EC2 launch template requires IMDSv2 or disables IMDS

Check ID: ec2_launch_template_imdsv2_required
Provider: AWS
Service: ec2
Severity: HIGH
Categories: secrets
Resource type: AwsEc2LaunchTemplate

What this check verifies

EC2 launch templates are inspected for Instance Metadata Service configuration. It identifies versions where http_endpoint is enabled and http_tokens is required (IMDSv2 enforced), versions with the metadata service disabled, and versions that allow metadata without requiring tokens.

Risk

Allowing metadata access without IMDSv2 enables SSRF and open proxy paths to query instance metadata, exposing temporary credentials and secrets. Attackers can steal IAM role credentials to access data, modify resources, and pivot within the account, threatening confidentiality and integrity.

Recommendation

Enforce IMDSv2 in all launch template versions by setting token use to required; disable the metadata service when not needed. Apply least privilege to instance roles and use defense in depth (egress filtering, input validation) to reduce SSRF paths. Ensure applications and SDKs are compatible with IMDSv2.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-launch-template-version --launch-template-id <example_resource_id> --source-version <example_source_version> --launch-template-data '{"MetadataOptions":{"HttpTokens":"required"}}'

resource "aws_launch_template" "<example_resource_name>" {
  name = "<example_resource_name>"

  metadata_options {
    http_tokens = "required" # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: <example_resource_name>
      LaunchTemplateData:
        MetadataOptions:
          HttpTokens: required  # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_launch_template_imdsv2_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires