--- title: Don't let Amazon EC2 be your attacker's way in description: Learn how improper EC2-user configurations on Amazon Linux 2 can expose your Java app to security risks like RCE and how to mitigate them. image: https://www.cloudnation.nl/hubfs/Right%20Banner%20size%20(5).png --- English an IG&H company [![_CN_Monogram_Color_White_rgb](https://www.cloudnation.nl/hubfs/_CN_Monogram_Color_White_rgb.png "Back to home") ![preview__CN_Logo_Left_Color_Black_rgb](https://www.cloudnation.nl/hubfs/preview__CN_Logo_Left_Color_Black_rgb.png "Back to home") ](https://www.cloudnation.nl/en/) Services Migrate [ Cloud Migration Realize a seamless transition to the cloud ](https://www.cloudnation.nl/en/services/cloud-migration) [ Cloud Readiness Assessment Before you start your journey on the cloud. ](https://www.cloudnation.nl/en/services/cloud-readiness-assessment) [ Cloud Landing Zone Accelerator The start of a cloud journey. ](https://www.cloudnation.nl/en/services/cloud-landing-zone-accelerator) [ Advice & Strategy Use the knowhow of our best experts. ](https://www.cloudnation.nl/en/services/strategy) [ Application Modernization Modernize, simplify and transform applications. ](https://www.cloudnation.nl/en/services/applicationmodernization) Improve & Modernize [ Cloud Security & Compliance Security & compliance ](https://www.cloudnation.nl/en/services/cloud-security/old) [ Cloud Competence Center Accelerate development. ](https://www.cloudnation.nl/en/cloud-center-of-excellence-cloudnation) [ FinOps Turn cloud spend into business value ](https://www.cloudnation.nl/en/cloudnation-finops) Integrate [ Hybrid cloud Combine the best of private and public cloud. ](https://www.cloudnation.nl/en/services/hybrid-cloud) [ Network & connectivity Use the cloud optimally and create value. ](https://www.cloudnation.nl/en/services/networking-connectivity) [ Managed Cloud Services ](https://www.cloudnation.nl/en/services/managed-cloud-services) [ Managed Kubernetes Services ](https://www.cloudnation.nl/en/en/services/managed-kubernetes-services) Data & AI [ AI Solutions Harness the power of artificial intelligence ](https://www.cloudnation.nl/en/artificial-intelligence) [ Data Landing Zone A secure and scalable foundation for your data operations. ](https://www.cloudnation.nl/en/services/data-landing-zone) [ Agent Lake The governed foundation for enterprise AI agents ](https://www.cloudnation.nl/en/agent-lake) [![aws-grey](https://www.cloudnation.nl/hubfs/aws-grey.svg) ](https://aws.amazon.com/free/?trk=3c7428a8-c52c-45ed-8072-8e2ba8bf9225&sc_channel=ps&ef_id=Cj0KCQjwwvilBhCFARIsADvYi7InrIXPaSi0tr77kUKV_-nyhN-NviOxvxIBVTUFilC3rM2czBruU-gaAuXlEALw_wcB:G:s&s_kwcid=AL!4422!3!649687334390!e!!g!!aws!19738730142!145148221566&all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*all) [![azure-grey](https://www.cloudnation.nl/hubfs/azure-grey.svg) ](https://azure.microsoft.com/en-us/free/search/?ef_id=_k_Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB_k_&OCID=AIDcmmy4pl1olr_SEM__k_Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB_k_&gclid=Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB) [![google-cloud-grey](https://www.cloudnation.nl/hubfs/google-cloud-grey.svg) ](https://cloud.google.com/gcp/?hl=nl&utm_source=google&utm_medium=cpc&utm_campaign=emea-nl-all-nl-bkws-all-all-trial-e-gcp-1011340&utm_content=text-ad-none-any-DEV_c-CRE_495030366170-ADGP_Hybrid+%7C+BKWS+-+EXA+%7C+Txt+~+GCP+~+General%23v3-KWID_43700060393215884-kwd-6458750523-userloc_9064924&utm_term=KW_google%20cloud-NET_g-PLAC_&&gad=1&gclid=Cj0KCQjwwvilBhCFARIsADvYi7Kh3LYZSTLyTiCJcfyw5z0iKjKdP0z6hgphICBbRRXr230tD1FvZiIaAh7OEALw_wcB&gclsrc=aw.ds) [![oracle-ci-grey](https://www.cloudnation.nl/hubfs/oracle-ci-grey.svg) ](https://www.oracle.com/) [ Services overview ](https://www.cloudnation.nl/en/services) [ Success stories ](https://www.cloudnation.nl/en/success-stories) Industries Our **cloud-native specialists** have