AWS Auto Scaling group launch configuration not configured with Instance Metadata Service v2 (IMDSv2)
This policy identifies the autoscaling group launch configuration where IMDSv2 is set to optional. A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. With IMDSv2, every request is now protected by session authentication. Version 2 of the IMDS adds new protections that weren't available in IMDSv1 to further safeguard your EC2 instances created by the autoscaling group. It is recommended to use only IMDSv2 for all your EC2 instances.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: You cannot modify a launch configuration after you create it. To change the launch configuration for an Auto Scaling group, use an existing launch configuration as the basis for a new launch configuration with IMDSv2 enabled.

To update the Auto Scaling group to use the new launch configuration follow the steps below:

1. Open the Amazon EC2 console.
2. On the left navigation pane, under 'Auto Scaling', choose 'Auto Scaling Groups' and Choose 'Launch configurations' near the top of the page.
3. Select the reported launch configuration and choose Actions, then click 'Copy launch configuration'. This sets up a new launch configuration with the same options as the original, but with 'Copy' added to the name.
4. On the 'Create launch configuration' page, expand 'Advanced details' under 'Additional Configuration - optional'.
5. Under the 'Advanced details', go to the 'Metadata version' section.
6. Select 'V2 only (token required)' option.
7. When you have finished, click on the 'Create launch configuration' button at the bottom of the page.
8. On the navigation pane, under Auto Scaling, choose Auto Scaling Groups.
9. Select the check box next to the Auto Scaling group.
10. A split pane opens up at the bottom part of the page, showing information about the group that's selected.
11. On the Details tab, click on the 'Edit' button adjacent to the 'Launch configuration' option.
12. Under the 'Launch configuration' dropdown, select the newly created launch configuration.
13. When you have finished changing your launch configuration, click on the 'Update' button at the bottom of the page.

After you change the launch configuration for an Auto Scaling group, any new instances are launched with the new configuration options. Existing instances are not affected. To update existing instances,

1. Log in to the AWS Console
2. In the console, select the specific region from the region drop-down in the top right corner, for which the alert is generated.
3. Refer 'Configure instance metadata options for existing instances' section from the following URL: 
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html

To delete the reported Auto Scaling group launch configuration follow the steps below:

1. Open the Amazon EC2 console.
2. On the left navigation pane, under 'Auto Scaling', choose 'Auto Scaling Groups' and Choose 'Launch configurations' near the top of the page.
3. Select the reported launch configuration and choose Actions, then click 'Delete launch configuration'.
4. Click on the 'Delete' button to delete the autoscaling group launch configuration.

NOTE: Ensure adequate precautions before you enforce the use of IMDSv2, as applications or agents that use IMDSv1 for instance metadata access will break..

Query:
```config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = (metadataOptions.httpEndpoint does not exist) or (metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpTokens equals "optional") as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;```