A penetration tester is testing a cloud environment and discovers that an EC2 instance has the Instance Metadata Service (IMDS) accessible without IMDSv2 enforcement. What attack is possible through this misconfiguration?

Question

Accepted Answer

B. Accessing the instance metadata endpoint to retrieve temporary IAM credentials. The AWS Instance Metadata Service (IMDS) endpoint at 169.254.169.254 provides EC2 instances with configuration data including temporary IAM credentials associated with the instance's IAM role. If IMDSv2 (which requires a PUT-based session token request) is not enforced, an attacker with SSRF or direct access can query the metadata endpoint and retrieve temporary credentials to escalate privileges within the AWS environment.

A penetration tester is testing a cloud environment and discovers that an EC2 instance has the Instance Metadata Service (IMDS) accessible without IMDSv2 enforcement. What attack is possible through this misconfiguration?

Related Questions

Discussion