EC2 instance must enforce IMDSv2 (metadata tokens required)

High AWS General aws-ec2-instance-imdsv2-2

Applies to

AWS::EC2::Instance

What CGPulse checks

A resource passes this rule when metadataOptions.httpTokens must equal required. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Require IMDSv2 to prevent SSRF-based credential theft from the metadata service. In AWS Console: EC2 > Instance settings > Modify instance metadata options > set HttpTokens to required. See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

CLI

aws ec2 modify-instance-metadata-options --instance-id "{id}" --http-tokens required

Terraform

resource "aws_instance" "{name}" {
  metadata_options {
    http_tokens = "required"
  }
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan