6WAF

EC2 instance still accepts IMDSv1

CRITICAL / HIGH

What's the problem

HttpTokens=optional: an SSRF bug in an application can read the IAM role's temporary credentials from 169.254.169.254 with one GET request. Critical when the instance has an IAM role (6WAF raises EC2.8's High), High without a role

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Identity & access (IAM)

Reference standard: AWS Security Hub EC2.8

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 91) automatically in ~10 minutes

Start free

Related checks

Root account MFA not enabledRoot account has active access keysNo IAM password policy configuredIAM password minimum length below 14