Back to Checks
aws

EC2 launch template has IMDSv2 enabled and required or instance metadata service disabled

ec2_launch_template_imdsv2_required
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:AwsEc2LaunchTemplate

EC2 launch templates are inspected for Instance Metadata Service configuration. It identifies versions where http_endpoint is enabled and http_tokens is required (IMDSv2 enforced), versions with the metadata service disabled, and versions that allow metadata without requiring tokens.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing metadata access without IMDSv2 enables SSRF and open proxy paths to query instance metadata, exposing temporary credentials and secrets. Attackers can steal IAM role credentials to access data, modify resources, and pivot within the account, threatening confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_launch_template_imdsv2_required

Recommendation

Enforce IMDSv2 in all launch template versions by setting token use to required; disable the metadata service when not needed. Apply least privilege to instance roles and use defense in depth (egress filtering, input validation) to reduce SSRF paths. Ensure applications and SDKs are compatible with IMDSv2.

Remediation

CLI

aws ec2 create-launch-template-version --launch-template-id <example_resource_id> --source-version <example_source_version> --launch-template-data '{"MetadataOptions":{"HttpTokens":"required"}}'

Terraform

resource "aws_launch_template" "<example_resource_name>" {
  name = "<example_resource_name>"

  metadata_options {
    http_tokens = "required" # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: <example_resource_name>
      LaunchTemplateData:
        MetadataOptions:
          HttpTokens: required  # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check

Other

1In the AWS Console, go to EC2 > Launch Templates
2Select the launch template, then choose Actions > Modify template (Create new version)
3Expand Advanced details > Metadata options
4Set Http tokens to Required (or disable Metadata accessible)
5Click Create template version
6(Optional) Set this new version as Default if you want it used for future launches

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_launch_template_imdsv2_required(Check):
    def execute(self):
        findings = []
        for template in ec2_client.launch_templates:
            report = Check_Report_AWS(metadata=self.metadata(), resource=template)

            versions_with_imdsv2_required = []
            versions_with_metadata_disabled = []
            versions_with_no_imdsv2 = []

            for version in template.versions:
                if (
                    version.template_data.http_endpoint == "enabled"
                    and version.template_data.http_tokens == "required"
                ):
                    versions_with_imdsv2_required.append(str(version.version_number))
                elif (
                    version.template_data.http_endpoint == "disabled"
                    or not version.template_data.http_endpoint
                ):
                    versions_with_metadata_disabled.append(str(version.version_number))
                else:
                    versions_with_no_imdsv2.append(str(version.version_number))

            if versions_with_imdsv2_required:
                report.status = "PASS"
                report.status_extended = f"EC2 Launch Template {template.name} has IMDSv2 enabled and required in the following versions: {', '.join(versions_with_imdsv2_required)}."
            elif versions_with_metadata_disabled:
                report.status = "PASS"
                report.status_extended = f"EC2 Launch Template {template.name} has metadata service disabled in the following versions: {', '.join(versions_with_metadata_disabled)}."
            else:
                report.status = "FAIL"
                report.status_extended = f"EC2 Launch Template {template.name} has IMDSv2 disabled or not required in the following versions: {', '.join(versions_with_no_imdsv2)}."

            findings.append(report)

        return findings

References