How can I use Systems Manager automation to enforce only IMDSv2 access to my EC2 instance metadata?

Short description

By default, you use one or both of the following methods to retrieve instance metadata from a running Amazon EC2 instance:

• Instance Metadata Service Version 1 (IMDSv1), a request/response method
• IMDSv2, a session-oriented method

To require the use of IMDSv2 on an instance, run the AWS Systems Manager AWSSupport-ConfigureEC2Metadata runbook.

Important: When you enforce IMDSv2, you deactivate IMDSv1. This might affect applications that rely on IMDSv1. Before you enforce IMDSv2, make sure that all applications that use Amazon EC2 metadata are compatible with IMDSv2. For additional guidance on implementation best practices, see Recommended path to requiring IMDSv2.

Resolution

Prerequisites: To run the automation and read the output, you must have ssm:StartAutomationExecution and ssm:GetAutomationExecution permissions.

Run the AWSSupport-ConfigureEC2Metadata automation and choose Simple execution for Execute mode. Or, choose Rate control to run the automation on multiple targets. Then, configure the following settings for Input parameters:

• For InstanceId, enter the ID of your EC2 instance.
• For HttpPutResponseHopLimit, keep the default 0 to retain the current value. Or, enter a new value between 1 and 64.
• For EnforceIMDSv2, choose required.
• For MetadataAccess, choose enabled.
• (Optional) For AutomationAssumeRole, choose a role. If you don't specify a role, then the automation uses the permissions of the user that runs the document.
  Note: To change the target EC2 instance, the AutomationAssumeRole or user role must have ec2:ModifyInstanceMetadataOptions and ec2:DescribeInstances permissions. For more information about how to configure roles, see Create the service roles for Automation using the console.

Related information

Access instance metadata for an EC2 instance