Check provider logo

EC2 instance requires IMDSv2 or has the instance metadata service disabled

ec2_instance_imdsv2_enabled

Severityhigh
Serviceec2
by Prowler
identity-accesssecrets

EC2 instances are evaluated for IMDSv2 enforcement: metadata endpoint enabled with http_tokens: required, or metadata service fully disabled (http_endpoint: disabled).

Risk

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Run this check with Prowler CLI

prowler aws --checks ec2_instance_imdsv2_enabled

Run in Prowler Cloud

Recommendation

Apply defense in depth:

  • Require IMDSv2 tokens on all instances (http_tokens: required)
  • Disable metadata where not needed (http_endpoint: disabled)
  • Minimize hop limit to 1 when feasible
  • Update SDKs/apps for IMDSv2
  • Restrict instance profile permissions (least privilege)
  • Block metadata access from untrusted workloads

Remediation

CLI

aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabled

Native IaC
Terraform
Other
  1. In AWS Console, go to EC2 > Instances
  2. Select the instance > Actions > Instance settings > Modify instance metadata options
  3. Set Metadata version to IMDSv2 only (HTTP tokens: Required)
  4. Ensure Instance metadata service is Enabled (or set to Disabled to turn off IMDS entirely)
  5. Click Save

Source Code

Resource Type

AwsEc2Instance

References