Infra Audit5 min readUpdated November 4, 2026

One SSRF Bug Away From Your AWS Credentials

The instance metadata service is the most valuable target in any EC2 compromise. IMDSv1 makes it reachable with a single unauthenticated request.

IMDSv1 returns instance role credentials without a token, so any SSRF vulnerability in an app on that instance becomes a credential theft. Enforce IMDSv2 with HttpTokens=required.

Every EC2 instance can fetch its own role credentials from 169.254.169.254. IMDSv1 answers a plain GET with the credentials JSON. An application with an SSRF vulnerability, a URL-preview feature, a webhook fetcher, an open redirect, can be made to request that address and return the body.

See How We Work

In This Guide

The mechanism

Every EC2 instance can fetch its own role credentials from 169.254.169.254. IMDSv1 answers a plain GET with the credentials JSON. An application with an SSRF vulnerability, a URL-preview feature, a webhook fetcher, an open redirect, can be made to request that address and return the body.
Every EC2 instance can fetch its own role credentials from 169.254.169.254. IMDSv1 answers a plain GET with the credentials JSON. An application with an SSRF vulnerability, a URL-preview feature, a webhook fetcher, an open redirect, can be made to request that address and return the body. The attacker never touches the instance; the app fetches the credentials for them. Capital One 2019: exactly this chain, 100 million records.

IMDSv2 changes the shape of the request

IMDSv2 requires a PUT request to obtain a session token, then the token in a header for the actual fetch. SSRF payloads are usually simple GETs and cannot perform the two-step handshake. That is the entire defense, and it is one flag: HttpTokens=required.
IMDSv2 requires a PUT request to obtain a session token, then the token in a header for the actual fetch. SSRF payloads are usually simple GETs and cannot perform the two-step handshake. That is the entire defense, and it is one flag: HttpTokens=required.

Why 93% still allow it

Datadog's telemetry found 93% of EC2 instances still permit IMDSv1. The flag defaults to optional on older launch configurations, and nobody revisits instance metadata after launch day. It is invisible in normal operation, which is why the audit checks MetadataOptions on every instance and flags anything not required.
Datadog's telemetry found 93% of EC2 instances still permit IMDSv1. The flag defaults to optional on older launch configurations, and nobody revisits instance metadata after launch day. It is invisible in normal operation, which is why the audit checks MetadataOptions on every instance and flags anything not required.

If it stays

Every app on the instance is one SSRF bug away from the role's credentials, and the role's permissions define the blast radius. The exposure is not a matter of if an SSRF exists: web apps accumulate them. The fix is minutes per instance and requires no downtime.
Every app on the instance is one SSRF bug away from the role's credentials, and the role's permissions define the blast radius. The exposure is not a matter of if an SSRF exists: web apps accumulate them. The fix is minutes per instance and requires no downtime.

4 Tips to Get Started

1

aws ec2 describe-instances --query 'Reservations[].Instances[].MetadataOptions' shows the mode per instance.

2

HttpTokens=required is the fix. optional means v1 still works.

3

The Capital One breach was exactly this: SSRF to IMDSv1, role credentials, 100M records.

4

Hop limit and tag protection are secondary. Required tokens is the control that matters.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

What is IMDSv1 and why is it dangerous?

IMDSv1 is the instance metadata service that answers without a token. If an app has an SSRF bug, an attacker can read instance role credentials with one request. IMDSv2 requires a token fetch first, which blocks it. Datadog found 93% of EC2 instances still allow v1.

How does SSRF lead to AWS credentials?

The metadata service at 169.254.169.254 returns the instance role's temporary credentials at /latest/meta-data/iam/security-credentials/. IMDSv1 answers plain GETs, so an attacker who can make the app issue one request to that address receives the credentials in the response. IMDSv2 requires a PUT to obtain a token first, which SSRF payloads typically cannot do.

How do I enforce IMDSv2?

aws ec2 modify-instance-metadata-options --instance-id ID --http-tokens required --http-put-response-hop-limit 1. New instances should set it in the launch template. Then verify with describe-instances that no instance remains in optional mode.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works