Skip to main content
All CollectionsMonitoringTests
Test 292: AWS EC2 Instances IMDSv1 Disabled
Test 292: AWS EC2 Instances IMDSv1 Disabled

Drata validates that active AWS EC2 instances have Instance MetaData Service Version 1 (IMDSv1) disabled.

Updated over a month ago

ASSOCIATED DRATA CONTROL

This test is part of the Baseline Configuration and Hardening Standards control (DCF-12) that ensures your company has identified and documented baseline security configuration standards for all system components in accordance with industry-accepted hardening standards or vendor recommendations. These standards are reviewed periodically and updated as needed (e.g., when vulnerabilities are identified) and verified to be in place before or immediately after a production system component is installed or modified (e.g., through infrastructure as code, configuration checklists, etc.).

WHAT TO DO IF A TEST FAILS

If Drata finds that one or more active AWS EC2 instances have Instance MetaData Service v1 (IMDSv1) enabled, which is vulnerable to server side request forgery (SSRF) attacks, the test will fail.

STEPS TO REMEDIATE

  1. Sign into the AWS Management Console and navigate to the EC2 dashboard.

  2. Select an instance to modify that is failing this test.

  3. Choose 'Instance Settings' > 'Modify Instance Metadata Options'.

  4. In the 'Modify Instance Metadata Options' dialogue box, set 'Metadata version' to 'IMDSv2,' set 'Http tokens' to 'required,' and optionally, configure 'Http endpoint' to 'enabled' if it's not already.

  5. Save changes and repeat for each failing EC2 instance.

Did this answer your question?