AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2) misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_79
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	81c165ce-f66e-441a-8ea0-56a107175ccc

Impact

The Instance Metadata Service (IMDS) is an on-instance component used by code on the instance to securely access instance metadata.

You can access instance metadata from a running instance using one of the following methods:

• Instance Metadata Service Version 1 (IMDSv1) -- a request/response method

• Instance Metadata Service Version 2 (IMDSv2) -- a session-oriented method

As a request/response method IMDSv1 is prone to local misconfigurations:

• Open proxies, open NATs and routers, server-side reflection vulnerabilities.

• One way or another, local software might access local-only data.

How to Fix

Resource: AWS::EC2::LaunchTemplate

• Arguments: Properties.MetadataOptions.HttpEndpoint / Properties.MetadataOptions.HttpTokens [source,go]

---

Resources: IMDSv1Disabled: Type: AWS::EC2::LaunchTemplate Properties: ... LaunchTemplateData: ...

• MetadataOptions:

• HttpEndpoint: disabled

IMDSv2Enabled: Type: AWS::EC2::LaunchTemplate Properties: ... LaunchTemplateData: ...

• MetadataOptions:

• HttpTokens: required

---