IMDS-01: EC2 IMDSv2 enforcement¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What a failure enables¶
- Any bucket / key in the account
What it checks¶
It passes when:
- IMDSv2 enforced (HttpTokens: required, hop limit: 1).
Example failures:
- HttpTokens is 'optional' (should be 'required' for IMDSv2-only)
How to fix¶
- Enforce IMDSv2: aws ec2 modify-instance-metadata-options --instance-id … --http-tokens required --http-put-response-hop-limit 1 --http-endpoint enabled
- Enforce IMDSv2: aws ec2 modify-instance-metadata-options --instance-id i-0abc123def456789a --http-tokens required --http-put-response-hop-limit 1
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
ERROR:
- Instance … not found.
- Could not describe instance: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ec2.describe_instances |
ec2:DescribeInstances |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Related¶
- Runtime detection
DET-03(AWS Nitro Enclaves): Instance-role credential use from an unexpected source IP - Runtime detection
DET-15(AWS Nitro Enclaves): IMDS protection loosened on the enclave host
Evidence recorded¶
Keys in the finding's evidence: hop_limit, http_endpoint, http_tokens
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).