ASSOCIATED DRATA CONTROL
This test is part of the Baseline Configuration and Hardening Standards control (DCF-12) that ensures your company has identified and documented baseline security configuration standards for all system components in accordance with industry-accepted hardening standards or vendor recommendations. These standards are reviewed periodically and updated as needed (e.g., when vulnerabilities are identified) and verified to be in place before or immediately after a production system component is installed or modified (e.g., through infrastructure as code, configuration checklists, etc.).
WHAT TO DO IF A TEST FAILS
If Drata finds that one or more active AWS EC2 instances have Instance MetaData Service v1 (IMDSv1) enabled, which is vulnerable to server side request forgery (SSRF) attacks, the test will fail.
STEPS TO REMEDIATE
For Standalone EC2 Instances (Not in an ASG)
Sign into the AWS Management Console and navigate to the EC2 dashboard.
Select an instance to modify that is failing this test.
Choose 'Instance Settings' > 'Modify Instance Metadata Options'.
In the 'Modify Instance Metadata Options' dialogue box, set 'Metadata version' to 'IMDSv2,' set 'Http tokens' to 'required,' and optionally, configure 'Http endpoint' to 'enabled' if it's not already.
Save changes and repeat for each failing EC2 instance.
For EC2 Instances Managed by Auto Scaling Groups (ASG)
Sign In and navigate to ASG Settings
Sign into the AWS Management Console.
Go to EC2 → Auto Scaling Groups.
Select the relevant Auto Scaling Group (ASG).
Modify the Launch Template
In the Launch Template section, choose Actions → Modify Launch Template, or create a new version.
In the launch template editor, under Metadata Options, set:
Metadata version:
IMDSv2HTTP Tokens: required
HTTP Endpoint: enabled (optional)
Save the new launch template version.
Update the ASG to Use the New Launch Template Version
⚠️ This step is required. Without it, the ASG will continue launching instances with the previous configuration.
In the same ASG, go to the Launch Template section and select Edit.
Select the new version of the launch template.
Save your changes.
Start an Instance Refresh
While still in the ASG, go to the Instance refresh tab.
Select Start instance refresh.
Under Desired Configuration, select the correct launch template version.
Confirm and start the refresh.
💡 This will replace existing instances in batches using the updated launch template configuration.
Verify Compliance
Confirm new instances use IMDSv2 only.
Re-run the Drata test to ensure it passes.