| name | cis-aws-foundations-6.7 |
| description | Ensure that the EC2 Metadata Service only allows IMDSv2 |
| category | cis-networking |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","networking","ec2","imdsv2","metadata","ssrf"] |
| cis_id | 6.7 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-6.1.1","cis-aws-foundations-6.1.2"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the EC2 Metadata Service only allows IMDSv2
Description
When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).
Rationale
Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into categories, such as host name, events, and security groups.
When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method). With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally stored EC2 instance metadata and credentials.
Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.
Impact
None specified.
Audit Procedure
Using AWS Console
- Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
- In the left navigation panel, under the
Instances section, choose Instances.
- Select the EC2 instance that you want to examine.
- Check the
IMDSv2 status, and ensure that it is set to Required.
Using AWS CLI
- Run the
describe-instances command using appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region:
aws ec2 describe-instances --region <region> --output table --query "Reservations[*].Instances[*].InstanceId"
The command output should return a table with the requested instance IDs.
- Run the
describe-instances command using the instance ID returned in the previous step and apply custom filtering to determine whether the selected instance is using IMDSv2:
aws ec2 describe-instances --region <region> --instance-ids <instance-id> --query "Reservations[*].Instances[*].MetadataOptions" --output table
-
