Following the announce on the aws security blog about improving SSRF vuln : https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

Use Case

EC2 instances can be set to require IMDSv2 only.

Proposed Solution

This can be done with running instances or by using correct IAM policy, documentation : https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#configuring-instance-metadata-options

This is a 🚀 Feature Request