EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)

How to fix it

• Can break clients: Software still making IMDSv1 calls loses metadata access (the MetadataNoToken metric counts them), and containers need a PUT response hop limit of at least 2, set with the CLI.

In the console

EC2 → Instances → the instance → Actions → Instance settings → Modify instance metadata options

Instance metadata service

Enable

IMDSv2

Required

With the AWS CLI

aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --http-endpoint enabled

With Terraform

resource "aws_instance" "this" {
  ami           = var.ami_id
  instance_type = var.instance_type

  metadata_options {
    http_endpoint = "enabled"
    http_tokens   = "required"
  }
}