Question

A security team manages an AWS Organizations structure with an OU named 'Workloads' containing 40 member accounts. Leadership wants to guarantee that no EC2 instance can ever be launched across these accounts unless it requires IMDSv2 (instance metadata service version 2), regardless of what IAM permissions individual account administrators grant. The solution must be preventive, apply org-wide, and not depend on any per-account IAM configuration or detective remediation. What should the team implement?

Accepted Answer

Attach an SCP to the 'Workloads' OU that denies the ec2:RunInstances action when the ec2:MetadataHttpTokens condition key is not equal to 'required'.

Answer

Deploy an AWS Config managed rule (ec2-imdsv2-check) via a conformance pack to the OU with an automatic remediation action that reconfigures noncompliant instances.

Answer

Create an IAM permissions boundary in each account that restricts RunInstances to requests where IMDSv2 is enforced.

Answer

Enable an EC2 account-level setting through Systems Manager Automation to default all new instances to IMDSv2 across the accounts.