Assuming you're using the latest version of the AWS CLI, you can run the following:

#!/usr/bin/env bash

set -uefo pipefail

REGIONS=$(aws account list-regions | jq -r ".Regions[] | select(.RegionOptStatus != \"DISABLED\") | .RegionName")

for region in $REGIONS; do aws ec2 modify-instance-metadata-defaults --http-tokens required --region $region; done | cat