A security team wants to reduce the risk of an application vulnerability being exploited to steal an EC2 instance's IAM role credentials via the instance metadata service. Which configuration change most directly mitigates this specific risk?
- Require IMDSv2 by setting the instance metadata options' HttpTokens parameter to required
- Replace the instance's shared tenancy with a Dedicated Host
- Enable detailed CloudWatch monitoring on the instance
- Move the instance into a cluster placement group
Correct answer: A. Require IMDSv2 by setting the instance metadata options' HttpTokens parameter to required
IMDSv1 allows a simple, unauthenticated GET request to the instance metadata endpoint, which is exactly what many server-side request forgery (SSRF) exploits abuse to retrieve an instance's temporary IAM role credentials through a vulnerable application. Requiring IMDSv2, by setting HttpTokens to required, forces every metadata request to first obtain a session token via a PUT request with a hop limit, which most SSRF techniques cannot replicate because they typically cannot issue arbitrary PUT requests or control the token's TTL and hop count, closing off this specific credential-theft path. Switching to a Dedicated Host changes billing and hardware tenancy for licensing purposes and has no bearing on metadata credential exposure. Detailed CloudWatch monitoring only increases the frequency of metric collection for observability; it does not prevent or detect credential theft on its own. A cluster placement group only affects network latency and throughput between instances in the same Availability Zone and is unrelated to metadata security.
Source: AWS EC2 documentation: Instance metadata service version 2 (IMDSv2)