> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Compute Instance Metadata Service V1 Should Be Disabled

### More Info:

Compute instances should disable legacy Instance Metadata Service (IMDSv1) endpoints. IMDSv1 is vulnerable to SSRF attacks that can expose instance credentials to attackers

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step console instructions to disable Instance Metadata Service v1 (IMDSv1) on an OCI Compute instance (e.g., an instance used for monitoring), leaving only IMDSv2 enabled.

        Note: This is done **per instance** by updating the “Instance Metadata Service Version” setting.

        ***

        ### 1. Identify the compute instance

        1. Sign in to the **OCI Console**.
        2. In the left menu, go to: **Compute** → **Instances**.
        3. In the **Compartment** selector, choose the compartment where your monitoring instance resides.
        4. Click the **Name** of the target instance (the one used for monitoring).

        ***

        ### 2. Open the Instance Details and Edit Settings

        1. You are now on the **Instance details** page.
        2. Click the **More actions** button (three dots) in the top right (or use the **Edit** button, depending on the current UI).
        3. Select **Edit** (or **Edit instance details**).

        ***

        ### 3. Change the Metadata Service Version

        In the **Edit** panel/page:

        1. Scroll down to the **Instance metadata service** section.
        2. Locate the setting typically labeled:
           * **“Instance metadata service version”**, or similar.
        3. Set it to:
           * **V2 only** (or **Use only version 2**, depending on UI wording).
        4. Ensure that **“Allow metadata service v1”** (or equivalent toggle) is **disabled / unchecked**.

        This setting enforces IMDSv2 and implicitly disables IMDSv1.

        ***

        ### 4. Save the Changes

        1. Review the changes.
        2. Click **Save changes** or **Update**.

        No reboot is typically required for the IMDS version setting to take effect, but:

        * If you have any custom agents or scripts on the monitoring instance that query IMDSv1 endpoint (`http://169.254.169.254/opc/v1/...`), update them to use IMDSv2 semantics (including the session token flow) before making this change.

        ***

        ### 5. (Optional) Confirm IMDSv1 Is Disabled

        From within the instance (SSH):

        1. Try to call an IMDSv1 endpoint:
           ```bash theme={null}
           curl http://169.254.169.254/opc/v1/instance/ -v
           ```
           It should fail (e.g., 401/403 or similar denial).
        2. Use the IMDSv2 token flow to confirm IMDSv2 still works:
           ```bash theme={null}
           # Get token
           curl -X PUT \
             -H "Authorization: Bearer Oracle" \
             -H "Accept: application/json" \
             -H "Content-Type: application/json" \
             -H "opc-metadata-token-ttl-seconds: 300" \
             http://169.254.169.254/opc/v2/token

           # Use the returned token in a subsequent request
           ```

        This completes the remediation: IMDSv1 disabled, IMDSv2 enforced for your OCI compute monitoring instance.
      </Accordion>

      <Accordion title="Using CLI">
        To disable OCI Instance Metadata Service v1 (legacy endpoint) for your Compute instances (including those used for monitoring) via OCI CLI, you need to update the instance’s metadata service configuration.

        ### 1. Prerequisites

        * OCI CLI installed and configured (`oci setup config`)
        * Permissions: ability to `inspect` and `update` instances in the target compartment/tenancy.

        ***

        ### 2. Find the instance OCID(s)

        List instances in a compartment:

        ```bash theme={null}
        oci compute instance list \
          --compartment-id <COMPARTMENT_OCID> \
          --lifecycle-state RUNNING \
          --all
        ```

        Note the `id` (instance OCID) for each instance you want to fix.

        ***

        ### 3. Check current IMDS configuration (optional)

        ```bash theme={null}
        oci compute instance get \
          --instance-id <INSTANCE_OCID> \
          --query "data.\"instanceMetadataServiceConfig\"" \
          --raw-output
        ```

        You’ll see something like:

        ```json theme={null}
        {
          "isLegacyImdsEndpointDisabled": false,
          "maxAttempts": 3,
          "sessionDurationInSeconds": 1200
        }
        ```

        ***

        ### 4. Disable IMDSv1 (legacy endpoint) on an existing instance

        Run:

        ```bash theme={null}
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
          --force
        ```

        You can keep other fields if you want (e.g., maxAttempts / sessionDurationInSeconds):

        ```bash theme={null}
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --instance-metadata-service-config '{
            "isLegacyImdsEndpointDisabled": true,
            "maxAttempts": 3,
            "sessionDurationInSeconds": 1200
          }' \
          --force
        ```

        This switches the instance to IMDSv2-only. No reboot is typically required.

        ***

        ### 5. Apply to all monitoring instances (batch)

        Example bash loop for all running instances in a compartment:

        ```bash theme={null}
        COMPARTMENT_OCID=<COMPARTMENT_OCID>

        for ID in $(oci compute instance list \
                      --compartment-id $COMPARTMENT_OCID \
                      --lifecycle-state RUNNING \
                      --query "data[].id" \
                      --raw-output); do
          echo "Disabling IMDSv1 for $ID"
          oci compute instance update \
            --instance-id "$ID" \
            --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
            --force
        done
        ```

        Use a narrower filter (tags, display-name) if you only want monitoring-related instances.

