Find EC2 Instances Without IMDSv2 and Require It

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportImdsSettings",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "ec2:DescribeInstances",
        "ec2:GetInstanceMetadataDefaults",
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RequireImdsv2",
      "Effect": "Allow",
      "Action": "ec2:ModifyInstanceMetadataOptions",
      "Resource": "arn:aws:ec2:*:123456789012:instance/*"
    },
    {
      "Sid": "SetAccountDefault",
      "Effect": "Allow",
      "Action": "ec2:ModifyInstanceMetadataDefaults",
      "Resource": "*"
    }
  ]
}

// find-ec2-instances-without-imdsv2.ts
// Lists EC2 instances that still accept IMDSv1 (HttpTokens = optional) in every enabled Region,
// with the number of IMDSv1 calls each one made in the last 14 days (CloudWatch MetadataNoToken).
// Report-only by default. --apply requires IMDSv2 on instances with zero IMDSv1 calls;
// add --set-default to also make IMDSv2 the account default for new launches in each Region.
// Usage: npx tsx find-ec2-instances-without-imdsv2.ts [--regions=us-east-1,eu-west-1] [--apply] [--set-default]
import {
  EC2Client,
  DescribeRegionsCommand,
  GetInstanceMetadataDefaultsCommand,
  ModifyInstanceMetadataDefaultsCommand,
  ModifyInstanceMetadataOptionsCommand,
  paginateDescribeInstances,
} from "@aws-sdk/client-ec2";
import { CloudWatchClient, GetMetricDataCommand, type MetricDataQuery } from "@aws-sdk/client-cloudwatch";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const setDefault = args.includes("--set-default");
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1]
  ?? (args.includes("--regions") ? args[args.indexOf("--regions") + 1] : undefined);
const LOOKBACK_DAYS = 14;

interface Row { Region: string; Instance: string; Name: string; State: string; HopLimit: number; IMDSv1Calls: number; Verdict: string }

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg.split(",").map((r) => r.trim()).filter(Boolean);
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({})); // enabled Regions only
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

// Sum of MetadataNoToken per instance over the lookback window. GetMetricData takes up to 500 queries per call.
async function imdsv1Calls(cw: CloudWatchClient, ids: string[]): Promise<Map<string, number>> {
  const totals = new Map<string, number>();
  const end = new Date();
  const start = new Date(end.getTime() - LOOKBACK_DAYS * 86_400_000);
  for (let i = 0; i < ids.length; i += 500) {
    const batch = ids.slice(i, i + 500);
    const queries: MetricDataQuery[] = batch.map((id, n) => ({
      Id: `m${n}`,
      MetricStat: {
        Metric: { Namespace: "AWS/EC2", MetricName: "MetadataNoToken", Dimensions: [{ Name: "InstanceId", Value: id }] },
        Period: 86_400,
        Stat: "Sum",
      },
    }));
    let NextToken: string | undefined;
    do {
      const res = await cw.send(new GetMetricDataCommand({ MetricDataQueries: queries, StartTime: start, EndTime: end, NextToken }));
      for (const r of res.MetricDataResults ?? []) {
        const id = batch[Number((r.Id ?? "m0").slice(1))];
        const sum = (r.Values ?? []).reduce((a, b) => a + b, 0);
        totals.set(id, (totals.get(id) ?? 0) + sum);
      }
      NextToken = res.NextToken;
    } while (NextToken);
  }
  return totals;
}

async function scanRegion(region: string): Promise<Row[]> {
  const ec2 = new EC2Client({ region });
  const defaults = (await ec2.send(new GetInstanceMetadataDefaultsCommand({}))).AccountLevel;
  console.log(`${region}: account default HttpTokens=${defaults?.HttpTokens ?? "no-preference"}, enforced=${defaults?.HttpTokensEnforced ?? "no-preference"}`);

