The aws cpi can now be configured to require tokens for IMDSv2 communication: https://bosh.io/jobs/aws_cpi?source=github.com/cloudfoundry/bosh-aws-cpi-release&version=91#p%3daws.metadata_options

The aws cpi and the bosh agent have been updated to support IMDSv2 tokens, but it's possible there are bosh releases that also need to be updated to support this configuration.

If a bosh release uses instance profiles to communicate with AWS, they may need to be updated to support this new configuration.