A company runs workloads on EC2 instances and requires that all instances use Instance Metadata Service Version 2 (IMDSv2). If an instance still allows IMDSv1, it must be terminated. Which approach satisfies this requirement?

The correct answer leverages AWS Config, a service designed for continuous monitoring and evaluation of AWS resource configurations. The ec2-imdsv2-required managed rule specifically checks if EC2 instances enforce IMDSv2. By configuring this rule with an AWS Systems Manager Automation document, non-compliant instances (those allowing IMDSv1) can be automatically terminated, directly meeting the requirement. Incorrect options: IAM permissions boundaries control what actions an IAM principal can perform, but they do not enforce configuration on existing or newly launched instances regarding IMDSv2. Amazon Inspector focuses on vulnerability management and security best practices, not directly on IMDSv1/IMDSv2 enforcement for termination. While it might identify related issues, it's not the primary tool for this specific, direct enforcement. An EventBridge rule listening for launch events and a Lambda function could work for new instances, but it wouldn't address existing non-compliant instances without additional logic to scan all running instances. AWS Config provides this continuous evaluation out-of-the-box.