Exam AWS Certified Security - Specialty topic 1 question 440 discussion

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata-require-roles-to-use-IMDSv2-credentials Role Credentials is the key word

C option won't affect existing EC2 instances, so the correct answer is D.

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_ec2.html#example-ec2-2

C https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html

Based on https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html C is Require the use of IMDSv2 D is Require role credentials to be retrieved from IMDSv2 C stops us from starting a new instance but the question asks for "must never use IAM credentials from Instance Metadata Service Version 1 (IMDSv1)" Thus D must be correct as it "specifies that if this policy is applied to a role, and the role is assumed by the EC2 service and the resulting credentials are used to sign a request, then the request must be signed by EC2 role credentials retrieved from IMDSv2. Otherwise, all of its API calls will get an UnauthorizedOperation error. This statement/policy can be applied generally because, if the request is not signed by EC2 role credentials, it has no effect."

C and D address the issue. However, D addresses the issue in case EC2 instance is already running. C prevents provisioning new instances with IMDSv1 https://summitroute.com/blog/2020/03/25/aws_scp_best_practices/#require-the-use-of-imdsv2

C is the answer