# Ensure compute instance legacy metadata service endpoint is disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698520590523-ensure-compute-instance-legacy-metadata-service-endpoint-is-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every compute instance is configured to use only version 2 of the Instance Metadata Service (IMDSv2), with the legacy version 1 endpoints disabled. IMDSv2 requires an authorization header on every request, which makes metadata much harder to steal.

**Rationale**

The instance metadata service can reveal instance details and credentials used by instance principals. With the legacy v1 endpoints, a server-side request forgery (SSRF) flaw in an application can be used to read this metadata from outside. Requiring IMDSv2 blocks this common attack path and protects instance credentials.

**Impact**

-   Protects instance metadata and credentials from SSRF attacks
    
-   Applications must use IMDSv2 endpoints
    
-   Older images or tools that only support v1 may stop working
    

**Default Value**

By default, both IMDS version 1 and version 2 endpoints are enabled on many instances.

**Pre-Requisites**

-   Permission to manage instances in the compartment
    
-   Confirmation that the image and applications support IMDSv2
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.
    
3.  In the Instance information (Instance details) section, check the Instance metadata service value.
    
4.  Alternatively, run: oci compute instance get --instance-id <instance-ocid> and check that areLegacyImdsEndpointsDisabled is true.
    
5.  If version 1 is still allowed, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.
    
3.  Next to Instance metadata service, select Edit.
    
4.  Select Version 2 only and save the changes.
    
5.  Alternatively, run: oci compute instance update --instance-id <instance-ocid> --instance-options '{"areLegacyImdsEndpointsDisabled": true}'
    
6.  Confirm that applications on the instance still work.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.
    
3.  Next to Instance metadata service, select Edit, select Version 1 and version 2, and save the changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm](https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm)
    
-   [https://docs.oracle.com/en/learn/update-compute-imds/index.html](https://docs.oracle.com/en/learn/update-compute-imds/index.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.