Skip to main content

OCI Compute Instance Metadata Service V1 Should Be Disabled

More Info:​

Compute instances should disable legacy Instance Metadata Service (IMDSv1) endpoints. IMDSv1 is vulnerable to SSRF attacks that can expose instance credentials to attackers

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step console instructions to disable Instance Metadata Service v1 (IMDSv1) on an OCI Compute instance (e.g., an instance used for monitoring), leaving only IMDSv2 enabled.

Note: This is done per instance by updating the “Instance Metadata Service Version” setting.

1. Identify the compute instance​

  1. Sign in to the OCI Console.
  2. In the left menu, go to: Compute → Instances.
  3. In the Compartment selector, choose the compartment where your monitoring instance resides.
  4. Click the Name of the target instance (the one used for monitoring).

2. Open the Instance Details and Edit Settings​

  1. You are now on the Instance details page.
  2. Click the More actions button (three dots) in the top right (or use the Edit button, depending on the current UI).
  3. Select Edit (or Edit instance details).

3. Change the Metadata Service Version​

In the Edit panel/page:

  1. Scroll down to the Instance metadata service section.
  2. Locate the setting typically labeled:
    • “Instance metadata service version”, or similar.
  3. Set it to:
    • V2 only (or Use only version 2, depending on UI wording).
  4. Ensure that “Allow metadata service v1” (or equivalent toggle) is disabled / unchecked.

This setting enforces IMDSv2 and implicitly disables IMDSv1.

4. Save the Changes​

  1. Review the changes.
  2. Click Save changes or Update.

No reboot is typically required for the IMDS version setting to take effect, but:

  • If you have any custom agents or scripts on the monitoring instance that query IMDSv1 endpoint (http://169.254.169.254/opc/v1/...), update them to use IMDSv2 semantics (including the session token flow) before making this change.

5. (Optional) Confirm IMDSv1 Is Disabled​

From within the instance (SSH):

  1. Try to call an IMDSv1 endpoint: 
    curl http://169.254.169.254/opc/v1/instance/ -v
    It should fail (e.g., 401/403 or similar denial).
  2. Use the IMDSv2 token flow to confirm IMDSv2 still works: 
    # Get token
    curl -X PUT \
      -H "Authorization: Bearer Oracle" \
      -H "Accept: application/json" \
      -H "Content-Type: application/json" \
      -H "opc-metadata-token-ttl-seconds: 300" \
      http://169.254.169.254/opc/v2/token

    # Use the returned token in a subsequent request

This completes the remediation: IMDSv1 disabled, IMDSv2 enforced for your OCI compute monitoring instance.

Using CLI

To disable OCI Instance Metadata Service v1 (legacy endpoint) for your Compute instances (including those used for monitoring) via OCI CLI, you need to update the instance’s metadata service configuration.

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • Permissions: ability to inspect and update instances in the target compartment/tenancy.

2. Find the instance OCID(s)​

List instances in a compartment:

oci compute instance list \
  --compartment-id <COMPARTMENT_OCID> \
  --lifecycle-state RUNNING \
  --all

Note the id (instance OCID) for each instance you want to fix.

3. Check current IMDS configuration (optional)​

oci compute instance get \
  --instance-id <INSTANCE_OCID> \
  --query "data.\"instanceMetadataServiceConfig\"" \
  --raw-output

You’ll see something like:

{
  "isLegacyImdsEndpointDisabled": false,
  "maxAttempts": 3,
  "sessionDurationInSeconds": 1200
}

4. Disable IMDSv1 (legacy endpoint) on an existing instance​

Run:

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
  --force

You can keep other fields if you want (e.g., maxAttempts / sessionDurationInSeconds):

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --instance-metadata-service-config '{
    "isLegacyImdsEndpointDisabled": true,
    "maxAttempts": 3,
    "sessionDurationInSeconds": 1200
  }' \
  --force

This switches the instance to IMDSv2-only. No reboot is typically required.

5. Apply to all monitoring instances (batch)​

Example bash loop for all running instances in a compartment:

COMPARTMENT_OCID=<COMPARTMENT_OCID>

for ID in $(oci compute instance list \
              --compartment-id $COMPARTMENT_OCID \
              --lifecycle-state RUNNING \
              --query "data[].id" \
              --raw-output); do
  echo "Disabling IMDSv1 for $ID"
  oci compute instance update \
    --instance-id "$ID" \
    --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
    --force
done

Use a narrower filter (tags, display-name) if you only want monitoring-related instances.

