Add new check: Enforce IMDSv2 in EC2 instance and Launch Configuration

[jonjozwiak]

Blog Post Here: https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

CloudFormation: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-launchtemplatedata-metadataoptions.html
- Doesn’t appear possible for individual EC2 instance…

Terraform: It does not appear configurable, but suggest further research.
https://www.terraform.io/docs/providers/aws/r/launch_template.html
https://www.terraform.io/docs/providers/aws/r/instance.html

[KevinHock]

This would be a great feature to have!

For Terraform, I think we would do

if (
	metadata_options["http_tokens"] == "required"
	or
	metadata_options["http_endpoint"] == "disabled"
):
    # return and don't alert...
# otherwise, alert 

from https://www.terraform.io/docs/providers/aws/r/instance.html#metadata-options

[stale]

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at https://slack.bridgecrew.io
Thanks!

[KevinHock]

This is kinda done as far as Terraform goes, re: my commit above ref'ing this issue

What should we do for cloudformation?

[rollwagen]

FYI - as far Cloudformation goes, it seems this is still not possible on an EC2 instance level; still marked as 'open' on the roadmap. For details see aws-cloudformation/cloudformation-coverage-roadmap#655

[nimrodkor]

I believe this has been implemented for cloudformation and terraform. If someone disagrees - please reopen!

[rollwagen]

@nimrodkor - thanks for the update and looking into this.
In cloudformation the checkov check is for a (EC2-) LaunchConfiguration, this is at the moment still the workaround for setting IMDSv2; still can't do directly on and EC2 resource type (issue in cloudformation repo on this is still open, see link. So technically not fully closed as title says "Enforce IMDSv2 in EC2 instance", however, practically, at the moment, I believe there's not much more that can be done (for cloudformation).