EC2 Instances Without Imdsv2 Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "Require IMDSv2 for EC2 Instances" misconfiguration in AWS using the AWS console, follow these steps:

1. Log in to the AWS Management Console.
2. Navigate to the EC2 dashboard.
3. Select the EC2 instance that needs to be remediated.
4. Click on the "Actions" button and select "Instance Settings" and then click on "Modify instance metadata options".
5. In the "Modify instance metadata options" dialog box, select "Required" for "IMDSv2" option and click "Save".
6. Verify the configuration by following the same steps above.

By following these steps, you have successfully remediated the "Require IMDSv2 for EC2 Instances" misconfiguration in AWS using the AWS console.

Using CLI

The Instance Metadata Service (IMDS) is a service provided by Amazon Web Services (AWS) that allows EC2 instances to retrieve metadata about themselves and their environment. IMDSv2 is a newer version of the service that provides additional security features.

To remediate the "Require IMDSv2 for EC2 Instances" misconfiguration in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine or EC2 instance with appropriate IAM permissions.
2. Run the following command to enable IMDSv2 on all running EC2 instances in the current region:

aws ec2 modify-instance-metadata-options --instance-id $(curl -s http://169.254.169.254/latest/meta-data/instance-id) --http-tokens required --http-endpoint enabled

This command uses the modify-instance-metadata-options API to enable IMDSv2 on the current EC2 instance by passing --http-endpoint enabled and --http-tokens required parameters.

3. To enable IMDSv2 on all new EC2 instances launched in the current region, run the following command:

aws ec2 modify-instance-metadata-options --http-tokens required --http-endpoint enabled

This command uses the modify-instance-metadata-options API to enable IMDSv2 on all new EC2 instances launched in the current region by passing --http-endpoint enabled and --http-tokens required parameters.

4. Verify that the IMDSv2 is enabled on the EC2 instance by running the following command:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

This command should return the security credentials associated with the instance's IAM role, indicating that IMDSv2 is enabled.

By following these steps, you can remediate the "Require IMDSv2 for EC2 Instances" misconfiguration in AWS using AWS CLI.

Using Python

The Instance Metadata Service (IMDS) is a service provided by AWS that allows EC2 instances to retrieve information about themselves and their environment. IMDSv1 is the default version of the service, but it has some security vulnerabilities that can be exploited by attackers. IMDSv2 is a more secure version of the service that addresses these vulnerabilities.

To remediate the "Require IMDSv2 For EC2 Instances" misconfiguration in AWS using Python, you can follow these steps:

1. Install the AWS SDK for Python (Boto3) using pip:

pip install boto3

2. Create a new Python script and import the necessary libraries:

import boto3
from botocore.exceptions import ClientError

3. Create a new session and EC2 client:

session = boto3.Session()
ec2_client = session.client('ec2')

4. Get a list of all EC2 instances in your account:

response = ec2_client.describe_instances()
instances = [i for r in response['Reservations'] for i in r['Instances']]

5. For each instance, check if IMDSv2 is already enabled:

for instance in instances:
    instance_id = instance['InstanceId']
    http_endpoint = instance['MetadataOptions']['HttpEndpoint']
    http_tokens = instance['MetadataOptions']['HttpTokens']
    if http_endpoint == 'enabled' and http_tokens == 'required':
        print(f"IMDSv2 already enabled for instance {instance_id}")

    else:
        print(f"IMDSv2 is not enabled for instance {instance_id}")

6. If IMDSv2 is not enabled, update the instance attribute to enable it:

response = ec2_client.modify_instance_metadata_options(
    InstanceId=instance_id,
    HttpEndpoint='enabled',
    HttpTokens='required'
)
print(f"IMDSv2 enabled for instance {instance_id}")

7. Save and run the Python script to remediate the misconfiguration.

Note: This script assumes that you have the necessary permissions to modify EC2 instance attributes in your AWS account.

Using Terraform

resource "aws_instance" "EC2_INSTANCE_NAME" {
  ami           = "AMI_ID"          # replace with your AMI ID
  instance_type = "INSTANCE_TYPE"   # replace with your instance type
  subnet_id     = "SUBNET_ID"       # replace with your subnet ID
  # ...other arguments...

  metadata_options {
    http_tokens   = "required"  # Enforce IMDSv2
    http_endpoint = "enabled"   # Keep metadata endpoint enabled
  }
}

Enforcing IMDSv2 may break applications on the instance that are not configured to use it; test in non-production first and ensure all applications are IMDSv2-compatible before rollout. This change is applied in place for existing aws_instance resources and does not force replacement of the instance.

After updating your Terraform, terraform plan should show a single in-place update on the aws_instance resource, with metadata_options.http_tokens changing from "optional" (or unset) to "required" and metadata_options.http_endpoint set to "enabled" if it was previously different.