Remediation
Using AWS CloudFormationβ
- CloudFormation template (YAML):
AWSTemplateFormatVersion: '2010-09-09'
Description: Enforce IMDSv2 on a specified EC2 instance
Parameters:
InstanceId:
Type: String
Description: EC2 Instance ID to update with IMDSv2 enforcement
Resources:
EnforceIMDSv2:
Type: AWS::EC2::Instance
Properties:
InstanceId: !Ref InstanceId
MetadataOptions:
HttpTokens: required
From Command Lineβ
- Run
the describe-instances
command using appropriate filtering to list the IDs of all the existing EC2 instances currently available in the selected region:
aws ec2 describe-instances --region <region-name> --output table --query "Reservations[*].Instances[*].InstanceId"
- The command output should return a table with the requested instance IDs.
- Now run the
modify-instance-metadata-options
command using an instance ID returned at the previous step to update the Instance Metadata Version:
aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name>
- Repeat steps no. 1 β 3 to perform the remediation process for other EC2 Instances in the same AWS region.
- Change the region by updating
--region
and repeat the entire process for other regions.
From Consoleβ
- Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
- In the left navigation panel, under the
INSTANCES
section, chooseInstances
. - Select the EC2 instance that you want to examine.
- Choose
Actions
>Instance Settings
>Modify instance metadata options
. - Ensure
Instance metadata service
is set toEnable
and setIMDSv2
toRequired
. - Repeat steps no. 1 β 5 to perform the remediation process for other EC2 Instances in the all applicable AWS region(s).