AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count grea

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_341
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	d9b2ff26-a1b3-49a7-885a-dade1183d193

Impact

This rule checks if the Launch template in AWS (Amazon Web Services) has a metadata response hop limit greater than 1. The metadata response hop limit is a security setting that determines how many networking hops (steps) an EC2 instance metadata request can traverse. If this limit is set to a value greater than 1, it could allow an attacker to potentially intercept the request and gain access to sensitive information. So it's always safer to limit it to 1 to minimize vulnerabilities.

How to Fix

Resource: aws_launch_configuration, aws_launch_template

• Arguments: metadata_options.http_put_response_hop_limit

To fix the issue, you should enable the HttpPutResponseHopLimit on the AWS launch template and set it to 1. This limits the number of hops a metadata packet can take to 1, ensuring that the IMDSv1 is not reachable. [source,go]

resource "aws_launch_template" "default" { name = "example"

block_device_mappings { device_name = "/dev/sda1" }

instance_market_options { market_type = "spot" }

metadata_options { http_tokens = "required" http_put_response_hop_limit = 1 } }