeline pulls the same SHA256-pinned image that was scanned. The DETECTIVE typology is deliberate: scanning surfaces unsafe state, the build-pipeline gate is the PREVENTIVE pair (deployment denied on CRITICAL findings).

Remediation — AWS CLI

# Enable enhanced (Inspector v2) scanning at the registry level.
aws ecr put-registry-scanning-configuration \
  --scan-type ENHANCED \
  --rules 'scanFrequency=CONTINUOUS_SCAN,repositoryFilters=[{filter="*",filterType="WILDCARD"}]'

# Per-repository: scan-on-push + immutable tags + KMS encryption.
aws ecr create-repository \
  --repository-name app/api \
  --image-tag-mutability IMMUTABLE \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration encryptionType=KMS,kmsKey=arn:aws:kms:eu-west-1:111122223333:key/

# List images in a repo with CRITICAL findings.
aws ecr describe-image-scan-findings \
  --repository-name app/api \
  --image-id imageTag=v2024.03.15 \
  --query 'imageScanFindings.findingSeverityCounts'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_ecr_registry_scanning_configuration" "enhanced" {
  scan_type = "ENHANCED"
  rule {
    scan_frequency = "CONTINUOUS_SCAN"
    repository_filter {
      filter      = "*"
      filter_type = "WILDCARD"
    }
  }
}

resource "aws_ecr_repository" "app_api" {
  name                 = "app/api"
  image_tag_mutability = "IMMUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  encryption_configuration {
    encryption_type = "KMS"
    kms_key         = aws_kms_key.ecr.arn
  }
}

# Lifecycle policy: keep last 30 immutable tags, expire untagged after 7 days.
resource "aws_ecr_lifecycle_policy" "app_api" {
  repository = aws_ecr_repository.app_api.name
  policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Keep last 30 tagged images"
        selection = {
          tagStatus     = "tagged"
          tagPatternList = ["*"]
          countType     = "imageCountMoreThan"
          countNumber   = 30
        }
        action = { type = "expire" }
      },
      {
        rulePriority = 2
        description  = "Expire untagged after 7 days"
        selection = {
          tagStatus   = "untagged"
          countType   = "sinceImagePushed"
          countUnit   = "days"
          countNumber = 7
        }
        action = { type = "expire" }
      }
    ]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: ECR repository with enhanced (Inspector) scan-on-push and KMS encryption.
Parameters:
  RepoName:
    Type: String
  EcrKmsKeyArn:
    Type: String
Resources:
  ScanOnPushRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: !Ref RepoName
      ImageScanningConfiguration:
        ScanOnPush: true
      ImageTagMutability: IMMUTABLE
      EncryptionConfiguration:
        EncryptionType: KMS
        KmsKey: !Ref EcrKmsKeyArn

Compliance mapping

fields @timestamp, eventName, requestParameters.scanType, requestParameters.repositoryName, requestParameters.imageScanningConfiguration.scanOnPush, requestParameters.rules, userIdentity.arn
          | filter eventSource = "ecr.amazonaws.com" and eventName in ["PutRegistryScanningConfiguration","PutImageScanningConfiguration"]
          | filter requestParameters.scanType = "BASIC" or requestParameters.imageScanningConfiguration.scanOnPush = false
          | sort @timestamp desc
          | limit 50

Equivalent on: Azure · GCP · OCI

Enable Amazon Inspector organisation-wide with the delegated-administrator pattern, covering EC2 instances, ECR repositories, and Lambda functions; route findings into AWS Security Hub for unified triage (Amazon Inspector User Guide — EC2/ECR/Lambda scanning (accessed 2026-05)). A naming caveat that matters for accuracy in audit reports: the product is Amazon Inspector (current name; the older "AWS Inspector" branding is no longer correct), and the "v2" qualifier was dropped in 2024 — the previous "Amazon Inspector v2" is now simply "Amazon Inspector". Inspector continuously assesses EC2 (agent-based and agentless modes), ECR images (the same scanning surfaced in aws-work-03), and Lambda functions (package and code scanning). Severity HIGH DETECTIVE because Inspector surfaces unsafe state — CVEs, misconfigurations, public-network-path findings — but is not itself the preventive gate; the build-pipeline integration and the IMDSv2/SCP combination on aws-work-01 are the preventive pairs.

