EC2 instance should require IMDSv2 (token-based metadata access)

What it checks

EC2 instance should require IMDSv2 (token-based metadata access)

Where it applies

Terraform: aws_instance, aws_launch_template

CloudFormation: AWS::EC2::Instance, AWS::EC2::LaunchTemplate

How to fix it

1. Set metadata_options { http_tokens = "required", http_put_response_hop_limit = 1 }
2. Test app behavior — most SDKs support IMDSv2 by default, but older custom code may need updating

Frameworks

• AWS FSBP EC2.8
• SOC 2 CC6.1
• SOC 2 CC6.6
• SOC 2 CC6.3
• PCI-DSS v4.0.1/2.2.6
• HIPAA 164.312(a)(1)
• HIPAA 164.312(d)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules