Description

Ensure every compute instance is configured to use only version 2 of the Instance Metadata Service (IMDSv2), with the legacy version 1 endpoints disabled. IMDSv2 requires an authorization header on every request, which makes metadata much harder to steal.

Rationale

The instance metadata service can reveal instance details and credentials used by instance principals. With the legacy v1 endpoints, a server-side request forgery (SSRF) flaw in an application can be used to read this metadata from outside. Requiring IMDSv2 blocks this common attack path and protects instance credentials.

Impact

  • Protects instance metadata and credentials from SSRF attacks

  • Applications must use IMDSv2 endpoints

  • Older images or tools that only support v1 may stop working

Default Value

By default, both IMDS version 1 and version 2 endpoints are enabled on many instances.

Pre-Requisites

  • Permission to manage instances in the compartment

  • Confirmation that the image and applications support IMDSv2

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. In the Instance information (Instance details) section, check the Instance metadata service value.

  4. Alternatively, run: oci compute instance get --instance-id <instance-ocid> and check that areLegacyImdsEndpointsDisabled is true.

  5. If version 1 is still allowed, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. Next to Instance metadata service, select Edit.

  4. Select Version 2 only and save the changes.

  5. Alternatively, run: oci compute instance update --instance-id <instance-ocid> --instance-options '{"areLegacyImdsEndpointsDisabled": true}'

  6. Confirm that applications on the instance still work.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. Next to Instance metadata service, select Edit, select Version 1 and version 2, and save the changes.

Reference