Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.
ec2_instance_imdsv2_enabled
Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.
Risk
Using IMDSv2 will protect from misconfiguration and SSRF vulnerabilities. IMDSv1 will not.
Run this check with Prowler CLI
prowler aws --checks ec2_instance_imdsv2_enabled
ARN template
arn:partition:service:region:account-id:resource-id
Recommendation
If you don't need IMDS you can turn it off. Using aws-cli you can force the instance to use only IMDSv2.
Remediation
CLI
aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabled
Source Code
Resource Type
AwsEc2Instance