Transition to using Instance Metadata Service Version 2

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html

• CloudWatch: MetadataNoToken

• Use an AMI that configures IMDSv2 by default
  • HttpTokens set to required
  • aws ec2 modify-instance-metadata-defaults --http-tokens
    • Terraform resource: aws ec2 instance metadata defaults
  • aws ec2 modify-instance-metadata-options

Terraform:

• metadata_options: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options
  • http_tokens = required

Related

• Datadog: EC2 instances should enforce IMDSv2
• ec2-imdsv2-check
• aws_instance

See also

• IMDS, IMDS versions (IMDSv2), IMDS initiate session, ec2-imdsv2-check, aws ec2 modify-instance-metadata-options, /latest/meta-data, /latest/user-data, modify-instance-metadata-defaults