EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)

How to fix it

• Can break clients: On instances launched from it, software still making IMDSv1 calls, such as an older AWS SDK, loses metadata access; containers also need a hop limit of 2.
• Affects another check: Instances already launched from the template keep their metadata options, so EC2.8 still fails on each until it is changed or replaced.

In the console

• Replaces the resource: A launch template version cannot be edited: create a new version requiring IMDSv2, then make it the default (Actions → Set default version), the only version this check reads.

EC2 → Launch Templates → the template → Actions → Modify template (Create new version) → Advanced details

Metadata accessible

Enabled

Metadata version

V2 only (token required)

With Terraform

resource "aws_launch_template" "this" {
  update_default_version = true
  metadata_options {
    http_tokens = "required"
  }
}