  const found: { id: string; name: string; state: string; hop: number }[] = [];
  for await (const page of paginateDescribeInstances({ client: ec2 }, {
    Filters: [
      { Name: "metadata-options.http-tokens", Values: ["optional"] },
      { Name: "instance-state-name", Values: ["pending", "running", "stopping", "stopped"] },
    ],
  })) {
    for (const res of page.Reservations ?? []) {
      for (const i of res.Instances ?? []) {
        if (i.MetadataOptions?.HttpEndpoint === "disabled") continue; // IMDS switched off entirely
        found.push({
          id: i.InstanceId ?? "",
          name: i.Tags?.find((t) => t.Key === "Name")?.Value ?? "",
          state: i.State?.Name ?? "",
          hop: i.MetadataOptions?.HttpPutResponseHopLimit ?? 1,
        });
      }
    }
  }

  const calls = found.length ? await imdsv1Calls(new CloudWatchClient({ region }), found.map((f) => f.id)) : new Map<string, number>();
  const rows: Row[] = found.map((f) => {
    const n = calls.get(f.id) ?? 0;
    const verdict = n > 0 ? "IMDSv1 IN USE: update software first" : f.state === "stopped" ? "no data (stopped): check before requiring" : "ready to require IMDSv2";
    return { Region: region, Instance: f.id, Name: f.name, State: f.state, HopLimit: f.hop, IMDSv1Calls: n, Verdict: verdict };
  });

  if (apply) {
    for (const r of rows.filter((x) => x.Verdict === "ready to require IMDSv2")) {
      try {
        await ec2.send(new ModifyInstanceMetadataOptionsCommand({ InstanceId: r.Instance, HttpTokens: "required", HttpEndpoint: "enabled" }));
        r.Verdict = "IMDSv2 now required";
      } catch (err) {
        r.Verdict = `failed: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
    if (setDefault) {
      await ec2.send(new ModifyInstanceMetadataDefaultsCommand({ HttpTokens: "required", HttpPutResponseHopLimit: 2 }));
      console.log(`${region}: account default set to HttpTokens=required, hop limit 2 (new launches only)`);
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: skipped (${err instanceof Error ? err.name + ": " + err.message : String(err)})`);
    }
  }
  console.table(rows);
  const ready = rows.filter((r) => r.Verdict === "ready to require IMDSv2").length;
  console.log(`${rows.length} instances accept IMDSv1; ${rows.filter((r) => r.IMDSv1Calls > 0).length} made IMDSv1 calls in ${LOOKBACK_DAYS} days.`);
  if (!apply) console.log(`Report only: nothing changed. --apply would require IMDSv2 on ${ready} instance(s).`);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2 @aws-sdk/client-cloudwatch
npm install --save-dev tsx typescript

# Report only, every enabled Region
AWS_PROFILE=readonly npx tsx find-ec2-instances-without-imdsv2.ts

# Require IMDSv2 on instances with zero IMDSv1 calls, and make it the default for new launches
AWS_PROFILE=admin npx tsx find-ec2-instances-without-imdsv2.ts --regions=us-east-1 --apply --set-default

eu-west-1: account default HttpTokens=no-preference, enforced=no-preference
us-east-1: account default HttpTokens=no-preference, enforced=no-preference
┌─────────┬─────────────┬───────────────────────┬──────────────┬───────────┬──────────┬─────────────┬─────────────────────────────────────────────┐
│ (index) │ Region      │ Instance              │ Name         │ State     │ HopLimit │ IMDSv1Calls │ Verdict                                     │
├─────────┼─────────────┼───────────────────────┼──────────────┼───────────┼──────────┼─────────────┼─────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'i-0a1b2c3d4e5f60718' │ 'api-1'      │ 'running' │ 2        │ 0           │ 'ready to require IMDSv2'                   │
│ 1       │ 'us-east-1' │ 'i-0b2c3d4e5f6071829' │ 'legacy-etl' │ 'running' │ 1        │ 1824        │ 'IMDSv1 IN USE: update software first'      │
│ 2       │ 'us-east-1' │ 'i-0c3d4e5f607182930' │ 'jenkins'    │ 'stopped' │ 1        │ 0           │ 'no data (stopped): check before requiring' │
└─────────┴─────────────┴───────────────────────┴──────────────┴───────────┴──────────┴─────────────┴─────────────────────────────────────────────┘
3 instances accept IMDSv1; 1 made IMDSv1 calls in 14 days.
Report only: nothing changed. --apply would require IMDSv2 on 1 instance(s).