AWS Config can do this using the managed ec2-imdsv2-check rule. Here is a reference: https://docs.aws.amazon.com/config/latest/developerguide/ec2-imdsv2-check.html

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It provides managed rules that you can use to evaluate the configuration settings of your resources against desired configurations. In this case, you can use the AWS Config managed rule "ec2-imdsv2-check" to evaluate whether your EC2 instances are using the Instance Metadata Service Version 2 (IMDSv2) or not. This rule checks if the EC2 instances have the HTTP token request enabled for the Instance Metadata Service (IMDS), which is a requirement for using IMDSv2. If an EC2 instance is found to be non-compliant with the rule (i.e., not using IMDSv2), AWS Config can be configured to automatically remediate the non-compliant resource. You can set up AWS Systems Manager Automation to terminate the non-compliant EC2 instance as the remediation action.

A - AWS Config

A - AWS Config

A is correct: use Config to monitor and SSM Automation to terminate instances B: permission boundary cannot spot the need-to-terminate instances C: Inspector is for vul scanning D: EC2 instance launch successful event wont provide sufficient information

Answer A

Only viable option