Instance Metadata Service version 1 is enabled
Description
The Instance Metadata Service (IMDS) is an on-instance component used by code on the instance to securely access instance metadata. You can access instance metadata from a running instance using one of the following methods:
- Instance Metadata Service Version 1 (IMDSv1) – a request/response method
- Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method
As a request/response method IMDSv1 is prone to local misconfigurations:
- Open proxies, open NATs and routers, server-side reflection vulnerabilities.
- One way or another, local software might access local-only data.
Fix - Buildtime
Terraform
- Resource: aws_instance
- Arguments: http_tokens – (Optional) Whether or not the metadata service requires session tokens, the mechanism used for Instance Metadata Service Version 2. Can be “optional” or “required”. (Default: “optional”). Set to “required” to enable Instance Metadata Service V2.
Alternatively, disable the metadata service altogether by setting http_endpoint = "disabled".
resource “aws_instance” “example” {
…
instance_type = “t2.micro”
+ metadata_options {
…
+ http_endpoint = “enabled”
+ http_tokens = “required”
+ }
…
}
If setting http_tokens = "required" in a launch template that is being used for a EKS worker/node group, you should consider setting the http_put_response_hop_limit = 2 per the default behavior in EKS.
Without this setting the default service account in EKS will not be able to access the instance metadata service.
CloudFormation
- Resource: AWS::EC2::LaunchTemplate
- Arguments: Properties.MetadataOptions.HttpEndpoint / Properties.MetadataOptions.HttpTokens
Resources:
IMDSv1Disabled:
Type:AWS::EC2::LaunchTemplate
Properties:
…
LaunchTemplateData:
…
+ MetadataOptions:
+ HttpEndpoint: disabled
IMDSv2Enabled:
Type: AWS::EC2::LaunchTemplate
Properties:
…
LaunchTemplateData:
…
+ MetadataOptions:
+ HttpTokens: required