IMDSv2 (Instance Metadata Service v2)

IMDSv2 (Instance Metadata Service version 2) is the secure replacement for IMDSv1 on Amazon EC2. It requires a session token obtained via an HTTP PUT request before any metadata can be accessed, preventing Server-Side Request Forgery (SSRF) attacks from stealing IAM role credentials.

Why IMDSv1 Is Dangerous

• IMDSv1 allows simple GET requests to 169.254.169.254 with no authentication
• Any SSRF vulnerability in an application running on EC2 can steal IAM role credentials
• Malware (e.g., the LiteLLM credential stealer) queries IMDS as its first action to harvest temporary credentials

How IMDSv2 Works

1. Client sends PUT /latest/api/token with X-Aws-Ec2-Metadata-Token-Ttl-Seconds header
2. IMDS returns a session token (valid up to 6 hours)
3. Client includes the token in subsequent GET requests via X-Aws-Ec2-Metadata-Token header

Enforcement

aws ec2 modify-instance-metadata-options \
  --instance-id i-1234567890abcdef0 \
  --http-tokens required \
  --http-endpoint enabled

Use --http-tokens required to enforce IMDSv2. Set this as default for all new instances via account-level settings or SCPs.