IMDS
Instance metadata service
A link-local HTTP endpoint, 169.254.169.254 on the major clouds, through which a virtual machine reads its configuration and temporary credentials. SSRF to it is a common route to cloud credential theft; AWS IMDSv2 requires a session token obtained with a PUT request and limits how many network hops a response can travel.
- Also called
- IMDSv2
- Defined in
- AWS: Use the Instance Metadata Service
Covered in
Constrain server-side fetches to their intended destinations
Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Practice: SSRF lab: Guard an outbound fetch against SSRF · SSRF validation lab: Validate a fetch URL with ipaddress