Our Journey Migrating to AWS IMDSv2

This post details Slack's migration of its EC2 fleet and tools to AWS IMDSv2 to enhance security by mitigating SSRF vulnerabilities inherent in IMDSv1. It outlines the discovery process using the `MetadataNoToken` CloudWatch metric and the `imds-cw-metric-collector` application, and the investigation of IMDSv1 call origins using `AWS ImdsPacketAnalyzer` and other tools. The post describes the migration of services and scripts to IMDSv2-compatible libraries and the implementation of preventative measures for new instances through Terraform modules (`accounts_using_imdsv1`) and AWS Service Control Policies (SCPs) to enforce IMDSv2. It also highlights the limitations of SCPs and the establishment of an EventBridge and Lambda-based notification system as a final safety net.