EC2 IAM roles vulnerable to SSRF attacks

[tolgaOzen]

Find more live information in Aikido here: https://app.aikido.dev/queue?sidebarIssue=4763105&groupId=6798&sidebarIssueTask=191028&sidebarTab=tasks

==== Scope ====
This task includes issues in the following cloud:

• permify

==== TLDR ====
IMDS is an internal AWS service used by EC2 instances to fetch their IAM roles. EC2 Instances should have Metadata Service version 2 (IMDSv2) enabled and required. Using IMDSv2 will protect from misconfiguration and SSRF vulnerabilities. IMDSv1 will not.

==== How to fix ====
Upgrading to Amazon Linux 2023 will automatically remediate this issue as it uses IMDSv2 by default. If you cannot upgrade, use the following code to enable stronger authentication:
aws ec2 modify-instance-metadata-options --instance-id i-1234567898ab --http-tokens required --http-endpoint enabled