Use AWS Config to find EC2 instances using Instance Metadata Service Version 1 (IMDSv1)

Question

How do you find Amazon EC2 instances that are in a public subnet and are using Instance Metadata Service Version 1 (IMDSv1) using AWS Config or AWS Security Hub?

Thanks.

Answer 1

figured it out:

SELECT
  resourceId,
  resourceName,
  resourceType,
  configuration.publicDnsName,
  configuration.instanceType,
  tags,
  availabilityZone
WHERE
  resourceType = 'AWS::EC2::Instance'
  AND configuration.publicDnsName LIKE 'ec2%'

or if you want to do it via the CLI

aws configservice select-aggregate-resource-config --expression "SELECT resourceId, resourceName, resourceType, configuration.publicDnsName, configuration.instanceType, tags, availabilityZone WHERE resourceType = 'AWS::EC2::Instance' AND configuration.publicDnsName LIKE 'ec2%'" --configuration-aggregator-name XX-XX-XX