AWS AWSEC2 medium security documentation change
Summary
Updated terminology from 'Auto Scaling groups' to 'Amazon EC2 Auto Scaling groups' and clarified launch template requirements for IMDSv2 enforcement
Security assessment
The changes emphasize proper enforcement of IMDSv2 (Instance Metadata Service Version 2) through Amazon EC2 Auto Scaling groups, which is a security hardening measure against potential metadata service exploitation. The documentation clarifies that launch templates must be used to enforce metadata service restrictions, and explicitly states the need to disable legacy launch configurations via SCPs/IAM policies - all security-focused controls.
Diff
diff --git a/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.md b/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.md index 5144c55ee..64838f130 100644 --- a//AWSEC2/latest/UserGuide/ExamplePolicies_EC2.md +++ b//AWSEC2/latest/UserGuide/ExamplePolicies_EC2.md @@ -1696 +1696 @@ The following RunInstances metadata options policies must be used in conjunction -If you use Auto Scaling groups and you need to require the use of IMDSv2 on all new instances, your Auto Scaling groups must use _launch templates_. +If you use Amazon EC2 Auto Scaling groups and you need to require the use of IMDSv2 on all new instances, your Amazon EC2 Auto Scaling groups must use _launch templates_. @@ -1698 +1698 @@ If you use Auto Scaling groups and you need to require the use of IMDSv2 on all -When an Auto Scaling group uses a launch template, the `ec2:RunInstances` permissions of the IAM principal are checked when a new Auto Scaling group is created. They are also checked when an existing Auto Scaling group is updated to use a new launch template or a new version of a launch template. +When an Amazon EC2 Auto Scaling group uses a launch template, the `ec2:RunInstances` permissions of the IAM principal are checked when a new Amazon EC2 Auto Scaling group is created. They are also checked when an existing Amazon EC2 Auto Scaling group is updated to use a new launch template or a new version of a launch template. @@ -1700 +1700 @@ When an Auto Scaling group uses a launch template, the `ec2:RunInstances` permis -Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only checked when an Auto Scaling group that is using a launch template, is created or updated. For an Auto Scaling group that is configured to use the `Latest` or `Default` launch template, the permissions are not checked when a new version of the launch template is created. For permissions to be checked, you must configure the Auto Scaling group to use a _specific version_ of the launch template. +Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only checked when an Amazon EC2 Auto Scaling group that is using a launch template, is created or updated. For an Amazon EC2 Auto Scaling group that is configured to use the `Latest` or `Default` launch template, the permissions are not checked when a new version of the launch template is created. For permissions to be checked, you must configure the Amazon EC2 Auto Scaling group to use a _specific version_ of the launch template. @@ -1702 +1702 @@ Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only -###### To enforce the use of IMDSv2 on instances launched by Auto Scaling groups, the following additional steps are required: +###### To enforce the use of IMDSv2 on instances launched by Amazon EC2 Auto Scaling groups, the following additional steps are required: @@ -1704 +1704 @@ Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only - 1. Disable the use of launch configurations for all accounts in your organization by using either service control policies (SCPs) or IAM permissions boundaries for new principals that are created. For existing IAM principals with Auto Scaling group permissions, update their associated policies with this condition key. To disable the use of launch configurations, create or modify the relevant SCP, permissions boundary, or IAM policy with the `"autoscaling:LaunchConfigurationName"` condition key with the value specified as `null`. + 1. Disable the use of launch configurations for all accounts in your organization by using either service control policies (SCPs) or IAM permissions boundaries for new principals that are created. For existing IAM principals with Amazon EC2 Auto Scaling group permissions, update their associated policies with this condition key. To disable the use of launch configurations, create or modify the relevant SCP, permissions boundary, or IAM policy with the `"autoscaling:LaunchConfigurationName"` condition key with the value specified as `null`. @@ -1710 +1710 @@ Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only - 4. For an Auto Scaling group that uses a launch configuration, replace the launch configuration with a launch template. For more information, see [Migrate your Auto Scaling groups to launch templates](https://docs.aws.amazon.com/autoscaling/ec2/userguide/migrate-to-launch-templates.html) in the _Amazon EC2 Auto Scaling User Guide_. + 4. For an Amazon EC2 Auto Scaling group that uses a launch configuration, replace the launch configuration with a launch template. For more information, see [Migrate your Amazon EC2 Auto Scaling groups to launch templates](https://docs.aws.amazon.com/autoscaling/ec2/userguide/migrate-to-launch-templates.html) in the _Amazon EC2 Auto Scaling User Guide_. @@ -1712 +1712 @@ Restrictions on the use of IMDSv1 on IAM principals for `RunInstances` are only - 5. For an Auto Scaling group that uses a launch template, make sure that it uses a new launch template with the instance metadata options configured, or uses a new version of the current launch template with the instance metadata options configured. For more information, see [update-auto-scaling-group](https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html). + 5. For an Amazon EC2 Auto Scaling group that uses a launch template, make sure that it uses a new launch template with the instance metadata options configured, or uses a new version of the current launch template with the instance metadata options configured. For more information, see [update-auto-scaling-group](https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html).