A component that never learned the token PUT does not fail in a way that says "metadata". Software on an instance with a role attached through an instance profile reads temporary credentials out of IMDS precisely so nobody keeps access keys on the box [7]. The dev.to lab's walkthrough reads the role name from /latest/meta-data/iam/security-credentials/, which returns IMDSLabRole, then reads AccessKeyId, SecretAccessKey and Token from the path underneath it [6]. Cut that read off and the process starts fine, then fails at whatever AWS API call it makes next [14].
That is why the console's instruction is worth reading literally: confirm the instance is making no IMDSv1 calls first, and use MetadataNoToken to confirm it [1][2]. The metric counts tokenless calls that were made. A backup script that runs monthly, or an agent that only touches IMDS when its cached credentials expire, contributes nothing to that count during a window it did not run in, and reads as compliant [15]. A flat reading over a Tuesday afternoon only tells you what did not happen on that Tuesday afternoon.
The lab requests its token with a TTL of 21600 seconds, which is six hours [8][13]. That sets how long one v2 session stays valid; it says nothing about how long you should watch the metric, and the material supplies no guidance on that either [17].
The second dependency is one most people meet after the flip. The HTTP PUT response hop limit is specifically part of the v2 session mechanism: it governs how many network hops the reply carrying the token may travel, and AWS accepts values from 1 to 64 [11]. A caller sitting further from 169.254.169.254 [4] than that limit allows never receives a token, so it never receives metadata, and from the outside that is indistinguishable from a legacy SDK that never asked for one [16]. The material states the range without stating the default [17], which makes it a number to choose rather than inherit.
One naming trap sits in the middle of all this. The console presents the setting as IMDSv2 Optional or Required, and at launch as a Metadata version field reading "V2 only (token required)" [9][10]. Through the API, CLI, SDKs or infrastructure as code, the same option is HttpTokens [9]. It is the same field under two vocabularies, and the one in the IaC diff is the one that gets reviewed.
The lab cites the 2019 Capital One incident, where unauthorized access to IMDS formed part of an attack chain, and information on more than 100 million people was affected [12]. That history argues for the ordering here, not against it: instrument, choose a hop limit deliberately, then set required. The duration of that first step is the part the lab does not give you a number for [17], and it is the part that decides whether the flag flip is boring.
