EC2 instance requires IMDSv2 or has IMDS disabled

Check ID: ec2_instance_imdsv2_enabled
Provider: AWS
Service: ec2
Severity: HIGH
Categories: identity-access, secrets
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are evaluated for IMDSv2 enforcement: metadata endpoint enabled with http_tokens: required, or metadata service fully disabled (http_endpoint: disabled).

Risk

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Recommendation

Apply defense in depth:

Require IMDSv2 tokens on all instances (http_tokens: required)
Disable metadata where not needed (http_endpoint: disabled)
Minimize hop limit to 1 when feasible
Update SDKs/apps for IMDSv2
Restrict instance profile permissions (least privilege)
Block metadata access from untrusted workloads

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-instance-metadata-options —instance-id <instance-id> —http-tokens required —http-endpoint enabled

# Enforce IMDSv2 on an EC2 instance
resource "aws_instance" "<example_resource_name>" {
  ami           = "<example_resource_id>"
  instance_type = "<example_resource_name>"

  metadata_options {
    http_tokens = "required"  # Critical: Require IMDSv2 tokens (blocks IMDSv1)
  }
}

# CloudFormation: enforce IMDSv2 on an EC2 instance
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: "<example_resource_id>"
      InstanceType: "<example_resource_name>"
      MetadataOptions:
        HttpTokens: required  # Critical: Require IMDSv2 tokens (blocks IMDSv1)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_imdsv2_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires