OCI Compute Instance Metadata Service V1 Should Be Disabled

Using Console

Below are step‑by‑step console instructions to disable Instance Metadata Service v1 (IMDSv1) on an OCI Compute instance (e.g., an instance used for monitoring), leaving only IMDSv2 enabled.Note: This is done per instance by updating the “Instance Metadata Service Version” setting.

1. Identify the compute instance

Sign in to the OCI Console.
In the left menu, go to: Compute → Instances.
In the Compartment selector, choose the compartment where your monitoring instance resides.
Click the Name of the target instance (the one used for monitoring).

2. Open the Instance Details and Edit Settings

You are now on the Instance details page.
Click the More actions button (three dots) in the top right (or use the Edit button, depending on the current UI).
Select Edit (or Edit instance details).

3. Change the Metadata Service Version

In the Edit panel/page:

Scroll down to the Instance metadata service section.
Locate the setting typically labeled:
- “Instance metadata service version”, or similar.
Set it to:
- V2 only (or Use only version 2, depending on UI wording).
Ensure that “Allow metadata service v1” (or equivalent toggle) is disabled / unchecked.

This setting enforces IMDSv2 and implicitly disables IMDSv1.

4. Save the Changes

Review the changes.
Click Save changes or Update.

No reboot is typically required for the IMDS version setting to take effect, but:

If you have any custom agents or scripts on the monitoring instance that query IMDSv1 endpoint (http://169.254.169.254/opc/v1/...), update them to use IMDSv2 semantics (including the session token flow) before making this change.

5. (Optional) Confirm IMDSv1 Is Disabled

From within the instance (SSH):

Try to call an IMDSv1 endpoint:
curl http://169.254.169.254/opc/v1/instance/ -v
It should fail (e.g., 401/403 or similar denial).

Use the IMDSv2 token flow to confirm IMDSv2 still works:

# Get token
curl -X PUT \
  -H "Authorization: Bearer Oracle" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "opc-metadata-token-ttl-seconds: 300" \
  http://169.254.169.254/opc/v2/token

# Use the returned token in a subsequent request

This completes the remediation: IMDSv1 disabled, IMDSv2 enforced for your OCI compute monitoring instance.

Using CLI

To disable OCI Instance Metadata Service v1 (legacy endpoint) for your Compute instances (including those used for monitoring) via OCI CLI, you need to update the instance’s metadata service configuration.

1. Prerequisites

OCI CLI installed and configured (oci setup config)
Permissions: ability to inspect and update instances in the target compartment/tenancy.

2. Find the instance OCID(s)

List instances in a compartment:

oci compute instance list \
  --compartment-id <COMPARTMENT_OCID> \
  --lifecycle-state RUNNING \
  --all

Note the id (instance OCID) for each instance you want to fix.

3. Check current IMDS configuration (optional)

oci compute instance get \
  --instance-id <INSTANCE_OCID> \
  --query "data.\"instanceMetadataServiceConfig\"" \
  --raw-output

You’ll see something like:

{
  "isLegacyImdsEndpointDisabled": false,
  "maxAttempts": 3,
  "sessionDurationInSeconds": 1200
}

4. Disable IMDSv1 (legacy endpoint) on an existing instance

Run:

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
  --force

You can keep other fields if you want (e.g., maxAttempts / sessionDurationInSeconds):

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --instance-metadata-service-config '{
    "isLegacyImdsEndpointDisabled": true,
    "maxAttempts": 3,
    "sessionDurationInSeconds": 1200
  }' \
  --force

This switches the instance to IMDSv2-only. No reboot is typically required.

5. Apply to all monitoring instances (batch)

Example bash loop for all running instances in a compartment:

COMPARTMENT_OCID=<COMPARTMENT_OCID>

for ID in $(oci compute instance list \
              --compartment-id $COMPARTMENT_OCID \
              --lifecycle-state RUNNING \
              --query "data[].id" \
              --raw-output); do
  echo "Disabling IMDSv1 for $ID"
  oci compute instance update \
    --instance-id "$ID" \
    --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
    --force
done

Use a narrower filter (tags, display-name) if you only want monitoring-related instances.

6. Ensure future instances are compliant

If you use instance configurations (e.g., for autoscaling / instance pools used for monitoring), update the configuration as well:

oci compute instance-configuration update \
  --instance-configuration-id <INSTANCE_CONFIG_OCID> \
  --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
  --force

New instances launched from that configuration will have IMDSv1 disabled.

Using Python

To disable OCI Instance Metadata Service v1 (legacy endpoints) using Python, you need to set the are_legacy_imds_endpoints_disabled flag on the instance options via the OCI Python SDK.Below is step‑by‑step remediation for existing and new instances.

1. Prerequisites

Install the OCI Python SDK:

pip install oci

Configure your OCI credentials (e.g. ~/.oci/config):

[DEFAULT]
user=ocid1.user.oc1..
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..
region=us-ashburn-1

2. Disable IMDSv1 on an existing instance

import oci
from oci.core import ComputeClient
from oci.core.models import UpdateInstanceDetails, InstanceOptions

# 1. Config + client
config = oci.config.from_file("~/.oci/config", "DEFAULT")
compute_client = ComputeClient(config)

# 2. Target instance OCID
instance_id = "ocid1.instance.oc1..xxxx"

# 3. Build update payload: disable legacy IMDS endpoints (IMDSv1)
update_details = UpdateInstanceDetails(
    instance_options=InstanceOptions(
        are_legacy_imds_endpoints_disabled=True
    )
)

# 4. Call update_instance
response = compute_client.update_instance(
    instance_id=instance_id,
    update_instance_details=update_details
)

print("Update launched, new lifecycle state:", response.data.lifecycle_state)

This:

Keeps IMDSv2 enabled
Disables legacy metadata endpoints (IMDSv1 paths such as /opc/v1/...).

No reboot is usually required, but verify any applications relying on IMDSv1 first.

3. Ensure all new instances have IMDSv1 disabled

When launching instances (e.g. for monitoring agents), set the same flag in LaunchInstanceDetails:

import oci
from oci.core import ComputeClient
from oci.core.models import LaunchInstanceDetails, InstanceOptions

config = oci.config.from_file("~/.oci/config", "DEFAULT")
compute_client = ComputeClient(config)

launch_details = LaunchInstanceDetails(
    compartment_id="ocid1.compartment.oc1..xxxx",
    availability_domain="kIdk:US-ASHBURN-AD-1",
    shape="VM.Standard.E4.Flex",
    # ... image_id, subnet_id, etc.
    instance_options=InstanceOptions(
        are_legacy_imds_endpoints_disabled=True
    )
)

response = compute_client.launch_instance(launch_details)
print("Launched instance:", response.data.id)

4. Verifying from the instance (optional)

From the instance, IMDSv1 endpoints (e.g. curl http://169.254.169.254/opc/v1/instance/) should return an error or no data, while IMDSv2 endpoints (e.g. /opc/v2/instance/) remain available according to OCI docs for your region/shape.This is sufficient to satisfy the requirement: “OCI Compute Instance Metadata Service V1 Should Be Disabled” for your monitoring instances using Python automation.

Using Terraform

resource "oci_core_instance" "COMPUTE_INSTANCE" {
  # Replace these with your actual values
  compartment_id      = "OCID_OF_COMPARTMENT"
  availability_domain = "AVAILABILITY_DOMAIN_NAME"
  shape               = "VM.SHAPE"
  display_name        = "INSTANCE_NAME"
  subnet_id           = "OCID_OF_SUBNET"
  image_id            = "OCID_OF_IMAGE"

  # Disable legacy IMDSv1 endpoints
  instance_options {
    are_legacy_imds_endpoints_disabled = true
  }

  # ...any other required arguments...
}

This updates the instance’s metadata service to disable legacy IMDSv1; it should not force replacement, but may require a reboot depending on OCI behavior and current state.To verify, terraform plan should show an in-place update setting instance_options.are_legacy_imds_endpoints_disabled from false (or unset) to true on the affected oci_core_instance resource.

OCI Misconfigurations

OCI Compute Instance Metadata Service V1 Should Be Disabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the compute instance

2. Open the Instance Details and Edit Settings

3. Change the Metadata Service Version

4. Save the Changes

5. (Optional) Confirm IMDSv1 Is Disabled

1. Prerequisites

2. Find the instance OCID(s)

3. Check current IMDS configuration (optional)

4. Disable IMDSv1 (legacy endpoint) on an existing instance

5. Apply to all monitoring instances (batch)

6. Ensure future instances are compliant

1. Prerequisites

2. Disable IMDSv1 on an existing instance

3. Ensure all new instances have IMDSv1 disabled

4. Verifying from the instance (optional)

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify the compute instance

​2. Open the Instance Details and Edit Settings

​3. Change the Metadata Service Version

​4. Save the Changes

​5. (Optional) Confirm IMDSv1 Is Disabled

​1. Prerequisites

​2. Find the instance OCID(s)

​3. Check current IMDS configuration (optional)

​4. Disable IMDSv1 (legacy endpoint) on an existing instance

​5. Apply to all monitoring instances (batch)

​6. Ensure future instances are compliant

​1. Prerequisites

​2. Disable IMDSv1 on an existing instance

​3. Ensure all new instances have IMDSv1 disabled

​4. Verifying from the instance (optional)

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the compute instance

2. Open the Instance Details and Edit Settings

3. Change the Metadata Service Version

4. Save the Changes

5. (Optional) Confirm IMDSv1 Is Disabled

1. Prerequisites

2. Find the instance OCID(s)

3. Check current IMDS configuration (optional)

4. Disable IMDSv1 (legacy endpoint) on an existing instance

5. Apply to all monitoring instances (batch)

6. Ensure future instances are compliant

1. Prerequisites

2. Disable IMDSv1 on an existing instance

3. Ensure all new instances have IMDSv1 disabled

4. Verifying from the instance (optional)