AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count greater than 1
This policy identifies the autoscaling group launch configuration where the Instance Metadata Service network hops count is set to greater than 1. A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances. With the metadata response hop limit count for the IMDS greater than 1, the PUT response that contains the secret token can travel outside the EC2 instance. Only metadata with a limited hop count for all your EC2 instances is recommended.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: You cannot modify a launch configuration after you create it. To change the launch configuration for an Auto Scaling group, use an existing launch configuration as the basis for a new launch configuration with IMDS with a hop count equal to 1.

To update the Auto Scaling group to use the new launch configuration follow the steps below:

1. Open the Amazon EC2 console.
2. On the left navigation pane, under 'Auto Scaling', choose 'Auto Scaling Groups' and Choose 'Launch configurations' near the top of the page.
3. Select the reported launch configuration, choose Actions, then click 'Copy launch configuration'. This sets up a new launch configuration with the same options as the original, but with 'Copy' added to the name.
4. On the 'Create launch configuration' page, expand 'Advanced details' under 'Additional Configuration - optional'.
5. Under the 'Advanced details', go to the 'Metadata response hop limit' section.
6. Edit the text box and set the value to 1.
7. When you have finished, click on the 'Create launch configuration' button at the bottom of the page.
8. On the navigation pane, under Auto Scaling, choose Auto Scaling Groups.
9. Select the check box next to the Auto Scaling group.
10. A split pane opens up at the bottom part of the page, showing information about the group that's selected.
11. On the Details tab, click on the 'Edit' button adjacent to the 'Launch configuration' option.
12. Under the 'Launch configuration' dropdown, select the newly created launch configuration.
13. When you have finished changing your launch configuration, click on the 'Update' button at the bottom of the page.

After you change the launch configuration for an Auto Scaling group, any new instances are launched with the new configuration options. Existing instances are not affected. To update existing instances, 

1. Log in to the AWS Console
2. In the console, select the specific region from the region drop-down in the top right corner, for which the alert is generated.
3. Refer 'Configure instance metadata options for existing instances' section from the following URL:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html

To delete the reported Auto Scaling group launch configuration follow the steps below:

1. Open the Amazon EC2 console.
2. On the left navigation pane, under 'Auto Scaling', choose 'Auto Scaling Groups' and Choose 'Launch configurations' near the top of the page.
3. Select the reported launch configuration, choose Actions, then click 'Delete launch configuration'.
4. Click on the 'Delete' button to delete the autoscaling group launch configuration..

Query:
```config from cloud.resource where api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = metadataOptions.httpEndpoint exists and metadataOptions.httpEndpoint equals "enabled" and metadataOptions.httpPutResponseHopLimit greater than 1 as X; config from cloud.resource where api.name = 'aws-describe-auto-scaling-groups' as Y; filter ' $.X.launchConfigurationName equal ignore case $.Y.launchConfigurationName'; show X;```