Severity discrepancy between autoscaling_group_launch_configuration_requires_imdsv2 and ec2_instance_imdsv2_enabled

[pr3l14t0r]

Steps to Reproduce

Heyho! We recently updated from 4.4.0 to 4.5.3. One of the new checks is autoscaling_group_launch_configuration_requires_imdsv2, which fails for a few resources. We do alert on Critical and High severity, that is mainly why it was brought to my attention.

The mentioned check is referring to autoscaling groups specifically rather than EC2 instances that are currently running.

That means there are currently two checks that would test the MetaData configuration for EC2 instances.

Question:

Why is autoscaling_group_launch_configuration_requires_imdsv2 of severity High while ec2_instance_imdsv2_enable is set to medium?

Here's the output of prowler aws --list-checks | grep imds, maybe it helps (ignore ec2_instance_account_imdsv2_enabled for this discussion):

[autoscaling_group_launch_configuration_requires_imdsv2] Check if Auto Scaling group launch configurations require Instance Metadata Service Version 2 (IMDSv2). - autoscaling [high]
[ec2_instance_account_imdsv2_enabled] Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities. - ec2 [medium]
[ec2_instance_imdsv2_enabled] Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required. - ec2 [medium]

Second question:

Is it possible to set a custom severity to a check? I couldn't find a "simple" solution to this in the docs. It's not worth the effort to create a dedicated customized check out of it.. 😅

Expected behavior

Both ec2_instance_imdsv2_enabled and ec2_instance_account_imdsv2_enabled have the same severity.

Actual Result with Screenshots or Logs

NA

How did you install Prowler?

Cloning the repository from github.com (git clone)

Environment Resource

• Fargate Task
• Local Docker image

OS used

Alpine Linux

Prowler version

Prowler 4.5.3

Pip version

pip 24.2 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)

Context

No response

[pedrooot]

Hi! @pr3l14t0r thanks for the ping. We’ll need to review the logic behind the severity of the checks you mentioned. Once we make a decision, I’ll create a PR with the solution and let you know. Thanks!

Regarding your second question, you can use the custom check metadata feature:
Custom Checks Metadata Documentation
You can find all the information about this feature in our documentation.

Thanks! Best regards.

[pr3l14t0r]

Heyho @pedrooot ! Thank you so much for the super quick response. :)

I don't know how i have overseen the Custom Checks Metada file in the documentation. Lo siento, señor y muchas gracias!