deep** knowhow** and relevant **experience** in various industries [ Branches overview ](https://www.cloudnation.nl/en/industries) [ FinTech Accelerate FinTech innovations ](https://www.cloudnation.nl/en/industries/finance-fintech) [ ISV Remain future proof and transform your applications through the cloud ](https://www.cloudnation.nl/en/industries/isv) [ Manufacturing Improve operational efficiency, security and scalability of your processes. ](https://www.cloudnation.nl/en/industries/production-industry) [ Digital Natives Unlock new possibilities with cloud solutions designed for the digital pioneer. ](https://www.cloudnation.nl/en/branches/digital-natives) [ Inspiration ](https://www.cloudnation.nl/en/inspiration) About Us [ About CloudNation ](https://www.cloudnation.nl/en/about-us) [ Careers ](https://www.cloudnation.nl/en/careers) [ Our partners ](https://www.cloudnation.nl/en/partners) [ CloudNation Academy ](https://www.cloudnation.nl/en/cloud-academy) [ Contact ](https://www.cloudnation.nl/en/contact) [Plan a call ](https://www.cloudnation.nl/en/schedule-a-meeting) [![_CN_Monogram_Color_White_rgb](https://www.cloudnation.nl/hubfs/_CN_Monogram_Color_White_rgb.png "Back to home") ![preview__CN_Logo_Left_Color_Black_rgb](https://www.cloudnation.nl/hubfs/preview__CN_Logo_Left_Color_Black_rgb.png "Back to home") ](https://www.cloudnation.nl/en/) Services Migrate [ Cloud Migration Realize a seamless transition to the cloud ](https://www.cloudnation.nl/en/services/cloud-migration) [ Cloud Readiness Assessment Before you start your journey on the cloud. ](https://www.cloudnation.nl/en/services/cloud-readiness-assessment) [ Cloud Landing Zone Accelerator The start of a cloud journey. ](https://www.cloudnation.nl/en/services/cloud-landing-zone-accelerator) [ Advice & Strategy Use the knowhow of our best experts. ](https://www.cloudnation.nl/en/services/strategy) [ Application Modernization Modernize, simplify and transform applications. ](https://www.cloudnation.nl/en/services/applicationmodernization) Improve & Modernize [ Cloud Security & Compliance Security & compliance ](https://www.cloudnation.nl/en/services/cloud-security/old) [ Cloud Competence Center Accelerate development. ](https://www.cloudnation.nl/en/cloud-center-of-excellence-cloudnation) [ FinOps Turn cloud spend into business value ](https://www.cloudnation.nl/en/cloudnation-finops) Integrate [ Hybrid cloud Combine the best of private and public cloud. ](https://www.cloudnation.nl/en/services/hybrid-cloud) [ Network & connectivity Use the cloud optimally and create value. ](https://www.cloudnation.nl/en/services/networking-connectivity) [ Managed Cloud Services ](https://www.cloudnation.nl/en/services/managed-cloud-services) [ Managed Kubernetes Services ](https://www.cloudnation.nl/en/en/services/managed-kubernetes-services) Data & AI [ AI Solutions Harness the power of artificial intelligence ](https://www.cloudnation.nl/en/artificial-intelligence) [ Data Landing Zone A secure and scalable foundation for your data operations. ](https://www.cloudnation.nl/en/services/data-landing-zone) [ Agent Lake The governed foundation for enterprise AI agents ](https://www.cloudnation.nl/en/agent-lake) [![aws-grey](https://www.cloudnation.nl/hubfs/aws-grey.svg) ](https://aws.amazon.com/free/?trk=3c7428a8-c52c-45ed-8072-8e2ba8bf9225&sc_channel=ps&ef_id=Cj0KCQjwwvilBhCFARIsADvYi7InrIXPaSi0tr77kUKV_-nyhN-NviOxvxIBVTUFilC3rM2czBruU-gaAuXlEALw_wcB:G:s&s_kwcid=AL!4422!3!649687334390!e!!g!!aws!19738730142!145148221566&all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*all) [![azure-grey](https://www.cloudnation.nl/hubfs/azure-grey.svg) ](https://azure.microsoft.com/en-us/free/search/?ef_id=_k_Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB_k_&OCID=AIDcmmy4pl1olr_SEM__k_Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB_k_&gclid=Cj0KCQjwwvilBhCFARIsADvYi7IzQ1lpK0myTZJUEGM4La7kZrvaGTatFZ5ommalhQTlkevfIc4qPNsaAl4FEALw_wcB) [![google-cloud-grey](https://www.cloudnation.nl/hubfs/google-cloud-grey.svg) ](https://cloud.google.com/gcp/?hl=nl&utm_source=google&utm_medium=cpc&utm_campaign=emea-nl-all-nl-bkws-all-all-trial-e-gcp-1011340&utm_content=text-ad-none-any-DEV_c-CRE_495030366170-ADGP_Hybrid+%7C+BKWS+-+EXA+%7C+Txt+~+GCP+~+General%23v3-KWID_43700060393215884-kwd-6458750523-userloc_9064924&utm_term=KW_google%20cloud-NET_g-PLAC_&&gad=1&gclid=Cj0KCQjwwvilBhCFARIsADvYi7Kh3LYZSTLyTiCJcfyw5z0iKjKdP0z6hgphICBbRRXr230tD1FvZiIaAh7OEALw_wcB&gclsrc=aw.ds) [![oracle-ci-grey](https://www.cloudnation.nl/hubfs/oracle-ci-grey.svg) ](https://www.oracle.com/) [ Services overview ](https://www.cloudnation.nl/en/services) [ Success stories ](https://www.cloudnation.nl/en/success-stories) Industries Our **cloud-native specialists** have deep** knowhow** and relevant **experience** in various industries [ Branches overview ](https://www.cloudnation.nl/en/industries) [ FinTech Accelerate FinTech innovations ](https://www.cloudnation.nl/en/industries/finance-fintech) [ ISV Remain future proof and transform your applications through the cloud ](https://www.cloudnation.nl/en/industries/isv) [ Manufacturing Improve operational efficiency, security and scalability of your processes. ](https://www.cloudnation.nl/en/industries/production-industry) [ Digital Natives Unlock new possibilities with cloud solutions designed for the digital pioneer. ](https://www.cloudnation.nl/en/branches/digital-natives) [ Inspiration ](https://www.cloudnation.nl/en/inspiration) About Us [ About CloudNation ](https://www.cloudnation.nl/en/about-us) [ Careers ](https://www.cloudnation.nl/en/careers) [ Our partners ](https://www.cloudnation.nl/en/partners) [ CloudNation Academy ](https://www.cloudnation.nl/en/cloud-academy) [ Contact ](https://www.cloudnation.nl/en/contact) [Plan a call ](https://www.cloudnation.nl/en/schedule-a-meeting) [![_CN_Monogram_Color_White_rgb](https://www.cloudnation.nl/hubfs/_CN_Monogram_Color_White_rgb.png "Back to home") ![preview__CN_Logo_Left_Color_Black_rgb](https://www.cloudnation.nl/hubfs/preview__CN_Logo_Left_Color_Black_rgb.png "Back to home") ](https://www.cloudnation.nl/en/) [ Let's talk ](https://www.cloudnation.nl/en/schedule-a-meeting) Menu [![_CN_Monogram_Color_White_rgb](https://www.cloudnation.nl/hubfs/_CN_Monogram_Color_White_rgb.png "Back to home") ![preview__CN_Logo_Left_Color_Black_rgb](https://www.cloudnation.nl/hubfs/preview__CN_Logo_Left_Color_Black_rgb.png "Back to home") ](https://www.cloudnation.nl/en/) [ Let's talk ](https://www.cloudnation.nl/en/schedule-a-meeting) Menu Services Migrate [ Cloud Migration ](https://www.cloudnation.nl/en/services/cloud-migration) [ Cloud Readiness Assessment ](https://www.cloudnation.nl/en/services/cloud-readiness-assessment) [ Cloud Landing Zone Accelerator ](https://www.cloudnation.nl/en/services/cloud-landing-zone-accelerator) [ Advice & Strategy ](https://www.cloudnation.nl/en/services/strategy) [ Application Modernization ](https://www.cloudnation.nl/en/services/applicationmodernization) Improve & Modernize [ Cloud Security & Compliance ](https://www.cloudnation.nl/en/services/cloud-security/old) [ Cloud Competence Center ](https://www.cloudnation.nl/en/cloud-center-of-excellence-cloudnation) [ FinOps ](https://www.cloudnation.nl/en/cloudnation-finops) Integrate [ Hybrid cloud ](https://www.cloudnation.nl/en/services/hybrid-cloud) [ Network & connectivity ](https://www.cloudnation.nl/en/services/networking-connectivity) [ Managed Cloud Services ](https://www.cloudnation.nl/en/services/managed-cloud-services) [ Managed Kubernetes Services ](https://www.cloudnation.nl/en/en/services/managed-kubernetes-services) Data & AI [ AI Solutions ](https://www.cloudnation.nl/en/artificial-intelligence) [ Data Landing Zone ](https://www.cloudnation.nl/en/services/data-landing-zone) [ Agent Lake ](https://www.cloudnation.nl/en/agent-lake) [Services overview ](https://www.cloudnation.nl/en/services) [ Success stories ](https://www.cloudnation.nl/en/success-stories) Industries [ FinTech ](https://www.cloudnation.nl/en/industries/finance-fintech) [ ISV ](https://www.cloudnation.nl/en/industries/isv) [ Manufacturing ](https://www.cloudnation.nl/en/industries/production-industry) [ Digital Natives ](https://www.cloudnation.nl/en/branches/digital-natives) [Branches overview ](https://www.cloudnation.nl/en/industries) [ Inspiration ](https://www.cloudnation.nl/en/inspiration) About Us [ About CloudNation ](https://www.cloudnation.nl/en/about-us) [ Careers ](https://www.cloudnation.nl/en/careers) [ Our partners ](https://www.cloudnation.nl/en/partners) [ CloudNation Academy ](https://www.cloudnation.nl/en/cloud-academy) [ Contact ](https://www.cloudnation.nl/en/contact) [Let's talk ](https://www.cloudnation.nl/en/schedule-a-meeting) [Terug ](https://www.cloudnation.nl/inspiratie/blogs/) [News](https://www.cloudnation.nl/en/inspiration/blogs/tag/news) [Knowledge](https://www.cloudnation.nl/en/inspiration/blogs/tag/knowledge) [AWS](https://www.cloudnation.nl/en/inspiration/blogs/tag/aws) # Don't let Amazon EC2 be your attacker's way in ![](https://www.cloudnation.nl/hubfs/Nathan%20W%20-%20HR.jpeg) **Nathan Wouda** AWS Cloud Consultant Publish date: 7 April 2025 ![](https://www.cloudnation.nl/hs-fs/hubfs/Right%20Banner%20size%20(5).png?width=1600) [mailto:info@example.com?&subject=&body=https://www.cloudnation.nl/en/inspiration/blogs/dont-let-ec2-be-your-attackers-way-in](mailto:info@example.com?&subject=&body=https://www.cloudnation.nl/en/inspiration/blogs/dont-let-ec2-be-your-attackers-way-in) Having good security hygiene is standard practice when building cloud infrastructure. It is, however, quite difficult to think of all potential risks when doing so. This blog describes a situation on Amazon Web Services (AWS) that can be easily prevented, but also the risks involved in having this risk exposed.  ### Finding an attack vector Recently, when doing some preparations for an upcoming migration to AWS, I’ve been going through some scripts that set up the application environment for a Java application. One thing in particular stood out, which was the unintended exposure of root access to the customer application.  A script installing a Java application on an Amazon Linux 2 instance contained the following instruction:  $ chown -R ec2-user:ec2-user /srv    This immediately raised a red flag with me, because this could mean the application data needs to read and write to this folder, and the application user could very well be EC2-user. Now you tell me, “the application is not running as root, so this is good practice”. Well, perhaps in a Docker container, but keep in mind we are talking about Amazon Linux 2 here.     ### About the EC2-user The EC2-user on Amazon Linux 2 by default is a member of the group wheel. This is a group that allows administrator access. Because of the nature of the EC2-user and the way people get access to Amazon EC2 instances through the command line, no password is set at any point. Because of this, the sudoers file does not ask for a password whenever calling sudo as EC2-user.   ### Confirming my suspicions Going back to the Java application configuration, going over the rest of the script, it shows the application is managed through systems, and is accompanied by a service file. The contents of this file are:  [Unit]  Description=Generic Java application  [Service]  WorkingDirectory=/srv/generic  ExecStart=/srv/generic/init  User=ec2-user  Type=simple  Restart=on-failure  RestartSec=10    [Install]  WantedBy=multi-user.target ```   ``` Note the User parameter. It is set to EC2-user. This confirms that the application is run as the EC2-user.    ### Determining the impact  So now you have your Java application running as an administrator user, not as root. What’s so bad about that? Well, we’ve all seen these Remote Code Execution (RCE) vulnerabilities. An RCE enables an attacker to run any bit of arbitrary code on a vulnerable system. If your Java application is vulnerable to, let’s say, Log4Shell, an attacker would be able to spawn a shell on your system as EC2-user. Running any other command from that point on would be as easy as running sudo any command.  We can go far beyond this hypothetical situation in which we dive into what other possibilities this gives an attacker, but that would be a rabbit hole on its own. It suffices to say that with root access, the attacker can hide their evidence quite easily while being able to access any data on the system and possibly beyond. The solution in this case would be to limit the user used by the application. Create a new user with the least privilege needed for the application to work. #### AWS Security in Layers: Least privilege on EC2, data protection with Macie   Automating Data Security in AWS: Leveraging Amazon Macie for sensitive information management in large organizations   [Explore more ](https://www.cloudnation.nl/en/inspiration/blogs/automating-data-security-in-aws-amazon-macie) ![CloudNation-beeld-gh3hx-7](https://7979774.fs1.hubspotusercontent-na1.net/hubfs/7979774/CloudNation-beeld-gh3hx-7.jpg) [mailto:info@example.com?&subject=&body=https://www.cloudnation.nl/en/inspiration/blogs/dont-let-ec2-be-your-attackers-way-in](mailto:info@example.com?&subject=&body=https://www.cloudnation.nl/en/inspiration/blogs/dont-let-ec2-be-your-attackers-way-in) ![](https://www.cloudnation.nl/hubfs/Nathan%20W%20-%20HR.jpeg) **Nathan Wouda** AWS Cloud Consultant Publish date: 7 April 2025 ## More knowledge, how-to's and insights for inspiration [![](https://7979774.fs1.hubspotusercontent-na1.net/hubfs/7979774/Right%20Banner%20size%20%2842%29.png) News ## IG&H acquires CloudNation from Atomic Group Lees verder ](https://www.cloudnation.nl/en/inspiration/blogs/igh-acquires-cloudnation-from-atomic-group) [![](https://7979774.fs1.hubspotusercontent-na1.net/hubfs/7979774/Right%20Banner%20size%20%2810%29-1.png) News Azure ## Microsoft Channel AI Market Maker Partner of the Year 2025! Lees verder ](https://www.cloudnation.nl/en/inspiration/blogs/microsoft-channel-ai-market-maker-partner-of-the-year-2025) [![](https://7979774.fs1.hubspotusercontent-na1.net/hubfs/7979774/Right%20Banner%20size%20%288%29.png) News AWS ## CloudNation achieves AWS Premier Partner status Lees verder ](https://www.cloudnation.nl/en/inspiration/blogs/cloudnation-achieves-aws-premier-partner-status) Follow us: ##### Contact Kosterijland 10 3981 AJ Bunnik [![blue-chat-icon](https://www.cloudnation.nl/hubfs/Development%20assets/blue-chat-icon.svg)   Chat with us ](https://www.cloudnation.nl/en/inspiration/blogs/dont-let-ec2-be-your-attackers-way-in#hs-chat-open) [![blue-phone-call](https://www.cloudnation.nl/hubfs/Development%20assets/blue-phone-call.svg)   +31 (0)6 48 016 896 ](tel:0031648016896) [![blue-mail](https://www.cloudnation.nl/hubfs/Development%20assets/blue-mail.svg)   info@cloudnation.nl ](mailto:info@cloudnation.nl) ![iso 27001](https://www.cloudnation.nl/hubfs/iso%2027001.svg)  ![gdpr compliant](https://www.cloudnation.nl/hubfs/gdpr%20compliant.svg)   ![iso 27001](https://www.cloudnation.nl/hubfs/iso%2027001.svg)  ![gdpr compliant](https://www.cloudnation.nl/hubfs/gdpr%20compliant.svg)   ##### CloudNation [ About CloudNation ](https://www.cloudnation.nl/en/about-us) [ Careers ](https://www.cloudnation.nl/werken-bij) [ CloudNation Academy ](https://www.cloudnation.nl/en/cloud-academy) [ Contact ](https://www.cloudnation.nl/contact) ##### Partners [ All our partners ](https://www.cloudnation.nl/en/partners) [ AWS ](https://www.cloudnation.nl/en/partners/amazon-web-services#aws-partner) [ Azure ](https://www.cloudnation.nl/en/partners#microsoft-azure-partner) [ And lots more ](https://www.cloudnation.nl/en/partners) ##### Knowledge, howto's and insights of CloudNation in your mailbox