6WAF

EC2 instance is not patch compliant

HIGH

What's the problem

Patch Manager reports NON_COMPLIANT: patches missing, failed, installed but waiting for a reboot, or on the rejected list. Only running instances registered with SSM that Patch Manager has scanned are checked; instances never scanned are not evaluated

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Patching & containers (Patch Manager, ECR)

Reference standard: AWS Security Hub SSM.2

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 132) automatically in ~10 minutes

Start free

Related checks

ECR repository does not scan imagesECR repository policy allows any AWS account