---
title: EC2 instances should enforce IMDSv2
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > EC2 instances should enforce IMDSv2
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EC2 instances should enforce IMDSv2
 
## Description{% #description %}

Amazon EC2 instances should enforce the IMDSv2 session-oriented method to access instance metadata. IMDSv1 uses insecure GET requests and responses that are exposed to SSRF, misconfigured reverse proxies, and open firewalls, while IMDSv2 requires a session token. This check verifies that each instance's metadata options have `http_tokens` set to `required` and `state` set to `applied` (instances with a pending metadata change fail until the change is applied), including instances launched by an Auto Scaling group. An instance with missing metadata options fails, and so does an instance whose metadata endpoint is disabled while `http_tokens` is `optional`, as in the CIS audit. Instances that are shutting down or terminated are skipped, and an instance with a missing or empty state fails.

## Remediation{% #remediation %}

Confirm that the software on each affected instance supports IMDSv2, then follow [Transition to using Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html) to require IMDSv2 on the instance in every applicable region.

## References{% #references %}

- [Transition to using Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html)
- [Misconfiguration spotlight: IMDS](https://securitylabs.datadoghq.com/articles/misconfiguration-spotlight-imds/)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)