IMDSv2 is the second version of Amazon EC2’s Instance Metadata Service protocol. It requires a temporary session token with metadata requests, preventing access through a single GET request. section 5.2
This requirement matters because server-side request forgery (SSRF) can trick a misconfigured service or WAF into relaying requests to internal endpoints. An exposed metadata service can disclose AWS access keys and enable serious cloud-account compromise. section 5.2
Metadata access through SSRF
A threat actor exploited a WAF misconfiguration to relay a request to an EC2 metadata endpoint during the Capital One breach, retrieving AWS access keys. Requiring a temporary token blocks the simple single-request pattern used by such relays. section 5.2
Use IMDSv2 alongside SSRF defenses:
- Upgrade EC2 instances to IMDSv2 and review metadata-service configuration. section 5.2
- Block user-controlled requests to localhost, internal networks, and sensitive metadata endpoints; use sandboxing or an outbound proxy when arbitrary URLs are required. section 5.2
