EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

How to fix it

Create a new launch template version with metadata access set to required, then make that version the default. A version cannot be edited, and stopping after the first step leaves instances launching from the old default and this finding open. Only the default version is read here. Anything that reads instance metadata without a token stops working, including older AWS SDK versions. Instances already running are unaffected; EC2.8 reads those.

In the console

EC2 → Launch templates → the template → Actions → Modify template (Create new version) → Advanced details → Metadata version

With Terraform

resource "aws_launch_template" "this" {
  update_default_version = true
  metadata_options {
    http_tokens = "required"
  }
}