Require IMDSv2 only after checking the workload metadata clients

Move metadata access to session tokens with a controlled compatibility check.

Source facts

EC2 IMDSv2 uses a token-based session: the client obtains a token and includes it with later metadata requests until it expires. Instances can be configured to accept only IMDSv2, causing IMDSv1 requests to fail. AWS provides supported SDK guidance and examples for the different request methods.

Source: AWS Documentation.

Applicability

This concerns EC2 instance-metadata client behavior, rather than an application login token or a complete SSRF defense assessment.

DSE recommendation

DSE recommends inventorying agents, boot scripts and applications that query instance metadata before requiring the newer method. Verify their SDK and request implementation against the current reference. Use a representative test instance and preserve the initial metadata settings. Update the client workflow before enforcing a requirement that would interrupt credential or configuration retrieval. Record who owns each remaining legacy dependency and include the requirement in the approved instance template after the pilot. Include startup and scheduled maintenance paths in the client inventory, with a named owner for each uncommon metadata consumer. Agree the acceptance evidence before tightening the setting so a successful interactive request is not the only compatibility result retained.

Verification

Proposed verification: obtain and use an IMDSv2 token on the test instance, exercise the actual workload clients and confirm their behavior after the requirement is applied. Check that a tokenless request is rejected as intended. Avoid copying instance-role credentials into troubleshooting notes.

Official reference

AWS Documentation. Reviewed October 20, 2026.