Policy Packs

guardrails-samples

Mitigate the risk of unauthorized metadata exposure through vulnerabilities like Server-Side Request Forgery (SSRF).

Enforce IMDSv2 for AWS EC2 Instances

main

aws_ec2_instance_metadata_service

Instance metadata is data about your instance that you can use to configure or manage the running instance.&#92;nInstance metadata is divided into categories, for example, host name, events, and security groups.&#92;n&#92;nInstance metadata can be accessed from a running instance using one of the following methods:&#92;n&#92;n  * Instance Metadata Service Version 1 (IMDSv1) – a request/response method&#92;n&#92;n  * Instance Metadata Service Version 2 (IMDSv2) – a session-oriented method&#92;n&#92;nBy default, you can use either IMDSv1 or IMDSv2, or both. However, the instance metadata service can be specifically&#92;nconfigured to use IMDSv2 on each instance. When you specify that IMDSv2 must be used, IMDSv1 no longer works.&#92;n

instanceMetadataService

AWS > EC2 > Instance > Metadata Service

aws_ec2_instance_metadata_service_token_hop_limit

The number of network hops that the metadata token can travel.&#92;n&#92;nThe larger the number, the further instance metadata requests can travel.&#92;n&#92;nMaximum is 64.&#92;n

instanceMetadataServiceTokenHopLimit

AWS > EC2 > Instance > Metadata Service > HTTP Token Hop Limit

turbot_policy_setting.aws_ec2_instance_metadata_service

turbot_policy_setting.aws_ec2_instance_metadata_service_token_hop_limit

Policy	Setting	Note
AWS > EC2 > Instance > Metadata Service	Check: Enabled for V2 only
AWS > EC2 > Instance > Metadata Service > HTTP Token Hop Limit	2

Policy Settings