terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: aws-ec2-launch-template-metadata-service-v1-enabled
    patterns:
      - pattern: |
          resource "aws_launch_template" $ANYTHING {
            ...
          }
      - pattern-not-inside: |
          resource "aws_launch_template" $ANYTHING {
            ...
            metadata_options {
              ...
              http_endpoint = "disabled"
              ...
            }
            ...
          }
      - pattern-not-inside: |
          resource "aws_launch_template" $ANYTHING {
            ...
            metadata_options {
              ...
              http_tokens = "required"
              ...
            }
            ...
          }
    message: The EC2 launch template has Instance Metadata Service Version 1
      (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which
      improve security when talking to IMDS. You should either disable IMDS or
      require the use of IMDSv2.
    languages:
      - hcl
    severity: WARNING
    metadata:
      category: security
      technology:
        - terraform
        - aws
      owasp:
        - A07:2021 - Identification and Authentication Failures
      cwe:
        - "CWE-1390: Weak Authentication"
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
        - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options
        - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
      confidence: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Improper Authentication

Examples

aws-ec2-launch-template-metadata-service-v1-enabled.tf

# ruleid: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "fail_1" {
  name = "example"
}

# ruleid: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "fail_2" {
  name = "example"

  metadata_options {
    http_put_response_hop_limit = 2
  }
}

# ruleid: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "fail_3" {
  name = "example"

  metadata_options {
    http_endpoint               = "enabled"
    http_put_response_hop_limit = 2
  }
}

# ruleid: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "fail_4" {
  name = "example"

  metadata_options {
    http_endpoint               = "enabled"
    http_put_response_hop_limit = 2
    http_tokens                 = "optional"
  }
}

# ruleid: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "fail_5" {
  name = "example"

  metadata_options {
    http_put_response_hop_limit = 2
    http_tokens                 = "optional"
  }
}

# ok: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "pass_1" {
  name = "example"

  metadata_options {
    http_endpoint = "disabled"
  }
}

# ok: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "pass_2" {
  name = "example"

  metadata_options {
    http_tokens = "required"
  }
}

# ok: aws-ec2-launch-template-metadata-service-v1-enabled
resource "aws_launch_template" "pass_2" {
  name = "example"

  metadata_options {
    http_endpoint = "enabled"
    http_tokens   = "required"
  }
}