AWS organizations high security documentation change
Summary
Updated Instance Metadata Service (IMDS) documentation to clarify IMDSv2 enforcement, added new 'http_tokens_enforced' field with configuration options, and added warnings about potential launch failures due to IMDSv1 usage.
Security assessment
The changes explicitly add enforcement mechanisms for IMDSv2 (a security feature mitigating metadata service vulnerabilities), provide configuration options to require IMDSv2, and warn about launch failures if IMDSv1 is enabled. IMDSv2 enforcement directly addresses security risks associated with IMDSv1 metadata exposure attacks.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_policies_declarative_syntax.md b/organizations/latest/userguide/orgs_manage_policies_declarative_syntax.md index 9aa416d4f..304dea425 100644 --- a//organizations/latest/userguide/orgs_manage_policies_declarative_syntax.md +++ b//organizations/latest/userguide/orgs_manage_policies_declarative_syntax.md @@ -56 +56 @@ The following are the AWS services and attributes that declarative policies supp - * Instance Metadata Defaults + * Instance Metadata @@ -281 +281 @@ If you use this attribute in a declarative policy, you cannot use the following -Instance Metadata Defaults +Instance Metadata @@ -286 +286 @@ Instance Metadata Defaults -Controls IMDS defaults for all new EC2 instance launches. Note that this configuration sets defaults only and does not enforce IMDS version settings. For more information about IMDS defaults, see [IMDS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) in the _Amazon Elastic Compute Cloud User Guide_. +Controls IMDS defaults and IMDSv2 enforcement for all new EC2 instance launches. For more information about IMDS defaults and IMDSv2 enforcement, see [Use instance metadata to manage your EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) in the _Amazon EC2 User Guide_. @@ -306,0 +307,3 @@ The following are the available fields for this attribute: + }, + "http_tokens_enforced": { + "@@assign": "enabled" @@ -324 +327 @@ The following are the available fields for this attribute: -Before setting `http_tokens` to `required` (IMDSv2 must be used), make sure that none of your instances are making IMDSv1 calls. +Before setting `http_tokens` to `required` (IMDSv2 must be used), make sure that none of your instances are making IMDSv1 calls. For more information, see [Step 1: Identify instances with IMDSv2=optional and audit IMDSv1 usage](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html#path-step-1) in the _Amazon EC2 User Guide_. @@ -351,0 +355,14 @@ If `http_tokens` is set to `required`, it is recommended to set `http_put_respon + * `"http_tokens_enforced":` + + * `"no_preference"`: Other defaults apply. For example, AMI defaults if applicable. + + * `"enabled"`: IMDSv2 must be used. Attempts to launch an IMDSv1 instance or to enable IMDSv1 on existing instances will fail. + + * `"disabled"`: Both IMDSv1 and IMDSv2 are allowed. + +###### Warning + +**IMDSv2 enforcement** + +Enabling IMDSv2 enforcement while allowing IMDSv1 and IMDSv2 (token optional) will cause launch failures, unless IMDSv1 is explicitly disabled, either through launch parameters or AMI defaults. For more information, see [Launching an IMDSv1-enabled instance fails](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/troubleshooting-launch.html#launching-an-imdsv1-enabled-instance-fails) in the _Amazon EC2 User Guide_. +