# EC2 IMDSv2 Not Required

> Flags running EC2 instances where IMDSv2 is not enforced, leaving role credentials exposed to SSRF-style theft.

Source: https://zop.dev/integrations/aws/recommendations/ec2-imdsv2-not-required

---

## What IMDSv1 leaves open

The instance metadata service hands out, among other things, temporary credentials for the
instance's IAM role. The [IMDS guide](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html)
describes two modes: IMDSv1, a plain request and response, and IMDSv2, a session-oriented method
where the caller first obtains a token with a PUT request. By default an instance accepts both.
AWS positions IMDSv2 as defence in depth against open firewalls, reverse proxies and SSRF
vulnerabilities, where an attacker tricks an application into fetching a URL on their behalf. A simple
GET is easy to smuggle through such a bug; the token handshake is not.

## Finding instances that do not require tokens

```bash
aws ec2 describe-instances \
  --filters Name=instance-state-name,Values=running Name=metadata-options.http-tokens,Values=optional \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType]' --output table
```

Before enforcing, check whether anything on the instance still uses IMDSv1. The `MetadataNoToken`
CloudWatch metric counts those calls, and AWS says an instance is ready once it records zero:

```bash
aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name MetadataNoToken \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time 2026-09-11T00:00:00Z --end-time 2026-09-25T00:00:00Z \
  --period 86400 --statistics Sum
```

## The condition checked

The instance must be running, and ZopNight must have read its metadata options and found that
IMDSv2 is not required. That is the whole test: no threshold, no window.

## Instances ZopNight does not flag

Stopped instances are skipped. If AWS did not return metadata options for an instance, ZopNight
has nothing to judge and stays silent. A tag claiming IMDSv2 is enforced has no effect; only the
setting AWS reports counts.

## Risk exposure, no dollar figure

The finding reports $0. The cost of leaving it is the blast radius of the instance role: any
credential stolen through the metadata service carries every permission that role has.

## Enforcing IMDSv2

1. Confirm `MetadataNoToken` is zero, or update scripts and SDKs that still make IMDSv1 calls.
2. Require tokens. AWS notes that setting `--http-tokens` also needs `--http-endpoint enabled`:
   `aws ec2 modify-instance-metadata-options --instance-id i-0123456789abcdef0 --http-tokens required --http-endpoint enabled`.
3. Test the application; any remaining IMDSv1 call now fails.
4. Set IMDSv2 as required in launch templates and AMI defaults so new instances start compliant.

**Warning**
Once IMDSv2 is required, IMDSv1 calls fail immediately. Enforce on one instance first and watch for errors.