Question

A CloudOps engineer manages a fleet of EC2 instances that must always have IMDSv2 enforced. Occasionally, developers launch instances with IMDSv1 enabled through the console. The team wants AWS Config to not only detect noncompliant instances but also automatically remediate them by requiring the token-based metadata endpoint, without manual intervention. Which approach satisfies this requirement?

Accepted Answer

Create an AWS Config managed rule (ec2-imdsv2-check) and attach an automatic remediation action that invokes an SSM Automation document to set the instance metadata options to require tokens.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub, which will automatically reconfigure noncompliant instances to enforce IMDSv2.

Answer

Create a CloudTrail metric filter on RunInstances events and trigger an SNS notification so an administrator can manually fix the instance.

Answer

Use an IAM permission boundary that prevents developers from launching instances unless IMDSv2 is enabled, blocking the noncompliant configuration entirely.