Fetch-url-http-3a-2f-2f169.254.169.254-2flatest-2fmeta Data-2fiam-2fsecurity Credentials-2f Guide

If you see this in your web server logs or as part of a bug bounty report, it is an attack attempt.

: To get the actual temporary keys (AccessKeyId, SecretAccessKey, and Token), you must append the role name returned by the first command to the end of the URL: Example: curl http://169.254.169 Troubleshooting Common Issues

: These credentials are used for applications running on EC2 instances to securely access other AWS services without needing to store long-term credentials on the instance.

"Code" : "Success", "LastUpdated" : "2023-...", "Type" : "AWS-HMAC", "AccessKeyId" : "ASIA...", "SecretAccessKey" : "...", "Token" : "...", "Expiration" : "..." If you see this in your web server

Once the attacker has the credentials, they can configure the AWS CLI:

In this deep-dive article, we’ll explore exactly what this endpoint is, why attackers obsess over it, how real-world breaches have exploited it, and—most importantly—how to defend your infrastructure against such metadata exfiltration.

creds = requests.get( f"http://169.254.169.254/latest/meta-data/iam/security-credentials/role", headers="X-aws-ec2-metadata-token": token ).json() creds = requests

https://victim.com/fetch-image.php?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Never assign an overly permissive role (e.g., AdministratorAccess ) to an EC2 instance. Use roles that only allow the exact actions needed. If an attacker steals credentials from a role that can only read one S3 bucket, the damage is contained.

http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://169

When an EC2 instance is launched with an IAM role, it can use the metadata service to obtain temporary security credentials. These credentials can then be used to access AWS resources without needing to hard-code or configure long-term access keys.

If an attacker successfully steals a token, their damage is limited by what the IAM role is allowed to do.

If you need help writing a to block this payload at your gateway.