IMDS versions

IMDS distinguishes between v1 and v2 requests by presence of headers

• IMDSv2 uses token-backed sessions that expires after a maximum of six hours.
• MDSv1 disabled in Amazon Linux 2023
• Datadog: EC2 instances should enforce IMDSv2

aws ec2 modify-instance-metadata-defaults --http-tokens required

Activities

• Transition to using Instance Metadata Service Version 2

Related

• IMDSv2
• Use IMDSv2, Transition to using Instance Metadata Service Version 2
• aws ec2 modify-instance-metadata-options

See also

• IMDS, IMDS versions (IMDSv2), IMDS initiate session, ec2-imdsv2-check, aws ec2 modify-instance-metadata-options, /latest/meta-data, /latest/user-data, modify-instance-metadata-defaults

https://d1.awsstatic.com/events/reinvent/2019/Security_best_practices_for_the_Amazon_EC2_instance_metadata_service_SEC310

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html

https://docs.datadoghq.com/security/default_rules/aws-ec2-instance-ec2-instances-should-enforce-imdsv2/