Some Random Notes

2.1 AWS Metadata services

2 min read

Q what is AWS Metadata services 169.254.169.254 in this context ?

In the context of cloud architecture and the OWASP Top 10 (specifically regarding Server-Side Request Forgery - SSRF), 169.254.169.254 is the reserved, universal IP address used by cloud providers (like AWS, Azure, and Google Cloud) for their Instance Metadata Service (IMCS).

Here is why it matters and how it ties into the scenario:

What is the Metadata Service?

When an application runs inside a cloud virtual machine (like an EC2 instance or a Kubernetes worker node), that application frequently needs to know things about its hosting environment—such as its current region, local IP address, IAM instance profile roles, and temporary security credentials.

To fetch this info, the application makes an HTTP GET request to the local link-local address: [http://169.254.169.254/latest/meta-data/](http://169.254.169.254/latest/meta-data/).

How it Becomes a Vulnerability (SSRF)

If an application suffers from SSRF (A01: Broken Access Control / SSRF)—meaning it blindly accepts a URL from a user and forces the server to make an HTTP request to it—an attacker can exploit this metadata endpoint:

  1. The Attack: The attacker sends a malicious payload into an image-fetching or webhook feature: [https://169.254.169.254/latest/meta-data/iam/security-credentials/](https://169.254.169.254/latest/meta-data/iam/security-credentials/).

  2. The Result: Because the request originates from inside the cloud server, the AWS infrastructure trusts it and returns the temporary IAM role credentials (AWS Access Key ID and Secret Access Key) belonging to that server.

  3. The Compromise: The attacker steals these credentials from the HTTP response, giving them full administrative access to read databases, S3 buckets, or other infrastructure resources connected to that AWS account.

How to Mitigate It

  • Restrict Outbound Traffic: Configure egress security groups and network firewalls so that backend pods/servers cannot route HTTP traffic to 169.254.169.254 unless explicitly required.

  • Require IMDSv2 (Token-Based Metadata): AWS enforces Instance Metadata Service Version 2 (IMDSv2), which requires a session token header (PUT request first) to fetch metadata. This blocks basic SSRF attacks because an attacker cannot easily script the initial token handshake through a simple URL input field.

Backlinks