Detections
Analytics

5.6 Ensure that EC2 Metadata Service only allows IMDSv2

Information

When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).

Rationale:

Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into categories, for example, host name, events, and security groups.

When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method). With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally-stored EC2 instance metadata and credentials.

Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.

Solution

From Console:

Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.

In the left navigation panel, under the INSTANCES section, choose Instances.

Select the EC2 instance that you want to examine.

Choose Actions > Instance Settings > Modify instance metadata options.

Ensure Instance metadata service is set to Enable and set IMDSv2 to Required.

Repeat steps no. 1 - 5 to perform the remediation process for other EC2 Instances in the all applicable AWS region(s).

From Command Line:

Run the describe-instances command using appropriate filtering to list the IDs of all the existing EC2 instances currently available in the selected region:

 aws ec2 describe-instances --region <region-name> --output table --query 'Reservations[*].Instances[*].InstanceId'

The command output should return a table with the requested instance IDs.

Now run the modify-instance-metadata-options command using an instance ID returned at the previous step to update the Instance Metadata Version:

 aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name>

Repeat steps no. 1 - 3 to perform the remediation process for other EC2 Instances in the same AWS region.

Change the region by updating --region and repeat the entire process for other regions.

See Also

https://workbench.cisecurity.org/benchmarks/14207

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: amazon_aws

Control ID: 485abc3bc9b9a053e8e41ac75abd11ca631a682fae1b9fd3ce99dc1c28d85827