Auto Scaling group enforces IMDSv2 or disables IMDS

Check ID: autoscaling_group_launch_configuration_requires_imdsv2
Provider: AWS
Service: autoscaling
Severity: HIGH
Categories: secrets
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

Amazon EC2 Auto Scaling launch configurations are evaluated for Instance Metadata Service settings. Instances should have the metadata endpoint enabled with http_tokens=required (enforcing IMDSv2), or have the metadata service disabled. Allowing http_tokens=optional or omitting the version leaves legacy access enabled.

Risk

Without enforced IMDSv2, SSRF and local escape paths can access IAM role credentials, enabling unauthorized API calls. Attackers could:

Exfiltrate data with stolen tokens
Move laterally and modify resources, degrading confidentiality and integrity

Recommendation

Require IMDSv2 for Auto Scaling-launched instances by setting http_tokens=required when metadata is enabled. If metadata is not needed, disable it. Apply least privilege to instance roles, set IMDSv2 as an account default, and use defense in depth (egress filtering, SSRF protections) to limit exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling create-launch-configuration --launch-configuration-name <new-launch-config> --image-id <AMI_ID> --instance-type <INSTANCE_TYPE> --metadata-options 'HttpTokens=required,HttpEndpoint=enabled'

# ASG launch configuration enforces IMDSv2
resource "aws_launch_configuration" "example" {
  image_id      = "<example_ami_id>"
  instance_type = "<example_instance_type>"

  metadata_options {
    http_tokens   = "required"  # critical: require IMDSv2 tokens (blocks IMDSv1)
    http_endpoint = "enabled"   # critical: IMDS enabled while enforcing v2
  }
}

resource "aws_autoscaling_group" "example" {
  launch_configuration = aws_launch_configuration.example.name
  min_size             = 1
  max_size             = 1
  vpc_zone_identifier  = ["<example_subnet_id>"]
}

# CloudFormation: ASG launch configuration enforces IMDSv2
Resources:
  LaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: <example_ami_id>
      InstanceType: <example_instance_type>
      MetadataOptions:
        HttpTokens: required     # critical: require IMDSv2 tokens (disables IMDSv1)
        HttpEndpoint: enabled    # critical: keep IMDS enabled while enforcing v2

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchConfigurationName: !Ref LaunchConfig
      MinSize: 1
      MaxSize: 1
      VPCZoneIdentifier:
        - <example_subnet_id>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_launch_configuration_requires_imdsv2. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Auto Scaling launch config assigns no public IP Auto Scaling group uses multiple Availability Zones

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires