Data-2fiam-2fsecurity Credentials-2f | Callback-url-http-3a-2f-2f169.254.169.254-2flatest-2fmeta

When you launch a virtual server (an EC2 instance) in AWS, you often need that server to perform actions—such as uploading files to S3 or writing logs to CloudWatch. To do this, the server needs permissions.

Rather than hard-coding permanent access keys onto the server (which is a major security risk), AWS provides the IMDS. This is a service running on every EC2 instance accessible only from within the instance itself. It provides information about the instance, such as its ID, IP address, and crucially, the IAM role attached to it.

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/MyAppRole

Example Response (Sensitive):

  "Code" : "Success",
  "LastUpdated" : "2023-10-01T12:00:00Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIAIOSFODNN7EXAMPLE",
  "SecretAccessKey" : "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "Token" : "IQoJb3JpZ2luX2VjELz...",
  "Expiration" : "2023-10-01T18:00:00Z"

These credentials are living, breathing keys that grant whatever permissions the IAM role has—potentially full administrative access to S3 buckets, Lambda functions, EC2 control, or even database snapshots.

Due to the prevalence of SSRF attacks, AWS introduced the Instance Metadata Service Version 2 (IMDSv2). When you launch a virtual server (an EC2

In the original version (IMDSv1), the request was a simple HTTP GET request (as described above). IMDSv2 adds a mandatory session layer:

This effectively thwarts simple SSRF attacks because most SSRF vulnerabilities allow an attacker to control the URL, but not the headers of the HTTP request. Example Response (Sensitive):

AWS now strongly recommends disabling IMDSv1 entirely and enforcing IMDSv2 on all EC2 instances.

If an attacker gains code execution on a cloud VM—via a vulnerable web app, SSRF (Server-Side Request Forgery), or a compromised dependency—their next immediate step is almost always: SSRF (Server-Side Request Forgery)

"Check if the instance has IAM credentials at the metadata endpoint."