Orion Analytics must enforce IMDSv2 across all EC2 instances. They already use the AWS Config managed rule ec2-imdsv2-check and want fully automated, least-privilege remediation that sets HttpTokens to required without rebooting instances. What should they do?

The correct solution leverages AWS Config's remediation capabilities with an SSM Automation document. The AWS-ConfigureEC2InstanceMetadataOptions document is specifically designed to modify IMDS settings, including HttpTokens, on running EC2 instances without requiring a reboot. Setting HttpTokens=required enforces IMDSv2. An AutomationAssumeRole with ec2:ModifyInstanceMetadataOptions provides the necessary least-privilege permissions. Enabling automatic remediation ensures continuous compliance. Using Systems Manager Patch Manager is incorrect because IMDSv2 enforcement is a configuration setting, not a patch. An SCP is incorrect because it prevents future non-compliant launches but does not remediate existing instances. A CloudWatch alarm triggering a Lambda to stop and start instances is incorrect because it causes downtime, which the question explicitly seeks to avoid, and is an overly complex approach compared to direct configuration modification.