thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Advanced

Instance Metadata Service (IMDS)

Link-local endpoint (169.254.169.254) from which an EC2 instance reads its metadata, user data and role credentials.

Definition

IMDS exposes instance details and temporary credentials for the attached IAM role. IMDSv2 requires a session token obtained with an HTTP PUT request and supports a hop limit, mitigating server-side request forgery (SSRF) attacks that abused IMDSv1 to steal credentials. AWS recommends enforcing IMDSv2 only.

Example

TOKEN=$(curl -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600') retrieves an IMDSv2 token.

Exam tip

SSRF stealing role credentials is the classic cloud attack; the fix is requiring IMDSv2 and least-privilege roles.

Related terms