When you provision a fleet of Amazon EC2 Ubuntu 22.04 or 24.04 LTS instances inside an AWS VPC, the AWS Shared Responsibility Model draws a strict line: AWS secures the underlying physical data centers and hypervisor, while you are responsible for securing the guest operating system.

Out of the box, default cloud Linux images prioritize convenience over zero-trust security:

OpenSSH often permits weak authentication defaults or generous retry limits ( MaxAuthTries ).

Kernel network parameters ( sysctl ) may allow IP spoofing, ICMP redirects, or unhardened packet forwarding.

Host-level firewalls ( UFW ) sit inactive, relying purely on external security groups without defense-in-depth at the OS layer.

Worse, when engineers manually SSH into an EC2 instance to debug an issue, configuration drift silently weakens your security posture across the fleet.

In my previous articles, I covered eliminating container CVEs in a shift-left FastAPI DevSecOps pipeline and cutting Amazon EKS & VPC infrastructure costs by…