How to tell what version of Instance Metadata Service(IMDS) EC2 instance is using?

Question

I'm trying to figure out what version of Instance Metadata Service my ec2 instance is using.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options

Answer 1

If you want to determine it from the EC2 instance, you can just try sending a request to http://169.254.169.254/ and see what the status code is.

For example, this instance has IMDSv2 enabled and requests without a token are not accepted:

$ curl -w "%{http_code}\n" http://169.254.169.254/
401

The 401 status code means Unauthorized.

If you have AWS access keys with permissions to describe EC2 instances, then you can run the following:

$ aws ec2 describe-instances --region us-west-2 --instance-id i-0123456789abcdef --query "Reservations[0].Instances[0].MetadataOptions"
{
    "State": "applied",
    "HttpTokens": "optional",
    "HttpPutResponseHopLimit": 1,
    "HttpEndpoint": "enabled"
}

This server does not require IMDSv2 (HttpTokens is optional).

To enable IMDSv2, you can run aws ec2 modify-instance-metadata-options. See more in AWS documentation on configuring the instance metadata options.