How do I configure instance metadata and activate tags on my EC2 instance?

Short description

You can set up default IMDS capabilities for new instances in your AWS account across all AWS Regions. By default, the latest instance types use Instance Metadata Service version 2 (IMDSv2). To use Instance Metadata Service version 1 (IMDSv1) on these instance types, you must manually activate IMDSv1 in the instance. It's a best practice to use IMDSv2 for security unless you must use IMDSv1.

Important: If you configure IMDSv2 on your instance, then IMDSv1 no longer works and applications that use IMDSv1 might not function correctly. Before you enforce IMDSv2, upgrade applications that use Amazon EC2 metadata to a version that supports IMDSv2. For more information about the differences between IMDSv1 and IMDSv2, see Use the Instance Metadata Service to access instance metadata.

By default, Amazon EC2 doesn't provide access to instance tags in the instance metadata. You must allow access at instance launch, or after launch on a running or stopped instance.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

You can use a combination of the following methods to configure instance metadata. However, you set the hierarchical order of precedence for the metadata options at instance launch.

How do I configure instance metadata at the AMI level?

You can configure an existing or new Amazon Machine Image (AMI) to use IMDSv2. When you launch an instance with the configured AMI, Amazon EC2 automatically sets the instance metadata version to IMDSv2 and the hop limit to 2.

Important: Make sure to verify that your AMI software supports IMDSv2. After you set the imds-support value to v2.0, you can't revert it. The only way to reset your AMI is to use the underlying snapshot to create a new AMI.

To configure a new AMI to use IMDSv2, run the following register-image AWS CLI command:

aws ec2 register-image \
    --name my-image \
    --root-device-name /dev/xvda \
    --block-device-mappings DeviceName=/dev/xvda,Ebs={SnapshotId=snap-0123456789example} \
    --architecture x86_64 \
    --imds-support v2.0

Note: Replace my-image with your AMI name, /dev/xvda with your root volume device name, snap-0123456789example with your snapshot ID, and x86_64 with your architecture.

To configure an existing AMI to use IMDSv2, run the following modify-image-attribute command:

aws ec2 modify-image-attribute \
    --image-id ami-0123456789example \
    --imds-support v2.0

Note: Replace ami-0123456789example with your existing AMI ID.

Allow tags in metadata in your launch template

You can't directly configure access to tags for your AMIs. You must create an Amazon EC2 launch template. Under Advanced details, set Allow tags in metadata to -. Instances that you launch from this launch template allow access to all the instance's tags from the instance metadata.

How do I configure instance metadata at the account level?

Set IMDSv2 for all instances in your account. Or, to allow IMDSv1, for Metadata version, select V1 and V2 (token optional). To allow access to tags in instance metadata at the account level, under IMDS defaults, set Access to tags in metadata to Enabled.

Important: You must configure instance metadata once for each Region in your account.

How do I configure instance metadata at the instance level?

Note: AWS Identity and Access Management (IAM) policies or service control policies (SCP) might restrict the changes that you can make to instance settings.

To configure access to IMDS and tags in metadata on a new instance, expand Advanced details when you launch the instance. Then, configure the following settings:

• For Metadata accessible, select Enabled.
• For Metadata version, select V2 only (token required) or V1 and V2 (token optional).
  Note: If you use a container environment, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS), then for Metadata response hop limit, select 2.
• For Access to tags in metadata, select Enabled.

To modify an existing instance, modify the settings. To use IMDSv1 or IMDSv2, select Optional for IMDSv2. To enforce IMDSv2, select Required. Then, under Instance settings, select Allow tags in instance metadata.

Related information

Amazon EC2 Instance Metadata Service IMDSv2 by default

Get the full benefits of IMDSv2 and deactivate IMDSv1 across your AWS infrastructure