Policy: AWS > EC2 > Account Attributes > Instance Metadata Service Defaults

Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into categories, for example, host name, events, and security groups.

Instance metadata can be accessed from a running instance using one of the following methods:

* Instance Metadata Service Version 1 (IMDSv1) – a request/response method

* Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method

By default, you can use either IMDSv1 or IMDSv2, or both. However, the instance metadata service can be specifically configured to use IMDSv2 on each instance. When you specify that IMDSv2 must be used, IMDSv1 no longer works.

Resource Types

This policy targets the following resource types:

AWS > EC2 > Account Attributes

HTTP Token Hop Limit

Controls

AWS > EC2 > Account Attributes > Instance Metadata Service Defaults

Policy Packs

This policy setting is used by the following policy packs:

AWS CIS v3.0.0 - Section 5 - Networking

Policy Specification

Schema Type	`string`
Default	`Skip`
Valid Values [YAML]	`Skip` `Check: Disabled` `Check: Enabled for V1 and V2` `Check: Enabled for V2 only` `Enforce: Disabled` `Enforce: Enabled for V1 and V2` `Enforce: Enabled for V2 only`
Examples [YAML]	`Skip`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceDataProtection

Policy Type URI

tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults

GraphQL

query policyType(id: "tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesInstanceMetadataServiceDefaults"