c2.7 Enforce IMDSv2 on EC2 instances
The EC2 Instance Metadata Service (IMDS) hands temporary, rotating credentials to instances so you never hardcode keys. Require IMDSv2 everywhere — it adds session protections that block credential theft through SSRF, which IMDSv1 was vulnerable to.
Implementation guidance
Why IMDSv2
The Instance Metadata Service gives an instance temporary, frequently rotated credentials without hardcoding or distributing them. IMDSv2 makes the request session-oriented (a token is required), which prevents an attacker from reaching the metadata endpoint through a server-side request forgery (SSRF) vulnerability and stealing those credentials.
What to do
1. New instance launches now default to IMDSv2, but instances created before that change may still allow IMDSv1. Confirm new launches require IMDSv2 by default and reconfigure older instances. 2. Detect non-compliance with the AWS Security Hub CSPM control EC2.8 or the AWS Config ec2-imdsv2-check rule. 3. Set instances that still allow IMDSv1 to require IMDSv2, then disable IMDSv1 across your fleet — see Get the full benefits of IMDSv2.
Do it with the CLI
Require IMDSv2 (and disable IMDSv1) on an existing instance:
aws ec2 modify-instance-metadata-options \
--instance-id i-0123456789abcdef0 \
--http-tokens required \
--http-endpoint enabledMake every new launch in the account require IMDSv2 by default:
aws ec2 modify-instance-metadata-defaults \
--http-tokens required \
--http-endpoint enabledHow to validate
- Are your instances configured to require IMDSv2?
- Have you verified new EC2 launches require IMDSv2 by default?
- Do you use AWS Security Hub CSPM or AWS Config to detect instances still allowing IMDSv1?
Threats addressed
- An application vulnerable to SSRF on an instance still allowing IMDSv1 can be tricked into reading the instance credentials from the metadata endpoint and using them from outside the instance.
AWS services
Amazon EC2 
AWS Security Hub 
AWS Config Pricing
Enforcing IMDSv2 on Amazon EC2 is offered at no additional charge.