Control: 24 Paravirtual EC2 instance types should not be used
Description
This control checks whether the virtualization type of an EC2 instance is paravirtual. The control fails if the virtualizationType of the EC2 instance is set to paravirtual.
Linux Amazon Machine Images (AMIs) use one of two types of virtualization: paravirtual (PV) or hardware virtual machine (HVM). The main differences between PV and HVM AMIs are the way in which they boot and whether they can take advantage of special hardware extensions (CPU, network, and storage) for better performance.
Historically, PV guests had better performance than HVM guests in many cases, but because of enhancements in HVM virtualization and the availability of PV drivers for HVM AMIs, this is no longer true. For more information, see Linux AMI virtualization types in the Amazon EC2 User Guide for Linux Instances.
Remediation
For information about how to update an EC2 instance to a new instance type, see Change the instance type in the Amazon EC2 User Guide for Linux Instances.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_ec2_24
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_ec2_24 --share
SQL
This control uses a named query:
ec2_instance_virtualization_type_no_paravirtual