- Newest
- Most votes
- Most comments
The first thing to look at is whether the instance is actually the long-standing instance that you think it is, and that an instance didn't somehow get terminated and a new one provisioned from scratch. What is the launch date & time of the instance?
Also check that all the attached EBS volumes that you expect to be attached are actually still attached. If your website code was on an external volume that has become detached then the symptoms would be similar to what you describe.
You can use CloudTrail to see which users have logged in to AWS Console recently, as well as what actions they did in the Console while they were logged in https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html
Are there any logins that look suspicious? If the account root login is not protected by MFA then definitely add this https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html
On the instance itself, look through the access logs (what these are depends on the OS). Consider changing any passwords that may be shared, and rotating any keypairs that may be used to gain access. If the server is accessible over the internet then especially consider any accounts that are vulnerable to brute-force attacks. And again, if accessible from the internet then tighten up the IP address range that key administration ports (e.g. 22 for SSH, 3389 for RDP) are accessible from. Or consider using Systems Manager.
Hi,
The best way to start investigating is to use CloudTrail. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html
CloudTrail will record who does what when through the EC2 API. So, that you detect the EC2 / EBS API calls and their authors.
Best,
Didier
Relevant content
- asked a year ago
Note that the launch time shown in the console is the time when the server was last powered on, which may or may not match the time it was created. You can see the effective time when the server was created by opening the "Storage" tab of the instance in the console and clicking the EBS volume ID that is the root (operating system) volume. The creation time of the volume is when the operating system disk was created. This also reveals if someone else has rolled it back to an earlier backup, as an example.