Control: Auto Scaling group should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)
Description
This control checks whether IMDSv2 is enabled on all instances launched by AWS EC2 Auto Scaling groups. The control fails if the Instance Metadata Service (IMDS) version is not included in the launch configuration or if both IMDSv1 and IMDSv2 are enabled.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.autoscaling_launch_config_requires_imdsv2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.autoscaling_launch_config_requires_imdsv2 --shareSQL
This control uses a named query:
select launch_configuration_arn as resource, case when metadata_options_http_tokens = 'required' then 'ok' else 'alarm' end as status, case when metadata_options_http_tokens = 'required' then title || ' configured to use Instance Metadata Service Version 2 (IMDSv2).' else title || ' not configured to use Instance Metadata Service Version 2 (IMDSv2).' end as reason , region, account_idfrom aws_ec2_launch_configuration;