Launch Templates Should Only Allow IMDSv2

Overview

With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally-stored EC2 instance metadata and credentials. The software starts a session with a simple HTTP PUT request to IMDSv2.

Remediation guidance

AWS remediation

Console

Open Launch Templates.
Create a new version.
Set metadata options: HttpTokens required.
Set new version as default.

AWS CLI

aws ec2 create-launch-template-version \
  --launch-template-id <lt-id> \
  --source-version <current-version> \
  --launch-template-data '{"MetadataOptions":{"HttpTokens":"required"}}'
aws ec2 modify-launch-template --launch-template-id <lt-id> --default-version <new-version-number>

References

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template-version.html

Multiple Remediation Paths

AWS

SERVICE-WIDE (RECOMMENDED when many resources are affected): Deploy centralized guardrails and remediation using AWS Config Conformance Packs and (if applicable) AWS Organizations SCPs.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

ASSET-LEVEL: Apply the resource-specific remediation steps above to only the affected assets.

PREVENTIVE: Add CI/CD policy checks (CloudFormation/Terraform validation) before deployment to prevent recurrence.

References for Service-Wide Patterns

AWS Config Conformance Packs: https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html
AWS Organizations SCP examples: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

AWS: deploy/adjust organization conformance packs and policy guardrails.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Retrieve AWS Launch Templates without IMDSv2 required

Connectors

AWS

Covered asset types

LaunchTemplateVersion

Expected check: eq []

{
  launchTemplateVersions(
    where: { NOT: { metadataOptionHTTPTokens: "required" } }
  ) {...AssetFragment}
}