Ec2 instances without imdsv2 remediation

Using Console

Using CLI

The Instance Metadata Service (IMDS) is a service provided by Amazon Web Services (AWS) that allows EC2 instances to retrieve metadata about themselves and their environment. IMDSv2 is a newer version of the service that provides additional security features.To remediate the “Require IMDSv2 for EC2 Instances” misconfiguration in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or EC2 instance with appropriate IAM permissions.
Run the following command to enable IMDSv2 on all running EC2 instances in the current region:

aws ec2 modify-instance-metadata-options --instance-id $(curl -s http://169.254.169.254/latest/meta-data/instance-id) --http-put-response-hop-limit 1 --http-endpoint enabled

This command uses the modify-instance-metadata-options API to enable IMDSv2 on the current EC2 instance by passing --http-endpoint enabled and --http-put-response-hop-limit 1 parameters.

To enable IMDSv2 on all new EC2 instances launched in the current region, run the following command:

aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 1 --http-endpoint enabled

This command uses the modify-instance-metadata-options API to enable IMDSv2 on all new EC2 instances launched in the current region by passing --http-endpoint enabled and --http-put-response-hop-limit 1 parameters.

Verify that the IMDSv2 is enabled on the EC2 instance by running the following command:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

This command should return the security credentials associated with the instance’s IAM role, indicating that IMDSv2 is enabled.By following these steps, you can remediate the “Require IMDSv2 for EC2 Instances” misconfiguration in AWS using AWS CLI.

Using Python

The Instance Metadata Service (IMDS) is a service provided by AWS that allows EC2 instances to retrieve information about themselves and their environment. IMDSv1 is the default version of the service, but it has some security vulnerabilities that can be exploited by attackers. IMDSv2 is a more secure version of the service that addresses these vulnerabilities.To remediate the “Require IMDSv2 For EC2 Instances” misconfiguration in AWS using Python, you can follow these steps:

Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

Create a new Python script and import the necessary libraries:

import boto3
from botocore.exceptions import ClientError

Create a new session and EC2 client:

session = boto3.Session()
ec2_client = session.client('ec2')

Get a list of all EC2 instances in your account:

response = ec2_client.describe_instances()
instances = [i for r in response['Reservations'] for i in r['Instances']]

For each instance, check if IMDSv2 is already enabled:

for instance in instances:
    instance_id = instance['InstanceId']
    try:
        response = ec2_client.describe_instance_attribute(
            InstanceId=instance_id,
            Attribute='instanceMetadataOptions'
        )
        imds_mode = response['InstanceMetadataOptions']['HttpEndpoint']
        if imds_mode == 'enabled' and response['InstanceMetadataOptions']['HttpTokens'] == 'required':
            print(f"IMDSv2 already enabled for instance {instance_id}")
            continue
    except ClientError as e:
        if e.response['Error']['Code'] == 'InvalidInstanceID.NotFound':
            print(f"Instance {instance_id} not found")
            continue
        else:
            raise e

If IMDSv2 is not enabled, update the instance attribute to enable it:

response = ec2_client.modify_instance_metadata_options(
    InstanceId=instance_id,
    HttpEndpoint='enabled',
    HttpTokens='required'
)
print(f"IMDSv2 enabled for instance {instance_id}")

Save and run the Python script to remediate the misconfiguration.

Note: This script assumes that you have the necessary permissions to modify EC2 instance attributes in your AWS account.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Ec2 instances without imdsv2 remediation

Triage and Remediation

Remediation