AWS AWSEC2 documentation change
Summary
Restructured instance identity document retrieval process with OS-specific sections, added IMDSv2 token usage examples for Windows/Linux, and reorganized content hierarchy
Security assessment
Changes emphasize IMDSv2 usage (a security best practice) but do not address a specific vulnerability. The documentation now better explains secure token-based authentication for instance metadata access.
Diff
diff --git a/AWSEC2/latest/UserGuide/retrieve-iid.md b/AWSEC2/latest/UserGuide/retrieve-iid.md index 4e8856d83..c88e8f472 100644 --- a//AWSEC2/latest/UserGuide/retrieve-iid.md +++ b//AWSEC2/latest/UserGuide/retrieve-iid.md @@ -5 +5 @@ -# Retrieve the instance identity document for an Amazon EC2 instance +# Retrieve the instance identity document for an EC2 instance @@ -15 +15 @@ To verify the authenticity of an instance identity document after you retrieve i -###### To retrieve the instance identity document +IMDSv2 @@ -17 +16,0 @@ To verify the authenticity of an instance identity document after you retrieve i -Connect to the instance and run the following command to access the instance identity document from the instance metadata. @@ -19 +18 @@ Connect to the instance and run the following command to access the instance ide -cURL +###### Linux @@ -20,0 +20 @@ cURL +Run the following command from your Linux instance to retrieve the instance identity document. @@ -22 +21,0 @@ cURL -**IMDSv2** @@ -24,2 +23 @@ cURL - - $ TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ + TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ @@ -28 +26,7 @@ cURL -**IMDSv1** +###### Windows + +Run the following cmdlet from your Windows instance to retrieve the instance identity document. + + + [string]$token = (Invoke-WebRequest -Headers @{'X-aws-ec2-metadata-token-ttl-seconds' = '21600'} ` + http://169.254.169.254/latest/api/token).Content @@ -31 +35,2 @@ cURL - $ curl http://169.254.169.254/latest/dynamic/instance-identity/document + (Invoke-WebRequest -Headers @{'X-aws-ec2-metadata-token' = $Token} ` + http://169.254.169.254/latest/dynamic/instance-identity/document).Content @@ -33 +38 @@ cURL -PowerShell +IMDSv1 @@ -36 +41 @@ PowerShell -**IMDSv2** +###### Linux @@ -37,0 +43 @@ PowerShell +Run the following command from your Linux instance to retrieve the instance identity document. @@ -39 +44,0 @@ PowerShell - PS C:\> [string]$token = (Invoke-WebRequest -Method Put -Headers @{'X-aws-ec2-metadata-token-ttl-seconds' = '21600'} http://169.254.169.254/latest/api/token).Content @@ -40,0 +46 @@ PowerShell + curl http://169.254.169.254/latest/dynamic/instance-identity/document @@ -42 +48 @@ PowerShell - PS C:\> (Invoke-WebRequest -Headers @{'X-aws-ec2-metadata-token' = $Token} http://169.254.169.254/latest/dynamic/instance-identity/document).Content +###### Windows @@ -44 +50 @@ PowerShell -**IMDSv1** +Run the following cmdlet from your Windows instance to retrieve the instance identity document. @@ -47 +53 @@ PowerShell - PS C:\> (Invoke-WebRequest http://169.254.169.254/latest/dynamic/instance-identity/document).Content + (Invoke-WebRequest http://169.254.169.254/latest/dynamic/instance-identity/document).Content