AWSOverview
When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).
Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.
Remediation guidance
From Console:
- Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
- In the left navigation panel, under the
INSTANCESsection, chooseInstances. - Select the EC2 instance that you want to examine.
- Choose
Actions > Instance Settings > Modify instance metadata options. - Ensure
Instance metadata serviceis set toEnableand setIMDSv2toRequired. - Repeat steps no. 1 – 5 to perform the remediation process for other EC2 Instances in the all applicable AWS region(s).
From Command Line:
- Run the
describe-instancescommand using appropriate filtering to list the IDs of all the existing EC2 instances currently available in the selected region:
aws ec2 describe-instances --region <region-name> --output table --query "Reservations[*].Instances[*].InstanceId"
- The command output should return a table with the requested instance IDs.
- Now run the
modify-instance-metadata-optionscommand using an instance ID returned at the previous step to update the Instance Metadata Version:
aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name>
- Repeat steps no. 1 – 3 to perform the remediation process for other EC2 Instances in the same AWS region.
- Change the region by updating
--regionand repeat the entire process for other regions.
References
- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
- https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
AWS
Use AWS Organizations guardrails, AWS Config rules or conformance packs where they fit, approved account baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Retrieve AWS VMs without IMDSv2 required
Connectors
Covered asset types
Expected check: eq []
{
vms(
where: { NOT: { metadataOptionHTTPTokens: "required" } }
) {...AssetFragment}
}
