In cloud security, few strings of characters are as infamous as the local link-back address: 169.254.169.254 . When combined with specific paths, this IP address becomes the keys to the kingdom for attackers looking to compromise Amazon Web Services (AWS) infrastructure.
If an attacker successfully extracts credentials from this endpoint, the impact on your cloud environment can be catastrophic:
When an AWS EC2 instance is assigned an Identity and Access Management (IAM) role, AWS temporary security credentials are automatically attached to it. The operating system fetches these keys from the following path:
def get_iam_security_credentials(): url = 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' try: response = requests.get(url) response.raise_for_status() # Raise an exception for HTTP errors return response.json() except requests.RequestException as e: print(f"Request Exception: e") return None
If you're researching this topic for (e.g., penetration testing with authorization, cloud security research, or CTF challenges), I recommend focusing on these safer, constructive angles instead:
Attackers don’t magically run curl on your instance. They need to inject this HTTP request into a context that runs on the target machine. The most common methods are:
title: SSRF Attempt to AWS Metadata Service id: 8f4b5d2c-1a3e-4b6c-9d7e-2f8a1b4c6d8e status: experimental description: Detects HTTP requests to 169.254.169.254 in URL parameters or body references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html logsource: category: webserver detection: selection: c-uri|contains: '169.254.169.254' or c-uri|contains: '169.254.169.254' # encoded or c-uri|contains: '169%2E254%2E169%2E254' or c-uri|contains: '0xA9.0xFE.0xA9.0xFE' condition: selection falsepositives: - Legitimate AWS tools (rare) level: high
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,MetadataOptions.HttpTokens]' --output table
– How attackers might target metadata endpoints through SSRF, and how to harden applications using IMDSv2 (session-oriented metadata service), firewall rules, and metadata-request filtering.
: This is a link-local IP address used by AWS, Azure, and Google Cloud to provide metadata about the virtual machine.
: This is a link-local address used by the AWS Instance Metadata Service (IMDS) to allow instances to access information about themselves.
: This is the base URL for the AWS Instance Metadata Service. The IP address 169.254.169.254 is a special IP address that is reserved for this service and can only be accessed from within an EC2 instance.
If you need help writing a to block this payload at your gateway.