Back to Checks
oraclecloud

Compute instance legacy metadata service endpoint is disabled

compute_instance_legacy_metadata_endpoint_disabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:secretsidentity-access
Resource Type:Instance

OCI compute instance metadata service is configured so legacy IMDS v1 endpoints are disabled, requiring session-authorized IMDS v2 requests for metadata access

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Enabled IMDS v1 permits unauthenticated metadata reads via local access or SSRF, compromising confidentiality of instance credentials, SSH keys, and custom data. Stolen tokens enable cloud API abuse, driving privilege escalation, lateral movement, and unauthorized changes that impact integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks compute_instance_legacy_metadata_endpoint_disabled

Recommendation

Disable IMDS v1 and require IMDS v2 across all instances. Migrate applications to session-authorized requests and confirm image support. Enforce least privilege for instance principals, restrict untrusted processes from reaching 169.254.169.254, and monitor metadata access to provide defense in depth.

Remediation

CLI

oci compute instance update --instance-id <instance-ocid> --instance-options '{"areLegacyImdsEndpointsDisabled": true}'

Terraform

resource "oci_core_instance" "<example_resource_name>" {
  instance_options {
    are_legacy_imds_endpoints_disabled = true  # Critical: disables IMDSv1, allowing only IMDSv2
  }
}

Other

1In the OCI Console, go to Compute > Instances
2Select <example_resource_name>
3In Instance Details, next to Instance metadata service, click Edit
4Set Allowed IMDS version to Version 2 only
5Click Save changes

Check Code

"""Check if Compute Instance Legacy Metadata service endpoint is disabled."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.compute.compute_client import compute_client


class compute_instance_legacy_metadata_endpoint_disabled(Check):
    """Check if Compute Instance Legacy Metadata service endpoint is disabled."""

    def execute(self) -> Check_Report_OCI:
        """Execute the compute_instance_legacy_metadata_endpoint_disabled check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for instance in compute_client.instances:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=instance,
                region=instance.region,
                resource_name=instance.name,
                resource_id=instance.id,
                compartment_id=instance.compartment_id,
            )

            if instance.are_legacy_imds_endpoints_disabled:
                report.status = "PASS"
                report.status_extended = f"Compute instance {instance.name} has legacy metadata service endpoint disabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Compute instance {instance.name} has legacy metadata service endpoint enabled or not configured."

            findings.append(report)

        return findings

References