Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
ec2_instance_account_imdsv2_enabledProvider: AWS
Service:
ec2Severity: HIGH
Categories:
secretsResource type:
AwsEc2InstanceWhat this check verifies
EC2 account IMDS defaults withhttp_tokens=required ensure new instances in the Region use IMDSv2 by default and disable IMDSv1. Existing instances keep their current setting.
Risk
Without a default of IMDSv2, new instances may enable IMDSv1, exposing metadata via simple HTTP. SSRF or proxy misconfigs can steal temporary IAM credentials, enabling data exfiltration (confidentiality), unauthorized API changes (integrity), and lateral movement that can disrupt services (availability).Recommendation
Enforce IMDSv2 at the account level in every Region by settinghttp_tokens to required. Add guardrails with SCP/IAM conditions. Standardize AMIs and launch templates to require tokens, validate workload compatibility, and apply least privilege to instance roles for defense in depth. For containers, prefer hop limit 2.
Remediation
- CLI
- Dashboard steps
aws ec2 modify-instance-metadata-defaults —region <region> —http-tokens required
References
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/EC2/require-imds-v2.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = ec2_instance_account_imdsv2_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks