From Detection to Enforcement: Migrating from IMDSv1 to IMDSv2

This post outlines best practices and a staged approach (identification, attribution, migration, enforcement) for migrating from AWS EC2 IMDSv1 to IMDSv2, covering detection via CloudWatch, CloudTrail, and eBPF-based analysis. It highlights organizational challenges in containerized and large-scale environments, options for enforcing IMDSv2 (instance, ASG, and SCPs), and introduces Datadog Cloud Workload Security capabilities and dashboards to surface IMDSv1 usage and support remediation. The focus is on reducing risk from IMDS-related issues (e.g., SSRF paths) and streamlining migration across teams and codebases.