The AI answer we saw
To enforce IMDSv2 and disable IMDSv1 at scale in AWS, you can use several approaches: (1) **AWS Organizations SCP** – Apply a Service Control Policy that denies ec2:RunInstances unless the HttpTokens condition is set to 'required', preventing new instances from launching with IMDSv1. (2) **AWS Config Rule** – Enable the managed rule `ec2-imdsv2-check` to continuously detect non-compliant instances and trigger auto-remediation via AWS Systems Manager Automation. (3) **Terraform/CloudFormation** – Set `http_tokens = "required"` (Terraform) or `HttpTokens: required` in the MetadataOptions block of your instance launch templates to enforce IMDSv2 by default. (4) **Existing instances** – Use the AWS CLI command `aws ec2 modify-instance-metadata-options --instance-id <id> --http-tokens required` or run it at scale via AWS Systems Manager Run Command across your fleet. (5) **Launch Templates** – Update all existing launch templates and Auto Scaling Groups to include `HttpTokens: required` so new instances inherit the setting. For third-party tooling, platforms like Wiz, Orca Security, or Prisma Cloud can identify IMDSv1-enabled instances across multi-account environments and prioritize remediation.
Captured during this Readable report run. Answers can vary by AI tool and date.