Description

Detects EC2 instances with disabled termination protection, which could allow accidental or malicious termination of instances. This security check is critical for protecting scheduled instances and capacity-block instances from unintended shutdown or deletion.

Detection Strategy

• Checks only scheduled instances and capacity-block instances, excluding Auto Scaling group instances

• Verifies the DisableApiTermination attribute for each instance

• Reports a vulnerability when termination protection is set to false (disabled)

• Considers an instance vulnerable if it allows API-based termination