IMDS hop limit above 1 exposes the instance role to containers on the host

What it checks

IMDS hop limit above 1 exposes the instance role to containers on the host

Where it applies

Terraform: aws_instance, aws_launch_template

CloudFormation: AWS::EC2::Instance, AWS::EC2::LaunchTemplate

How to fix it

1. Set http_put_response_hop_limit = 1 unless workloads on the host require IMDS access.
2. If pods DO need AWS credentials, give them their own identity instead of the node's — IRSA on EKS, task roles on ECS — and return the hop limit to 1.
3. If the hop limit must stay above 1, scope the node role to the minimum the workloads actually need, since every container on the host inherits it.

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules