Control: 6.7 Ensure that the EC2 Metadata Service only allows IMDSv2
Description
When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).
Remediation
From Console:
- Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
- In the left navigation panel, under the
INSTANCES
section, chooseInstances
. - Select the EC2 instance that you want to examine.
- Choose
Actions > Instance Settings > Modify instance metadata options
. - Set
Instance metadata service
toEnable
. - Set
IMDSv2
toRequired
. - Repeat steps 1-6 to perform the remediation process for other EC2 instances in all applicable AWS region(s).
From Command Line:
- Run the
describe-instances
command, applying the appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region:
aws ec2 describe-instances --region <region-name> --output table --query "Reservations[*].Instances[*].InstanceId"
- The command output should return a table with the requested instance IDs.
- Run the
modify-instance-metadata-options
command with an instance ID obtained from the previous step to update the Instance Metadata Version:
aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name>
- Repeat steps 1-3 to perform the remediation process for other EC2 instances in the same AWS region.
- Change the region by updating
--region
and repeat the process for other regions.
Default Value:
By default, new EC2 instances support both IMDSv1 and IMDSv2. IMDSv1 (less secure) remains enabled unless explicitly restricted, so IMDSv2 must be manually required.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v600_6_7
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v600_6_7 --share
SQL
This control uses a named query:
select arn as resource, case when metadata_options ->> 'HttpTokens' = 'required' and metadata_options ->> 'State' = 'applied' then 'ok' else 'alarm' end as status, case when metadata_options ->> 'HttpTokens' = 'required' and metadata_options ->> 'State' = 'applied' then title || ' configured to use Instance Metadata Service Version 2 (IMDSv2).' else title || ' not configured to use Instance Metadata Service Version 2 (IMDSv2).' end as reason , region, account_idfrom aws_ec2_instance;