---
title: EC2 instances should enforce IMDSv2
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > EC2 instances should enforce IMDSv2
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EC2 instances should enforce IMDSv2
 
## Description{% #description %}

Amazon EC2 instances should enforce the IMDSv2 session-oriented method to access instance metadata. IMDSv1 uses insecure GET requests and responses that are exposed to SSRF, misconfigured reverse proxies, and open firewalls, while IMDSv2 requires a session token. This check verifies that each instance's metadata options have `http_tokens` set to `required` and `state` set to `applied` (instances with a pending metadata change fail until the change is applied), including instances launched by an Auto Scaling group. Instances that are shutting down or terminated are skipped.

## Remediation{% #remediation %}

1. In the [EC2 console](https://console.aws.amazon.com/ec2/), select the instance and choose **Actions > Instance settings > Modify instance metadata options**, and set **Instance metadata service** to **Enable** and **IMDSv2** to **Required**.
1. Alternatively, run `aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name>` for each instance in every applicable region, as described in [Transition to using Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html).

## References{% #references %}

- [Transition to using Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html)
- [Misconfiguration spotlight: IMDS](https://securitylabs.datadoghq.com/articles/misconfiguration-spotlight-imds/)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)