All checks
High
Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)
Checks that the launch configuration requires IMDSv2 (MetadataOptions HttpTokens set to required), whose session tokens protect instance metadata, including role credentials, from SSRF flaws IMDSv1 is exposed to. Every launch configuration in the Region is read, including ones no Auto Scaling group uses; a group on a launch template is not read here.
- service
- AutoScaling
- severity
- High
- scope
- evaluated in every region
How to fix it
- Replaces the resource: A launch configuration cannot be changed: copy it to a launch template, add a version requiring IMDSv2 and make it the default, switch each group to it, then delete this one.
- Can break clients: Running instances keep IMDSv1 until the group replaces them, by an instance refresh or scaling, and software on a replacement still using IMDSv1 then loses metadata access.
- Affects another check: EC2.170 reads the new template's default version, so it fails while the default is still the copied version that allows IMDSv1.
In the console
EC2 → Auto Scaling → Launch configurations, and the Launch template or configuration setting on the Auto Scaling group
- Metadata accessible
- Enabled, in the launch template
- Metadata version
- V2 only (token required)
- Launch template
- The new template, on each group using this launch configuration
- Version
- Default
See which of your accounts this check is failing on.
Book a live scan