# 5.7 Ensure that the EC2 Metadata Service Only Allows IMDSv2 (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234166-5-7-ensure-that-the-ec2-metadata-service-only-allows-imdsv2-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### **Profile Applicability** **Level 1** #### **Description** Amazon EC2 instances support two versions of the Instance Metadata Service (IMDS): - IMDSv1: Uses a simple request/response model. - IMDSv2: Implements a session-oriented model with temporary session tokens. IMDSv2 enhances instance security by requiring session-based authentication before metadata can be retrieved. Amazon recommends enforcing IMDSv2 to minimize exposure to Server-Side Request Forgery (SSRF) attacks and other unauthorized metadata access. #### Rationale: The Instance Metadata Service allows software on EC2 instances to access metadata including instance identity and temporary credentials. IMDSv1 allows unrestricted metadata requests, increasing the risk of SSRF vulnerabilities. By enforcing IMDSv2: - Only requests with valid session tokens can access metadata. - Applications must explicitly acquire tokens before metadata access, preventing automated or background exploitation. - The attack surface is minimized, reducing the risk of compromised credentials or internal metadata leakage. #### Impact: If IMDSv1 is permitted, malicious or compromised applications can exploit SSRF to obtain sensitive instance metadata, such as IAM role credentials. This can result in privilege escalation, lateral movement, and unauthorized AWS resource access. #### Default Value: By default, EC2 instances launched without specifying metadata options allow both IMDSv1 and IMDSv2. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - ec2:DescribeInstances - ec2:ModifyInstanceMetadataOptions - Access to the AWS Management Console - Identify regions and instances where configuration must be applied #### Remediation: ##### Test Plan: Using AWS Console: 1. Log in to the [AWS EC2 Console](https://console.aws.amazon.com/ec2/) 2. Navigate to Instances 3. Select an instance 4. Check Metadata Options under Instance Details 5. Ensure: - Metadata version is set to IMDSv2 only - HTTP tokens are marked as required Using AWS CLI: aws ec2 describe-instances \\ --query "Reservations\[\].Instances\[?MetadataOptions.HttpTokens!='required'\].InstanceId" \\ --output table This command lists instances not enforcing IMDSv2. ##### Implementation Plan: Using AWS Console: 1. Go to the EC2 Dashboard 2. Select the instance 3. Choose Actions → Instance Settings → Modify instance metadata options 4. Set: - Instance metadata service: Enabled - Metadata version: IMDSv2 only (HTTP tokens required) 5. Click Save changes Using AWS CLI: aws ec2 modify-instance-metadata-options \\ --instance-id \\ --http-tokens required \\ --http-endpoint enabled \\ --region Repeat for all EC2 instances across your AWS regions. #### Backout Plan: If applications require IMDSv1 and fail after enforcement: 1. Temporarily re-enable IMDSv1: aws ec2 modify-instance-metadata-options \\ --instance-id \\ --http-tokens optional \\ --region 2. Identify and refactor application components dependent on IMDSv1 3. Reapply \--http-tokens required after resolving dependencies #### References: - [AWS Documentation: Instance Metadata Service ](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) - [AWS Security Blog: Preventing SSRF with IMDSv2 ](https://aws.amazon.com/blogs/security/defense-in-depth-open-to-ssrf-imds-v2/) - [AWS CLI Reference: modify-instance-metadata-options ](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.8

Uninstall or Disable Unnecessary Services on Enterprise Assets and Software

CIS v7

5.2

Maintain Secure Images for Enterprise Systems

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.