Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 345 discussion

I think it's D. It must indeed use the ec2:MetadataHttpTokens condition key, but if we only deny the ec2:RunInstances, then the already running EC2 instances can still do AWS API calls. Even if they are not using IMDSv2.

Going for D, as A just enforce that the new EC2 instances to use IMDSv2 but there can be old instances not running IDMSv2 that can still do API calls...

Service Control Policies (SCPs) allow you to control which actions are allowed or denied across an entire organization or specific organizational units (OUs) in AWS Organizations. The ec2:MetadataHttpTokens condition key is used to enforce IMDSv2. Setting the value of required ensures that the EC2 instances launched must use IMDSv2, as IMDSv1 would be denied. By denying ec2:RunInstances when the IMDSv2 condition is not met, you are enforcing the policy for all EC2 instances launched, preventing the creation of instances without IMDSv2.

This Service Control Policy (SCP) ensures that any attempt to launch EC2 instances without using IMDSv2 will be denied. By attaching this SCP to the root of the organization, it will apply to all accounts within the organization, ensuring compliance across the board. Here is an example of the SCP statement: { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringNotEquals": { "ec2:MetadataHttpTokens": "required" } } } ] }

Here's why: Service Control Policies (SCPs): SCPs allow you to set permission guardrails for all accounts in your organization. By creating an SCP that denies the ec2:RunInstances action when the ec2:MetadataHttpTokens condition key is not set to required, you ensure that only instances configured to use IMDSv2 can be launched1. Condition Key: The ec2:MetadataHttpTokens condition key ensures that the instance metadata service requires the use of IMDSv21. This approach enforces the use of IMDSv2 across all EC2 instances in the organization, enhancing security by preventing the use of the less secure IMDSv1.

Option A will prevent creating ec2 instances, allowing existing ones to violate policy

Option A provides the correct solution by using the ec2:MetadataHttpTokens condition key in an SCP to deny the ec2:RunInstances action for instances that do not have IMDSv2 enabled. This is the most effective way to ensure compliance with the company’s requirement.