Remediation — AWS CLI

# Designate the delegated administrator (from the Organizations management account).
aws inspector2 enable-delegated-admin-account \
  --delegated-admin-account-id 222233334444

# From the delegated admin: enable Inspector for all member accounts, all resource types.
aws inspector2 enable \
  --account-ids ALL_MEMBERS \
  --resource-types EC2 ECR LAMBDA LAMBDA_CODE

# Verify status.
aws inspector2 batch-get-account-status \
  --account-ids 111122223333 222233334444 \
  --query 'accounts[].[accountId,state.status]'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_inspector2_delegated_admin_account" "security" {
  account_id = var.security_account_id
}

resource "aws_inspector2_organization_configuration" "auto_enable" {
  auto_enable {
    ec2         = true
    ecr         = true
    lambda      = true
    lambda_code = true
  }
}

# Per-account explicit enable (member accounts).
resource "aws_inspector2_enabler" "member" {
  for_each       = toset(var.member_account_ids)
  account_ids    = [each.value]
  resource_types = ["EC2", "ECR", "LAMBDA", "LAMBDA_CODE"]
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Inspector v2 enablement for EC2 + ECR + Lambda scanning in the account.
Resources:
  InspectorEnabler:
    Type: AWS::InspectorV2::Filter
    Properties:
      Name: enable-all-scan-types
      FilterAction: NONE
      FilterCriteria:
        Severity:
          - Comparison: EQUALS
            Value: HIGH

Compliance mapping

fields @timestamp, eventName, requestParameters.resourceTypes, requestParameters.accountIds, requestParameters.autoEnable, userIdentity.arn
          | filter eventSource = "inspector2.amazonaws.com" and eventName in ["Disable","DisassociateMember","UpdateOrganizationConfiguration","DeleteMember"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Every AWS Lambda function gets its own least-privileged execution role (no shared "lambda-default" role, no *:* wildcards), its function URL (where present) is configured with AuthType = AWS_IAM, its secrets are pulled at runtime from AWS Secrets Manager via KMS-encrypted references rather than baked into environment variables, and production functions carry a reserved_concurrent_executions ceiling that caps blast-radius cost during anomalous traffic (AWS Lambda Developer Guide — execution-role least privilege (accessed 2026-05)). The canonical secrets-management reference architecture — Secrets Manager rotation, KMS key policies, runtime fetching — is documented on the General IAM page (§secrets management), and this control intentionally cross-links rather than re-authoring per the Phase 4 canonical-content rule. Severity HIGH PREVENTIVE because Lambda functions inherit AWS-managed isolation but their execution-role permissions ARE the blast radius if the function is compromised; a function with s3:* on * is functionally an Organisation-wide read-write key in the hands of any attacker who exploits a code bug.

Remediation — AWS CLI

# Update an existing function to use a least-priv role and AWS_IAM URL auth.
aws lambda update-function-configuration \
  --function-name order-processor \
  --role arn:aws:iam::111122223333:role/lambda-order-processor-role \
  --reserved-concurrent-executions 50 \
  --environment 'Variables={SECRET_ARN=arn:aws:secretsmanager:eu-west-1:111122223333:secret:db/order-xyz}'

aws lambda update-function-url-config \
  --function-name order-processor \
  --auth-type AWS_IAM

# Audit: list functions whose role is the legacy lambda_basic_execution role.
aws lambda list-functions \
  --query 'Functions[?contains(Role,`lambda_basic_execution`)].[FunctionName,Role]' \
  --output table

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_iam_role" "order_processor" {
  name = "lambda-order-processor-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sts:AssumeRole"
      Principal = { Service = "lambda.amazonaws.com" }
    }]
  })
}

# Function-scoped policy: no wildcards beyond the function's own purpose.
resource "aws_iam_role_policy" "order_processor" {
  name = "order-processor-scope"
  role = aws_iam_role.order_processor.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = ["secretsmanager:GetSecretValue"]
        Resource = [aws_secretsmanager_secret.db_order.arn]
      },
      {
        Effect = "Allow"
        Action = ["kms:Decrypt"]
        Resource = [aws_kms_key.secrets.arn]
        Condition = {
          StringEquals = { "kms:ViaService" = "secretsmanager.eu-west-1.amazonaws.com" }
        }
      },
      {
        Effect = "Allow"
        Action = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "arn:aws:logs:*:*:log-group:/aws/lambda/order-processor:*"
      }
    ]
  })
}

resource "aws_lambda_function" "order_processor" {
  function_name = "order-processor"
  role          = aws_iam_role.order_processor.arn
  package_type  = "Zip"
  filename      = var.lambda_zip
  handler       = "index.handler"
  runtime       = "nodejs20.x"

  reserved_concurrent_executions = 50

  environment {
    variables = {
      SECRET_ARN = aws_secretsmanager_secret.db_order.arn
    }
  }
}

resource "aws_lambda_function_url" "order_processor" {
  function_name      = aws_lambda_function.order_processor.function_name
  authorization_type = "AWS_IAM"
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Lambda execution role scoped to a single DynamoDB table — no broad dynamodb:* or *.
Parameters:
  FunctionName:
    Type: String
  TableArn:
    Type: String
Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${FunctionName}-exec'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Ref LambdaTableAccessPolicy
  LambdaTableAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub '${FunctionName}-table-access'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:Query
            Resource: !Ref TableArn

