AWS SageMaker notebook instance allows for IMDSv1 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_371
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule checks whether SageMaker Notebook Instances are configured to use Instance Metadata Service version 2 (IMDSv2). MDSv2 reduces security risks by requiring session-oriented requests, unlike the vulnerable IMDSv1 which is susceptible to server-side request forgery (SSRF) attacks and potential unauthorized access. This improves the overall security posture of your AWS resources.

How to Fix

Resource: AWS::SageMaker::NotebookInstance

• Arguments: Properties/InstanceMetadataServiceConfiguration/MinimumInstanceMetadataServiceVersion

Ensure that the Amazon Sagemaker Notebook Instance is configured to only allow Instance Metadata Service Version 2 (IMDSv2), by setting the MinimumInstanceMetadataServiceVersion to 2, as displayed in the example below. [source,go]

Resources: Example: Type: "AWS::SageMaker::NotebookInstance" Properties: ... InstanceMetadataServiceConfiguration: MinimumInstanceMetadataServiceVersion: "2"