Check provider logo

Confidential-workload host enforces IMDSv2

ec2_confidential_workload_host_imdsv2_not_enforced

Severityhigh
Serviceec2
by Prowler
identity-accessec2-imdsv1

Instances hosting Nitro Enclave workloads (EnclaveOptions.Enabled=true) are evaluated for IMDSv2 enforcement on the metadata service (HttpTokens=required). This check assesses the host environment; it does not audit the enclave itself.

Risk

IMDSv1 exposes temporary IAM credentials to SSRF and workload-compromise paths on the host, undermining the confidentiality of the identity the enclave workload depends on.

Run this check with Prowler CLI

prowler aws --checks ec2_confidential_workload_host_imdsv2_not_enforced

Run in Prowler Cloud

Recommendation

Apply defense in depth on identity surfaces: require IMDSv2 on every confidential-workload host so credentials cannot be lifted from the metadata service via SSRF or a compromised workload on the host.

Remediation

CLI

aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabled

Native IaC
Terraform
Other
  1. Open the EC2 console.
  2. Select the confidential-workload host and choose Actions > Instance settings > Modify instance metadata options.
  3. Set IMDS to Enabled and IMDSv2 to Required.
  4. Save.

Source Code

Resource Type

AwsEc2Instance

References