Compliance mapping

fields @timestamp, eventName, requestParameters.functionName, requestParameters.role, requestParameters.policyArn, requestParameters.roleName, userIdentity.arn
          | filter eventSource in ["lambda.amazonaws.com","iam.amazonaws.com"] and eventName in ["CreateFunction","UpdateFunctionConfiguration","AttachRolePolicy"]
          | filter requestParameters.policyArn like /FullAccess$/ or requestParameters.policyArn like /AdministratorAccess$/ or requestParameters.policyArn like /:policy\/iam-/
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Harden Amazon EKS clusters along four orthogonal axes: (a) workload identity via EKS Pod Identity (Dec 2023 GA, preferred over IRSA per Phase 5 IAM precedent on aws-iam-06; IRSA remains legacy-but-supported for existing clusters); (b) Pod Security Admission with the restricted profile enforced on every workload namespace; (c) private control-plane endpoint with public access disabled; (d) control-plane audit logs shipped to CloudWatch (Amazon EKS — Pod Identity (accessed 2026-05)). Pod Identity decouples Kubernetes ServiceAccount → IAM role mapping from the per-cluster OIDC-provider step IRSA required; one EKS-side association replaces the cluster-specific IRSA trust-policy edit, which is the property that makes Pod Identity scale across many clusters without OIDC-provider sprawl. Scope deliberately bounded: this control covers (a)-(d) above; service-mesh integration, admission-controller frameworks beyond PSA, and runtime-detection agents are out of scope for this page and will be mentioned as v2 supplementary topics in a future release.

Remediation — AWS CLI

# Create a Pod Identity association: Kubernetes SA <-> IAM role mapping.
aws eks create-pod-identity-association \
  --cluster-name prod-cluster \
  --namespace orders \
  --service-account order-processor-sa \
  --role-arn arn:aws:iam::111122223333:role/eks-order-processor

# Update cluster: private endpoint only + full audit logging.
aws eks update-cluster-config \
  --name prod-cluster \
  --resources-vpc-config endpointPrivateAccess=true,endpointPublicAccess=false \
  --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

# Enforce Pod Security Admission restricted profile via namespace labels.
kubectl label namespace orders \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_eks_cluster" "prod" {
  name     = "prod-cluster"
  role_arn = aws_iam_role.cluster.arn
  version  = "1.30"

  vpc_config {
    subnet_ids              = aws_subnet.private[*].id
    endpoint_private_access = true
    endpoint_public_access  = false  # Private control plane only
  }

  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]

  encryption_config {
    provider { key_arn = aws_kms_key.eks.arn }
    resources = ["secrets"]
  }
}

# Pod Identity association (preferred over IRSA for new clusters).
resource "aws_eks_pod_identity_association" "order_processor" {
  cluster_name    = aws_eks_cluster.prod.name
  namespace       = "orders"
  service_account = "order-processor-sa"
  role_arn        = aws_iam_role.order_processor_pod.arn
}

resource "aws_iam_role" "order_processor_pod" {
  name = "eks-order-processor"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = ["sts:AssumeRole", "sts:TagSession"]
      Principal = { Service = "pods.eks.amazonaws.com" }
    }]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: EKS Pod Identity addon — installs the agent that mints scoped credentials per pod.
Parameters:
  ClusterName:
    Type: String
Resources:
  PodIdentityAgent:
    Type: AWS::EKS::Addon
    Properties:
      ClusterName: !Ref ClusterName
      AddonName: eks-pod-identity-agent
      ResolveConflicts: OVERWRITE

Compliance mapping

fields @timestamp, eventName, requestParameters.roleArn, requestParameters.roleSessionName, sourceIPAddress, userIdentity.sessionContext.sessionIssuer.arn
          | filter eventSource = "sts.amazonaws.com" and eventName = "AssumeRole"
          | parse requestParameters.roleArn /arn:aws:iam::(?<acct>\d+):role\/(?<role>.+)/
          | filter role like /^eks-pod-/
          | stats count() as n by sourceIPAddress, role
          | sort n desc
          | limit 50

