AWS appstream2 high security documentation change

Service: appstream2 · 2026-02-19 · Security-related high

File: appstream2/latest/developerguide/using-services.md

Summary

Added new section 'Configuring the Instance Metadata Service (IMDS) on your instances' with documentation about IMDSv1/IMDSv2 differences, resource support, and code examples for disabling IMDSv1

Security assessment

The change explicitly addresses security vulnerabilities in IMDSv1 by documenting how to enforce IMDSv2 (which uses session-oriented requests to mitigate vulnerabilities). The added 'disableIMDSV1' flag and CLI parameter provide concrete mechanisms to disable the less secure IMDSv1 protocol.

Diff

diff --git a/appstream2/latest/developerguide/using-services.md b/appstream2/latest/developerguide/using-services.md
index 13318add8..df45793b6 100644
--- a//appstream2/latest/developerguide/using-services.md
+++ b//appstream2/latest/developerguide/using-services.md
@@ -5 +5 @@
-AWS Identity and Access ManagementVPC endpoints
+AWS Identity and Access ManagementVPC endpointsConfiguring the Instance Metadata Service (IMDS) on your instances
@@ -39,0 +40,63 @@ When full public internet access is required, it’s a best practice to disable
+## Configuring the Instance Metadata Service (IMDS) on your instances
+
+This topic describes the Instance Metadata Service (IMDS).
+
+_Instance metadata_ is data that's related to an Amazon Elastic Compute Cloud (Amazon EC2) instance that applications can use to configure or manage the running instance. The instance metadata service (IMDS) is an on-instance component that code on the instance uses to securely access instance metadata. For more information, see [Instance metadata and user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) in the _Amazon EC2 User Guide_.
+
+Code can access instance metadata from a running instance using one of two methods: Instance Metadata Service Version 1 (IMDSv1) or Instance Metadata Service Version 2 (IMDSv2). IMDSv2 uses session-oriented requests and mitigates several types of vulnerabilities that could be used to try to access the IMDS. For information about these two methods, see [Configuring the instance metadata service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) in the _Amazon EC2 User Guide_.
+
+### Resource support for IMDS
+
+Always-On, On-Demand, Single-Session, and Multi-Session Fleets, and all Image Builders support both IMDSv1 and IMDSv2 when running WorkSpaces Applications images with the agent version or managed image update released on or after January 16, 2024.
+
+Elastic Fleets and AppBlock Builders instances also support both IMDSv1 and IMDSv2.
+
+### Example of IMDS attribute settings
+
+Below are two examples of choosing the IMDS method:
+
+#### Java v2 SDK example
+
+Below example request disable IMDSv1 using `disableIMDSV1` attributes
+    
+    
+    CreateFleetRequest request = CreateFleetRequest.builder()
+     .name("TestFleet")
+     .imageArn("arn:aws:appstream:us-east-1::image/TestImage")
+     .instanceType("stream.standard.large")
+     .fleetType(FleetType.ALWAYS_ON)
+     .computeCapacity(ComputeCapacity.builder()
+     .desiredInstances(5)
+     .build())
+     .description("Test fleet description")
+     .displayName("Test Fleet Display Name")
+     .enableDefaultInternetAccess(true)
+     .maxUserDurationInSeconds(3600)
+     .disconnectTimeoutInSeconds(900)
+     .idleDisconnectTimeoutInSeconds(600)
+     .iamRoleArn("arn:aws:iam::123456789012:role/TestRole")
+     .streamView(StreamView.APP)
+     .platform(PlatformType.WINDOWS)
+     .maxConcurrentSessions(10)
+     .maxSessionsPerInstance(2)
+     .tags(tags)
+     .disableIMDSV1(true)
+     .build();
+              
+
+Set **disableIMDSV1** to true to disable IMDSv1 and enforce IMDSv2.
+
+Set **disableIMDSV1** to false to enable both IMDSv1 and IMDSv2.
+
+#### CLI Example
+
+Below example request disable IMDSv1 using `--disable-imdsv1` attributes
+    
+    
+    aws appstream create-fleet --name test-fleet --image-arn "arn:aws:appstream:us-east-1::image/test-image" --disable-imdsv1 --instance-type stream.standard.small --compute-capacity DesiredInstances=2 --max-user-duration-in-seconds 57600 --disconnect-timeout-in-seconds 57600 --region us-east-1
+              
+
+Set `--disable-imdsv1` to true to disable IMDSv1 and enforce IMDSv2.
+
+Set `--no-disable-imdsv1` to false to enable both IMDSv1 and IMDSv2.
+