All checks
High
EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)
Verifies that EC2 instances require IMDSv2 (HttpTokens set to required). Its session tokens protect instance metadata, including the role credentials it serves, from the SSRF flaws, open reverse proxies and open firewalls that IMDSv1 is exposed to.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Instances → the instance → Actions → Instance settings → Modify instance metadata options
With the AWS CLI
aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabledWith Terraform
resource "aws_instance" "this" {
ami = var.ami_id
instance_type = var.instance_type
metadata_options {
http_endpoint = "enabled"
http_tokens = "required"
}
}See which of your accounts this check is failing on.
Book a demo