{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
        "slug": "require-imdsv2-only-after-checking-the-workload-metadata-clients",
        "url": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/require-imdsv2-only-after-checking-the-workload-metadata-clients/"
        },
        "title": "Require IMDSv2 only after checking the workload metadata clients",
        "summary": "Move metadata access to session tokens with a controlled compatibility check.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:13:48+00:00",
        "modified_at": "2026-10-20T18:34:29+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 243,
        "potentially_affected": "This concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.",
        "dse_recommendation": "DSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method.",
        "primary_source": {
            "name": "AWS Documentation",
            "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Move metadata access to session tokens with a controlled compatibility check.</p>\n<h2>Source facts</h2>\n<p>EC2 IMDSv2 uses a token-based session: the client obtains a token and includes it with later metadata requests until it expires. Instances can be configured to accept only IMDSv2, causing IMDSv1 requests to fail. AWS provides supported SDK guidance and examples for the different request methods.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\">AWS Documentation</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method. Verify their SDK and request implementation against the current reference. Use a representative test instance and preserve the initial metadata settings. Update the client workflow before enforcing a requirement that would interrupt credential or configuration retrieval. Record who owns each remaining legacy dependency and include the requirement in the approved instance template after the pilot. Include startup and scheduled maintenance paths in the client inventory, with a named owner for each uncommon metadata consumer. Agree the acceptance evidence before tightening the setting so a successful interactive request is not the only compatibility result retained.</p>\n<h2>Verification</h2>\n<p>Proposed verification: obtain and use an IMDSv2 token on the test instance, exercise the actual workload clients and confirm their behavior after the requirement is applied. Check that a tokenless request is rejected as intended. Avoid copying instance-role credentials into troubleshooting notes.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\">AWS Documentation</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Move metadata access to session tokens with a controlled compatibility check.\nSource facts\nEC2 IMDSv2 uses a token-based session: the client obtains a token and includes it with later metadata requests until it expires. Instances can be configured to accept only IMDSv2, causing IMDSv1 requests to fail. AWS provides supported SDK guidance and examples for the different request methods.\nSource: AWS Documentation.\nApplicability\nThis concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.\nDSE recommendation\nDSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method. Verify their SDK and request implementation against the current reference. Use a representative test instance and preserve the initial metadata settings. Update the client workflow before enforcing a requirement that would interrupt credential or configuration retrieval. Record who owns each remaining legacy dependency and include the requirement in the approved instance template after the pilot. Include startup and scheduled maintenance paths in the client inventory, with a named owner for each uncommon metadata consumer. Agree the acceptance evidence before tightening the setting so a successful interactive request is not the only compatibility result retained.\nVerification\nProposed verification: obtain and use an IMDSv2 token on the test instance, exercise the actual workload clients and confirm their behavior after the requirement is applied. Check that a tokenless request is rejected as intended. Avoid copying instance-role credentials into troubleshooting notes.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
        "content_markdown": "Move metadata access to session tokens with a controlled compatibility check.\n\n## Source facts\n\nEC2 IMDSv2 uses a token-based session: the client obtains a token and includes it with later metadata requests until it expires. Instances can be configured to accept only IMDSv2, causing IMDSv1 requests to fail. AWS provides supported SDK guidance and examples for the different request methods.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n\n## Applicability\n\nThis concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.\n\n## DSE recommendation\n\nDSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method. Verify their SDK and request implementation against the current reference. Use a representative test instance and preserve the initial metadata settings. Update the client workflow before enforcing a requirement that would interrupt credential or configuration retrieval. Record who owns each remaining legacy dependency and include the requirement in the approved instance template after the pilot. Include startup and scheduled maintenance paths in the client inventory, with a named owner for each uncommon metadata consumer. Agree the acceptance evidence before tightening the setting so a successful interactive request is not the only compatibility result retained.\n\n## Verification\n\nProposed verification: obtain and use an IMDSv2 token on the test instance, exercise the actual workload clients and confirm their behavior after the requirement is applied. Check that a tokenless request is rejected as intended. Avoid copying instance-role credentials into troubleshooting notes.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
                "url": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Require IMDSv2 only after checking the workload metadata clients",
                        "item": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/#article",
                "identifier": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
                "url": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/",
                "headline": "Require IMDSv2 only after checking the workload metadata clients",
                "description": "Move metadata access to session tokens with a controlled compatibility check.",
                "abstract": "Move metadata access to session tokens with a controlled compatibility check.",
                "articleBody": "Move metadata access to session tokens with a controlled compatibility check.\nSource facts\nEC2 IMDSv2 uses a token-based session: the client obtains a token and includes it with later metadata requests until it expires. Instances can be configured to accept only IMDSv2, causing IMDSv1 requests to fail. AWS provides supported SDK guidance and examples for the different request methods.\nSource: AWS Documentation.\nApplicability\nThis concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.\nDSE recommendation\nDSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method. Verify their SDK and request implementation against the current reference. Use a representative test instance and preserve the initial metadata settings. Update the client workflow before enforcing a requirement that would interrupt credential or configuration retrieval. Record who owns each remaining legacy dependency and include the requirement in the approved instance template after the pilot. Include startup and scheduled maintenance paths in the client inventory, with a named owner for each uncommon metadata consumer. Agree the acceptance evidence before tightening the setting so a successful interactive request is not the only compatibility result retained.\nVerification\nProposed verification: obtain and use an IMDSv2 token on the test instance, exercise the actual workload clients and confirm their behavior after the requirement is applied. Check that a tokenless request is rejected as intended. Avoid copying instance-role credentials into troubleshooting notes.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:13:48+00:00",
                "dateModified": "2026-10-20T18:34:29+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/require-imdsv2-only-after-checking-the-workload-metadata-clients/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Require IMDSv2 only after checking the workload metadata clients"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 243,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Documentation",
                    "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"
                }
            }
        ]
    }
}