        ***

        ### 6. Ensure future instances are compliant

        If you use instance configurations (e.g., for autoscaling / instance pools used for monitoring), update the configuration as well:

        ```bash theme={null}
        oci compute instance-configuration update \
          --instance-configuration-id <INSTANCE_CONFIG_OCID> \
          --instance-metadata-service-config '{"isLegacyImdsEndpointDisabled": true}' \
          --force
        ```

        New instances launched from that configuration will have IMDSv1 disabled.
      </Accordion>

      <Accordion title="Using Python">
        To disable OCI Instance Metadata Service v1 (legacy endpoints) using Python, you need to set the `are_legacy_imds_endpoints_disabled` flag on the instance options via the OCI Python SDK.

        Below is step‑by‑step remediation for **existing** and **new** instances.

        ***

        ## 1. Prerequisites

        1. Install the OCI Python SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Configure your OCI credentials (e.g. `~/.oci/config`):

        ```ini theme={null}
        [DEFAULT]
        user=ocid1.user.oc1..
        fingerprint=xx:xx:xx:xx
        key_file=/path/to/oci_api_key.pem
        tenancy=ocid1.tenancy.oc1..
        region=us-ashburn-1
        ```

        ***

        ## 2. Disable IMDSv1 on an existing instance

        ```python theme={null}
        import oci
        from oci.core import ComputeClient
        from oci.core.models import UpdateInstanceDetails, InstanceOptions

        # 1. Config + client
        config = oci.config.from_file("~/.oci/config", "DEFAULT")
        compute_client = ComputeClient(config)

        # 2. Target instance OCID
        instance_id = "ocid1.instance.oc1..xxxx"

        # 3. Build update payload: disable legacy IMDS endpoints (IMDSv1)
        update_details = UpdateInstanceDetails(
            instance_options=InstanceOptions(
                are_legacy_imds_endpoints_disabled=True
            )
        )

        # 4. Call update_instance
        response = compute_client.update_instance(
            instance_id=instance_id,
            update_instance_details=update_details
        )

        print("Update launched, new lifecycle state:", response.data.lifecycle_state)
        ```

        This:

        * Keeps IMDSv2 enabled
        * Disables legacy metadata endpoints (IMDSv1 paths such as `/opc/v1/...`).

        No reboot is usually required, but verify any applications relying on IMDSv1 first.

        ***

        ## 3. Ensure all **new** instances have IMDSv1 disabled

        When launching instances (e.g. for monitoring agents), set the same flag in `LaunchInstanceDetails`:

        ```python theme={null}
        import oci
        from oci.core import ComputeClient
        from oci.core.models import LaunchInstanceDetails, InstanceOptions

        config = oci.config.from_file("~/.oci/config", "DEFAULT")
        compute_client = ComputeClient(config)

        launch_details = LaunchInstanceDetails(
            compartment_id="ocid1.compartment.oc1..xxxx",
            availability_domain="kIdk:US-ASHBURN-AD-1",
            shape="VM.Standard.E4.Flex",
            # ... image_id, subnet_id, etc.
            instance_options=InstanceOptions(
                are_legacy_imds_endpoints_disabled=True
            )
        )

        response = compute_client.launch_instance(launch_details)
        print("Launched instance:", response.data.id)
        ```

        ***

        ## 4. Verifying from the instance (optional)

        From the instance, IMDSv1 endpoints (e.g. `curl http://169.254.169.254/opc/v1/instance/`) should return an error or no data, while IMDSv2 endpoints (e.g. `/opc/v2/instance/`) remain available according to OCI docs for your region/shape.

        This is sufficient to satisfy the requirement: **“OCI Compute Instance Metadata Service V1 Should Be Disabled”** for your monitoring instances using Python automation.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_core_instance" "COMPUTE_INSTANCE" {
          # Replace these with your actual values
          compartment_id      = "OCID_OF_COMPARTMENT"
          availability_domain = "AVAILABILITY_DOMAIN_NAME"
          shape               = "VM.SHAPE"
          display_name        = "INSTANCE_NAME"
          subnet_id           = "OCID_OF_SUBNET"
          image_id            = "OCID_OF_IMAGE"

          # Disable legacy IMDSv1 endpoints
          instance_options {
            are_legacy_imds_endpoints_disabled = true
          }

          # ...any other required arguments...
        }
        ```

        This updates the instance’s metadata service to disable legacy IMDSv1; it should not force replacement, but may require a reboot depending on OCI behavior and current state.

        To verify, `terraform plan` should show an in-place update setting `instance_options.are_legacy_imds_endpoints_disabled` from `false` (or unset) to `true` on the affected `oci_core_instance` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>