6. Ensure future instances are compliant​

If you use instance configurations (e.g., for autoscaling / instance pools used for monitoring), update the configuration as well:

oci compute instance-configuration update \
  --instance-configuration-id <INSTANCE_CONFIG_OCID> \
  --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
  --force

New instances launched from that configuration will have IMDSv1 disabled.

Using Python

To disable OCI Instance Metadata Service v1 (legacy endpoints) using Python, you need to set the are_legacy_imds_endpoints_disabled flag on the instance options via the OCI Python SDK.

Below is step‑by‑step remediation for existing and new instances.

1. Prerequisites​

  1. Install the OCI Python SDK:
pip install oci
  1. Configure your OCI credentials (e.g. ~/.oci/config):
[DEFAULT]
user=ocid1.user.oc1..
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..
region=us-ashburn-1

2. Disable IMDSv1 on an existing instance​

import oci
from oci.core import ComputeClient
from oci.core.models import UpdateInstanceDetails, InstanceOptions

# 1. Config + client
config = oci.config.from_file("~/.oci/config", "DEFAULT")
compute_client = ComputeClient(config)

# 2. Target instance OCID
instance_id = "ocid1.instance.oc1..xxxx"

# 3. Build update payload: disable legacy IMDS endpoints (IMDSv1)
update_details = UpdateInstanceDetails(
    instance_options=InstanceOptions(
        are_legacy_imds_endpoints_disabled=True
    )
)

# 4. Call update_instance
response = compute_client.update_instance(
    instance_id=instance_id,
    update_instance_details=update_details
)

print("Update launched, new lifecycle state:", response.data.lifecycle_state)

This:

  • Keeps IMDSv2 enabled
  • Disables legacy metadata endpoints (IMDSv1 paths such as /opc/v1/...).

No reboot is usually required, but verify any applications relying on IMDSv1 first.

3. Ensure all new instances have IMDSv1 disabled​

When launching instances (e.g. for monitoring agents), set the same flag in LaunchInstanceDetails:

import oci
from oci.core import ComputeClient
from oci.core.models import LaunchInstanceDetails, InstanceOptions

config = oci.config.from_file("~/.oci/config", "DEFAULT")
compute_client = ComputeClient(config)

launch_details = LaunchInstanceDetails(
    compartment_id="ocid1.compartment.oc1..xxxx",
    availability_domain="kIdk:US-ASHBURN-AD-1",
    shape="VM.Standard.E4.Flex",
    # ... image_id, subnet_id, etc.
    instance_options=InstanceOptions(
        are_legacy_imds_endpoints_disabled=True
    )
)

response = compute_client.launch_instance(launch_details)
print("Launched instance:", response.data.id)

4. Verifying from the instance (optional)​

From the instance, IMDSv1 endpoints (e.g. curl http://169.254.169.254/opc/v1/instance/) should return an error or no data, while IMDSv2 endpoints (e.g. /opc/v2/instance/) remain available according to OCI docs for your region/shape.

This is sufficient to satisfy the requirement: “OCI Compute Instance Metadata Service V1 Should Be Disabled” for your monitoring instances using Python automation.

Using Terraform
resource "oci_core_instance" "COMPUTE_INSTANCE" {
  # Replace these with your actual values
  compartment_id      = "OCID_OF_COMPARTMENT"
  availability_domain = "AVAILABILITY_DOMAIN_NAME"
  shape               = "VM.SHAPE"
  display_name        = "INSTANCE_NAME"
  subnet_id           = "OCID_OF_SUBNET"
  image_id            = "OCID_OF_IMAGE"

  # Disable legacy IMDSv1 endpoints
  instance_options {
    are_legacy_imds_endpoints_disabled = true
  }

  # ...any other required arguments...
}

This updates the instance’s metadata service to disable legacy IMDSv1; it should not force replacement, but may require a reboot depending on OCI behavior and current state.

To verify, terraform plan should show an in-place update setting instance_options.are_legacy_imds_endpoints_disabled from false (or unset) to true on the affected oci_core_instance resource.