A company is migrating its Amazon EC2 workloads to Instance Metadata Service Version 2 (IMDSv2). A security engineer must determine whether any EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1). How can the engineer confirm that the IMDSv1 endpoint is no longer being used?

The EC2:MetadataNoToken metric in Amazon CloudWatch specifically tracks successful calls to IMDSv1. If this metric is zero for all EC2 instances, it confirms that IMDSv1 is no longer being used. This is the most direct and efficient way to monitor IMDSv1 usage. Enabling logging for IMDSv1 with the CloudWatch agent during instance startup is not a standard or direct method provided by AWS to track IMDSv1 usage. The CloudWatch agent primarily collects logs and metrics from the operating system, not directly from the IMDS service itself. Creating a security group to block HTTP access to the IMDSv1 endpoint would prevent its use, but it wouldn't confirm whether it was being used prior to the block, nor would it provide ongoing monitoring of attempted access. Configuring user data scripts to send IMDSv1 usage logs to CloudTrail is not a native capability. CloudTrail logs API calls made to AWS services, but direct IMDSv1 requests from an instance are not logged by CloudTrail in this manner.