Skip to main content

Server Security: Applying Security Updates to Your EC2 Instance

Enhance the server security of a Red Hat Enterprise Linux EC2 instance by monitoring and applying system updates.

This is the first part of our Server Security on AWS series. In this series, we will explore some ways to enhance the security of a Red Hat Enterprise Linux EC2 instance. We may also touch on Amazon Linux where appropriate. This will by no means be an exhaustive list of the things you can do to harden and enhance the security posture of your cluster of EC2 instances, but it should be sufficient to get you moving in the right direction.

In this article, we will look at installing security updates and how, by default, Amazon Linux and Red Hat Enterprise Linux differ.

Server Security: monitoring system notices

When you launch an Amazon Linux instance for the first time, you will see the message of the day (MOTD). Amazon Linux will install both the critical and important security updates at launch time by default.

       __|  __|_  )
       _|  (     /   Amazon Linux AMI
      ___|\___|___|
https://aws.amazon.com/amazon-linux-ami/2015.09-release-notes/

If (right after the release notes link) your MOTD message indicates that you have additional security updates to install, they tend to be of a lower severity, but you should still install them as soon as you can.

# yum update --security

Right now there are no security updates I need to install myself. If there were, they would be generated by the 70-available-updates script:

# cat /etc/update-motd.d/70-available-updates | head -5
#!/bin/bash
# Possible summaries include:
# No packages needed for security; %d packages available
# %d package(s) needed[ (+%d related)] for security, out of %d available
# There are [[%d security update(s)[ out of ]%d total update(s)]] available

On Red Hat Enterprise Linux, you have to install the security updates yourself. RHEL does not install any critical or important security updates automatically. Using yum update, I’m shown a handful of packages that I should update in my newly launched instance:

# yum update --security | egrep -e '^(I|U).*\)$'
Install   1 Package  (+1 Dependent package)
Upgrade  23 Packages (+4 Dependent packages)

Server Security: applying updates

Running yum update --security lets you apply all the available security updates and ignore any other non-security updates. This is to ensure that you do not introduce additional – and unnecessary – changes to your EC2 instance, especially if stability is a priority.

To keep up with the security updates you may have to apply on Amazon Linux, you can watch the security bulletins as they are published at the Amazon Linux AMI Security Centre.

If you have a specific RHEL CVE (Common Vulnerabilities and Exposures) ID you would like to explore, you can query it using Red Hat’s CVE Database.

This was just a quick start to whet your appetite for more. In our next article, we will explore using firewall-cmd to configure firewall rules in your Red Hat Enterprise Linux 7 EC2 instance. You might also like to take Cloud Academy’s Introduction to Security Best Practices and Linux Security courses.

Any thoughts? Why not share them in the comments below.

Avatar

Written by

Eugene Teo

Eugene Teo is a director of security at a US-based technology company. He is interested in applying machine learning techniques to solve problems in the security domain.

Related Posts

Avatar
Stuart Scott
— June 20, 2019

Working with AWS Networking & Amazon VPC

Being able to architect your own isolated segment of AWS is a simple process using VPCs; understanding how to architect its related networking components and connectivity architecture is key to making it a powerful service.Many services within Amazon Web Services (AWS) require you t...

Read more
  • AWS
  • VPC
Avatar
Stuart Scott
— June 19, 2019

AWS Compute Fundamentals Update

AWS is renowned for the rate at which it reinvents, revolutionizes, and meets customer demands and expectations through its continuous cycle of feature and service updates. With hundreds of updates a month, it can be difficult to stay on top of all the changes made available.  Here ...

Read more
  • AWS
Jeff Hyatt
Jeff Hyatt
— June 18, 2019

10 Steps for an Effective Reserved Instances Strategy

Amazon Web Services (AWS) offers three different ways to pay for EC2 Instances: On-Demand, Reserved Instances, and Spot Instances. This article will focus on effective strategies for purchasing Reserved Instances. While most of the major cloud platforms offer pre-pay and reservation dis...

Read more
  • AWS
  • EC2
Joe Nemer
Joe Nemer
— June 18, 2019

AWS Certification Practice Exam: What to Expect from Test Questions

If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 11 certifications that cover major cloud roles including Solutions Architect, De...

Read more
  • AWS
  • AWS Certifications
Avatar
John Chell
— June 13, 2019

AWS Certified Solutions Architect Associate: A Study Guide

The AWS Solutions Architect - Associate Certification (or Sol Arch Associate for short) offers some clear benefits: Increases marketability to employers Provides solid credentials in a growing industry (with projected growth of as much as 70 percent in five years) Market anal...

Read more
  • AWS
  • AWS Certifications
Chris Gambino and Joe Niemiec
Chris Gambino and Joe Niemiec
— June 11, 2019

Moving Data to S3 with Apache NiFi

Moving data to the cloud is one of the cornerstones of any cloud migration. Apache NiFi is an open source tool that enables you to easily move and process data using a graphical user interface (GUI).  In this blog post, we will examine a simple way to move data to the cloud using NiFi c...

Read more
  • AWS
  • S3
Avatar
Chandan Patra
— June 11, 2019

Amazon DynamoDB: 10 Things You Should Know

Amazon DynamoDB is a managed NoSQL service with strong consistency and predictable performance that shields users from the complexities of manual setup.Whether or not you've actually used a NoSQL data store yourself, it's probably a good idea to make sure you fully understand the key ...

Read more
  • AWS
  • DynamoDB
Avatar
Andrew Larkin
— June 6, 2019

The 11 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS Certifications
Sam Ghardashem
Sam Ghardashem
— May 15, 2019

Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway

Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.Deploying any next generation firewall in a public cloud environment is challenging, not because of the f...

Read more
  • AWS
Joe Nemer
Joe Nemer
— May 3, 2019

AWS Config Best Practices for Compliance

Use AWS Config the Right Way for Successful ComplianceIt’s well-known that AWS Config is a powerful service for monitoring all changes across your resources. As AWS Config has constantly evolved and improved over the years, it has transformed into a true powerhouse for monitoring your...

Read more
  • AWS
  • Compliance
Avatar
Francesca Vigliani
— April 30, 2019

Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago

Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...

Read more
  • AWS
  • AWS Summits
Paul Hortop
Paul Hortop
— April 2, 2019

How to Monitor Your AWS Infrastructure

The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...

Read more
  • AWS
  • Monitoring