# Ensure EC2 Instance Metadata Service v2 (IMDSv2) Configured

- Source: https://support.icompaas.com/support/solutions/articles/62000228266-ensure-ec2-instance-metadata-service-v2-imdsv2-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

EC2 contains metadata on how this metadata is accessed. AWS Instance Metadata Service (IMDS) provides a convenient way to access metadata about a running EC2 instance, such as hostname, network configuration, security groups, etc. It is accessible only from within the instance. IMDSv2 is based on session-based authentication. IMDSv2 uses session-oriented requests. 

## **Rationale:**

AWS EC2 Instance Metadata Service (IMDSv2) is used for improving security and adding an additional defense in depth layer. It uses token-based authentication for requesting data from the endpoint, and in order to get the token, a separate PUT request has to be made.

## **Impact:**

IMDSv2 configuration will help to protect against a misconfigured web application firewall (WAF) that allows requests to EC2 instances. 

## **Default Value:**

IMDSv2 will be disabled by default.

## **Pre-Requisite:**

-   An EC2 instance in running state
    

## **Remediation:**

### **Test Plan:**

-   **AWS Console Process**
    

You can't use the Amazon EC2 console for existing instance metadata options. You can opt in to require that IMDSv2 be used when requesting instance metadata.

**Using AWS CLI**

aws ec2 describe-instances \\  
    --instance-ids <instance id> \\  
    --metadata-options.http-endpoint

### **Implementation Steps:**

-   **AWS Console Process**
    

You can't use the Amazon EC2 console for existing instance to modify metadata options. You can opt in to require that IMDSv2 is used when requesting instance metadata.

-   For new EC2 instance
    

1.  Login to AWS console and select EC2 in the home pane.
    
2.  Select **Instances** in the left pane ![](https://support.icompaas.com/assets/kb/8e816aff82767ed6.png) 
    
3.  Click on **Launch instances** to launch a new instance
4.  Give the required name for the instance and desired OS, instance type, security groups as needed.
5.  Under Advanced details select Metadata accessible **Enabled** and Metadata version to **V2only**. ![](https://support.icompaas.com/assets/kb/487d19e560a18e1c.png) 
6.  Click on **launch** instance.

  

**Using AWS CLI**

The following `modify-instance-metadata-options` example configures the use of IMDSv2 on the specified instance.

aws ec2 modify-instance-metadata-options \\  
    --instance-id i-1234567898abcdef0 \\  
    --http-tokens required \\  
    --http-endpoint enabled

Command to launch a new instance with metadata enabled IMDSv2 

aws ec2 run-instances \\  
    --image-id ami-0abcdef1234567890 \\  
    --instance-type t2.micro \\  
    --subnet-id subnet-08fc749671b2d077c \\  
    --security-group-ids sg-0b0384b66d7d692f9 \\  
    --key-name MyKeyPair  
    --metadata-options enabled  
    --http-tokens required \\  
    --http-endpoint enabled

## **Backout Plan:**

-   **AWS Console Process**
    

You can't use the Amazon EC2 console for an existing instance to modify metadata options. You can opt in to require that IMDSv2 be used when requesting instance metadata.

**Using AWS CLI**

To disable IMDSv2 from EC2

aws ec2 modify-instance-metadata-options \\  
 --instance-id < Instance Id >  \\  
  --http-endpoint enabled \\

## **Reference:**

[![](https://support.icompaas.com/assets/kb/1ab74fc646b23f14.png)Retrieve instance metadata - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html) 

[![](https://support.icompaas.com/assets/kb/e2b9c327441438db.png)Use IMDSv2 - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) 

[Modify instance metadata options for existing instances - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.