Equivalent on: Azure · GCP · OCI

Build EC2 instances from golden AMIs produced by an EC2 Image Builder pipeline whose ImageRecipe applies the CIS Amazon Linux 2023 (or equivalent) hardening components, installs the SSM Agent, and distributes the resulting AMI to every workload region via a DistributionConfiguration (EC2 Image Builder User Guide (accessed 2026-05)). The pipeline rebuilds on a quarterly cadence AND on a CVE-driven trigger (a CRITICAL CVE in the base image fires the build via an EventBridge rule). Severity MEDIUM PREVENTIVE because golden AMIs reduce ongoing patch surface but are not by themselves the patch-management story — aws-work-08 (Patch Manager) handles post-deployment patches; golden AMIs handle initial-state hygiene. The pair (golden AMI + Patch Manager) is the AWS-native equivalent of the "immutable infrastructure with periodic re-baking" pattern.

Remediation — AWS CLI

# Create an image recipe referencing CIS-hardening component + SSM Distributor packages.
aws imagebuilder create-image-recipe \
  --name al2023-cis-hardened \
  --semantic-version 1.0.0 \
  --parent-image arn:aws:imagebuilder:eu-west-1:aws:image/amazon-linux-2023-x86/x.x.x \
  --components componentArn=arn:aws:imagebuilder:eu-west-1:aws:component/cis-amazon-linux-2023-hardening/1.0.0 \
               componentArn=arn:aws:imagebuilder:eu-west-1:aws:component/aws-cli-version-2-linux/1.0.0

# Create a pipeline with a quarterly schedule and CVE-driven rebuild trigger.
aws imagebuilder create-image-pipeline \
  --name al2023-cis-quarterly \
  --image-recipe-arn arn:aws:imagebuilder:eu-west-1:111122223333:image-recipe/al2023-cis-hardened/1.0.0 \
  --infrastructure-configuration-arn  \
  --distribution-configuration-arn  \
  --schedule 'scheduleExpression="cron(0 6 1 */3 ? *)",pipelineExecutionStartCondition=EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_imagebuilder_image_recipe" "al2023_cis" {
  name              = "al2023-cis-hardened"
  parent_image      = "arn:aws:imagebuilder:${var.region}:aws:image/amazon-linux-2023-x86/x.x.x"
  version           = "1.0.0"

  component { component_arn = "arn:aws:imagebuilder:${var.region}:aws:component/cis-amazon-linux-2023-hardening/1.0.0" }
  component { component_arn = "arn:aws:imagebuilder:${var.region}:aws:component/aws-cli-version-2-linux/1.0.0" }
}

resource "aws_imagebuilder_distribution_configuration" "multi_region" {
  name = "al2023-multi-region"
  dynamic "distribution" {
    for_each = var.workload_regions
    content {
      region = distribution.value
      ami_distribution_configuration {
        name = "al2023-cis-{{ imagebuilder:buildDate }}"
      }
    }
  }
}

resource "aws_imagebuilder_image_pipeline" "al2023_cis_quarterly" {
  name                             = "al2023-cis-quarterly"
  image_recipe_arn                 = aws_imagebuilder_image_recipe.al2023_cis.arn
  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.this.arn
  distribution_configuration_arn   = aws_imagebuilder_distribution_configuration.multi_region.arn

  schedule {
    schedule_expression                = "cron(0 6 1 */3 ? *)"
    pipeline_execution_start_condition = "EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE"
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: EC2 Image Builder pipeline producing a hardened golden AMI on a weekly cadence.
Parameters:
  RecipeArn:
    Type: String
  InfrastructureConfigArn:
    Type: String
  DistributionConfigArn:
    Type: String
Resources:
  GoldenAmiPipeline:
    Type: AWS::ImageBuilder::ImagePipeline
    Properties:
      Name: golden-ami-weekly
      ImageRecipeArn: !Ref RecipeArn
      InfrastructureConfigurationArn: !Ref InfrastructureConfigArn
      DistributionConfigurationArn: !Ref DistributionConfigArn
      Schedule:
        ScheduleExpression: cron(0 6 ? * SUN *)
        PipelineExecutionStartCondition: EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE
      Status: ENABLED

Compliance mapping

fields @timestamp, eventName, requestParameters.imageId, requestParameters.imagePipelineArn, requestParameters.containerRecipeArn, requestParameters.imageRecipeArn, userIdentity.arn
          | filter eventSource in ["ec2.amazonaws.com","imagebuilder.amazonaws.com"] and eventName in ["RunInstances","UpdateImagePipeline","CancelImageCreation","DeleteImagePipeline"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable AWS Systems Manager Patch Manager on every EC2 instance: define a patch baseline (the approved-patch ruleset per OS family), define a maintenance window (the time-of-day envelope when patches are applied), attach instances via tag-based patch groups, and surface patch-compliance metrics to AWS Config (AWS Systems Manager — Patch Manager (accessed 2026-05)). The DETECTIVE typology is deliberate: Patch Manager reports the compliance state of every managed instance against the baseline, and the maintenance-window automation is the remediation pair. Severity MEDIUM because the control is operational hygiene rather than single-step exploitation prevention; pairs with aws-work-04 (Inspector flags the CVEs that the baseline must include) and aws-work-07 (golden AMIs handle initial-state hygiene; Patch Manager handles steady-state drift).

Remediation — AWS CLI

# Create a patch baseline (Linux example).
aws ssm create-patch-baseline \
  --name AL2023-Security-Critical \
  --operating-system AMAZON_LINUX_2023 \
  --approval-rules 'PatchRules=[{
    PatchFilterGroup={PatchFilters=[
      {Key=CLASSIFICATION,Values=[Security]},
      {Key=SEVERITY,Values=[Critical,Important]}]},
    ApproveAfterDays=3,
    ComplianceLevel=CRITICAL}]'

# Create a maintenance window (Sundays 03:00 UTC, 4-hour cutoff).
aws ssm create-maintenance-window \
  --name patch-prod-weekly \
  --schedule 'cron(0 3 ? * SUN *)' \
  --duration 4 --cutoff 1 \
  --allow-unassociated-targets

# Register patching task on the maintenance window.
aws ssm register-task-with-maintenance-window \
  --window-id mw-0abc \
  --task-type RUN_COMMAND \
  --task-arn AWS-RunPatchBaseline \
  --targets Key=tag:PatchGroup,Values=prod \
  --task-invocation-parameters 'RunCommand={Parameters={Operation=[Install]}}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_ssm_patch_baseline" "al2023_security" {
  name             = "AL2023-Security-Critical"
  operating_system = "AMAZON_LINUX_2023"

  approval_rule {
    approve_after_days  = 3
    compliance_level    = "CRITICAL"
    patch_filter {
      key    = "CLASSIFICATION"
      values = ["Security"]
    }
    patch_filter {
      key    = "SEVERITY"
      values = ["Critical", "Important"]
    }
  }
}

resource "aws_ssm_patch_group" "prod_linux" {
  baseline_id = aws_ssm_patch_baseline.al2023_security.id
  patch_group = "prod"
}

resource "aws_ssm_maintenance_window" "patch_prod" {
  name     = "patch-prod-weekly"
  schedule = "cron(0 3 ? * SUN *)"
  duration = 4
  cutoff   = 1
}

resource "aws_ssm_maintenance_window_target" "prod" {
  window_id     = aws_ssm_maintenance_window.patch_prod.id
  resource_type = "INSTANCE"
  targets {
    key    = "tag:PatchGroup"
    values = ["prod"]
  }
}

resource "aws_ssm_maintenance_window_task" "patch_run" {
  window_id        = aws_ssm_maintenance_window.patch_prod.id
  task_arn         = "AWS-RunPatchBaseline"
  task_type        = "RUN_COMMAND"
  max_concurrency  = "20%"
  max_errors       = "5%"
  priority         = 1

  targets {
    key    = "WindowTargetIds"
    values = [aws_ssm_maintenance_window_target.prod.id]
  }

  task_invocation_parameters {
    run_command_parameters {
      parameter {
        name   = "Operation"
        values = ["Install"]
      }
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SSM Patch Manager baseline (critical+security) applied during a maintenance window.
Resources:
  ProdPatchBaseline:
    Type: AWS::SSM::PatchBaseline
    Properties:
      Name: prod-amazonlinux-baseline
      OperatingSystem: AMAZON_LINUX_2023
      ApprovalRules:
        PatchRules:
          - ApproveAfterDays: 0
            PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - Security
                - Key: SEVERITY
                  Values:
                    - Critical
                    - Important
            ComplianceLevel: CRITICAL
            EnableNonSecurity: false

Compliance mapping

fields @timestamp, eventName, requestParameters.windowId, requestParameters.windowTargetId, requestParameters.targets, userIdentity.arn
          | filter eventSource = "ssm.amazonaws.com" and eventName in ["DeleteMaintenanceWindow","DeregisterTargetFromMaintenanceWindow","UpdateMaintenanceWindow","DisassociateAssociation"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI