---
title: "EC2 instances"
description: "The EC2 instance details an AWS integration brings into Guardian."
product: "Guardian"
edition: "Classic"
type: "reference"
url: "https://docs.cloudhouse.com/guardian/classic/control/integrations/ec2-instances/"
---
# EC2 instances

When creating an AWS integration with Guardian, you can choose to detect and add your EC2 instance(s) to Guardian for monitoring. For more information on how to set up an AWS integration, see [AWS Integration](https://docs.cloudhouse.com/guardian/classic/control/integrations/aws-integration/index.md).

Applies to: `Guardian Classic`

When detecting an EC2 instance via Guardian, you can choose to detect one or both of the following node types:

| Node Types | Description |
| --- | --- |
| Instance nodes | This option detects any Windows or Linux nodes within your EC2 instance(s). |
| Configuration data nodes | This option detects the EC2 configuration data associated with the EC2 instance(s). |

These nodes represent the EC2 virtual machine instance and its associated configuration. For more information on the differences between these nodes, see below.

## AWS Integration

On the **AWS Integration** page, if the **EC2 Instances** checkbox is selected from the list of **Check Things You Want To Detect** checkboxes, the following options are displayed:

**Detect EC2 Virtual Machines (e.g. the Windows/Linux VMs)** checkbox
:   The option to detect the EC2 Virtual Machine (**VM**) instance, that is, the operating system and its associated components. For example, users, services and packages.

    If selected, the **Operating System** column in the **Detected** tab (**Inventory** > **Detected**) displays any detected instance nodes as 'A type of Windows' or 'A type of Linux'.

**Host name property** drop-down list
:   The name of the AWS property that will be used to detect the nodes. Select an option from the drop-down list.

**Linux Credentials** drop-down
:   When scanning Linux nodes, provide your Linux credentials according to the following:

    - **Linux Connection Manager Group** drop-down list – The Connection Manager group that is responsible for scanning any non-Windows node(s) in your EC2 instance. Select a Connection Manager group from the drop-down list.

    - **SSH Port (Optional)** field – The Secure Shell (**SSH**) port number that the Linux Connection Manager uses to communicate with the target nodes for scanning.

        If you selected a Linux Connection Manager from the drop-down list above, enter the port number you are using. If no value is provided, Guardian will default to port 22.

        !!! note

            If you enter a port number that is different to the default (port 22), make sure that it matches the port number that the administrator of the target node is using to run their SSH server.

    - Credentials – Option to use credentials stored in the Guardian Credentials Vault or Azure Key Vault. Select one of the options below:

        - **Guardian Credentials Vault** – Use credentials stored in your Guardian instance. Select an option from the **Linux Credentials** drop-down list. Additionally, you can select 'Add New Credential' to display the **Create Credential** dialog if you anticipate using these same credentials for other nodes or integrations. For more information, see [Create Credential](https://docs.cloudhouse.com/guardian/classic/inventory/credentials/credentials/index.md#create-credential).

            !!! note

                This option is only available if you have the **Credentials** feature enabled. If you don't, you'll be prompted to enter a **Username** and **Password** for authentication.

        - **Azure Key Vault** – Use credentials stored in your organisation's Azure Key Vault. The credentials displayed are based on the Azure Key Vault integration. For more information, see [Azure Key Vault Credentials](https://docs.cloudhouse.com/guardian/classic/inventory/credentials/azure-key-vault-credentials/index.md).

            !!! note

                The Azure Key Vault feature was introduced in V3.63.0 of the Guardian Web Application. This is an optional feature that must be enabled. For more information, see [February 2026 Monthly Release](https://docs.cloudhouse.com/guardian/classic/what-s-new/1-current-release/monthly/february-2026/index.md).

            If selected, you are required to provide the following information:

            - **Username** field – Enter the username of the Azure account required to access the Azure Key Vault. This must be the same account that the selected Azure Key Vault secret belongs to.

            - **Azure Key Vault Items** drop-down list – Select a secret from the list. The secrets displayed are based on values from the Key Vault(s) configured in the Azure Key Vault integration.

                !!! tip

                    For more information, see [Azure Key Vault Integration](https://docs.cloudhouse.com/guardian/classic/control/integrations/azure-key-vault-integration/index.md).

                !!! warning

                    This option is only displayed if you have the Azure Key Vault feature enabled. If you don't, you'll be prompted to enter a **Username** and **Password** for authentication.

    If no value is provided, the nodes are added to the **Detected** tab, regardless of whether the **Automatically start monitoring and scanning newly detected nodes** checkbox is selected.

**Windows Credentials** drop-down
:   When scanning Windows nodes, provide your Windows credentials according to the following:

    - **Windows Connection Manager** drop-down list – The Connection Manager group that is responsible for scanning any Windows node(s) in your EC2 instance. Select a group from the drop-down list.

    - **WinRM Port** field – The default port for WinRM. Enter 5985 for HTTP-based connections, or 5986 for HTTPS/cert-based connections. If you are using non-standard ports for WinRM, enter them here.

    - **Windows Credentials** – Option to use a stored credential. Select an option from the **Credentials** drop-down list. Additionally, you can select 'Add New Credential' to display the **Create Credential** dialog if you anticipate using these same credentials for other nodes or integrations. For more information, see [Create Credential](https://docs.cloudhouse.com/guardian/classic/inventory/credentials/credentials/index.md#create-credential).

        !!! note

            This option is only available if you have the **Credentials** feature enabled. If you don't, you'll be prompted to enter a **Username** and **Password** for authentication.

    If no value is provided, the nodes are added to the **Detected** tab, regardless of whether the **Automatically start monitoring and scanning newly detected nodes** checkbox is selected.

**Detect EC2 Virtual Machines Configurations** checkbox
:   The option to detect the EC2 configuration data associated with the EC2 instance. This option detects any security groups, policies, storage properties, load balancers, and other options attached to the AWS EC2 instance.

    If selected, once the integration is created, any detected configuration data node(s) are displayed with 'Config' appended to its name and the OS type is 'AWS EC2 VM Configuration' to differentiate it from the associated instance. For example, 'Windows Server 2022 Config'.

Once the correct values have been set for the above fields, you can choose the **Detection Options** for your integration. By default, any detected nodes are displayed within the **Detected** tab of your Guardian instance, with the appended identifier attributed to that EC2 instance's node type.

If you choose to promote a detected node to the **Monitored** tab (**Inventory** > **Monitored**) for regular scanning, it will be automatically added to the corresponding dynamic node group. For example, configuration nodes are added to ‘AWS EC2 Virtual Machine Configuration’ node groups regardless of whether they are Windows or Linux.

!!! note

    If a Windows node group is not present in your Guardian instance, it will be automatically created upon the addition of a monitored Windows node. For more information, see [Node Groups](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/node-groups/node-groups/index.md).

However, if you choose to select the **Automatically start monitoring and scanning newly detected nodes** checkbox, all detected nodes are added to the **Monitored** tab. Here, they are automatically added to the corresponding Windows, Linux ,or AWS EC2 Virtual Machine Configuration node groups.

Once you have set the correct values for each of the EC2 options displayed, you can continue completing the options to add the AWS integration to the **Integrations** tab (**Control** > **Integrations**) of your Guardian instance.