Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)

How to fix it

Set at creation: fixing it means replacing the resource.

Have the launch configuration the finding names either requiring IMDSv2, with MetadataOptions.HttpTokens set to required, or deleted. A launch configuration cannot be modified, and AWS has closed creating new ones to newer accounts, so the setting moves onto a launch template with the Auto Scaling group repointed at it. That alone does not clear the finding: this check reads every launch configuration in the Region whether a group uses it or not, and the delete is refused while a group still refers to it.

In the console

EC2 → Auto Scaling → Launch configurations, and the Launch template or configuration setting on the Auto Scaling group