# HttpTokens

The state of token usage for your instance metadata requests.

- Source: [`aws-ec2/lib/instance.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-ec2/lib/instance.ts#L48)
- Type last changed: v2.231.0 · 1 Dec 2025

## Example

```ts
declare const vpc: ec2.Vpc;
declare const instanceType: ec2.InstanceType;
declare const machineImage: ec2.IMachineImage;

// Example 1: Enforce IMDSv2 with comprehensive options
new ec2.Instance(this, 'Instance', {
  vpc,
  instanceType,
  machineImage,
  httpEndpoint: true,
  httpProtocolIpv6: false,
  httpPutResponseHopLimit: 2,
  httpTokens: ec2.HttpTokens.REQUIRED,
  instanceMetadataTags: true,
});

// Example 2: Enforce IMDSv2 with minimal configuration
new ec2.Instance(this, 'SecureInstance', {
  vpc,
  instanceType,
  machineImage,
  httpTokens: ec2.HttpTokens.REQUIRED,
});
```

## Members

| Member | Description |
| --- | --- |
| `OPTIONAL` | If the state is optional, you can choose to retrieve instance metadata with or without a signed token header on your request. |
| `REQUIRED` | If the state is required, you must send a signed token header with any instance metadata retrieval requests. |

## Referenced by

- [`InstanceProps`](/v2/docs/aws-cdk-lib.aws_ec2.InstanceProps).httpTokens