AWS Config Rule: EC2 Token Hop Limit Check
EC2_TOKEN_HOP_LIMIT_CHECK
Eduardo Van Cauteren
Last Update 3 maanden geleden
Description: Checks if an Amazon Elastic Compute Cloud (EC2) instance metadata has a specified token hop limit that is below the desired limit. The rule is NON_COMPLIANT for an instance if it has a hop limit value above the intended limit.
Trigger type: Configuration changes
AWS Region: All supported AWS regions
How to Resolve Manually
This config rule checks if an EC2 instance metadata has its token hop limit value below the desired limit.
By default, the response to PUT requests has a response hop limit (time to live) of 1 at the IP protocol level.
If the evaluated instance has a hop limit value above the intended limit, the rule will be marked as non-compliant.
Since this value can't be edited from the AWS Console, to resolve it, you will need to change the value trough the CLI / Cloud Shell.
In the following example, the hop limit is set to 1. Note that when specifying a value for http-put-response-hop-limit, you must also set http-endpoint to enabled.
Want to know more about StackZone and how to make your cloud management simple and secure?
Check our how it works section with easy to follow videos or just create your own StackZone Account here
