AWS AWSEC2 documentation change
Summary
Updated terminology from 'allow/turn off' to 'enable/disable' for tag access control in IMDS. Added detailed procedures for enabling/disabling tag access post-launch, expanded CLI/PowerShell examples, and restructured IMDS version sections.
Security assessment
The changes improve documentation for controlling access to instance metadata tags, which is a security feature. However, there's no evidence of addressing a specific vulnerability or incident - this is a documentation clarity improvement for an existing security control.
Diff
diff --git a/AWSEC2/latest/UserGuide/work-with-tags-in-IMDS.md b/AWSEC2/latest/UserGuide/work-with-tags-in-IMDS.md index d443f7cd5..14d18558f 100644 --- a//AWSEC2/latest/UserGuide/work-with-tags-in-IMDS.md +++ b//AWSEC2/latest/UserGuide/work-with-tags-in-IMDS.md @@ -5 +5 @@ -Allow access to tags in instance metadataRetrieve tags from instance metadataTurn off access to tags in instance metadata +Enable access to tags in instance metadataRetrieve tags from instance metadataDisable access to tags in instance metadata @@ -17 +17 @@ If you add or remove an instance tag, the instance metadata is updated while the - * Allow access to tags in instance metadata + * Enable access to tags in instance metadata @@ -21 +21 @@ If you add or remove an instance tag, the instance metadata is updated while the - * Turn off access to tags in instance metadata + * Disable access to tags in instance metadata @@ -26 +26 @@ If you add or remove an instance tag, the instance metadata is updated while the -## Allow access to tags in instance metadata +## Enable access to tags in instance metadata @@ -28 +28 @@ If you add or remove an instance tag, the instance metadata is updated while the -By default, there is no access to instance tags in the instance metadata. For each instance, you must explicitly allow access by using one of the following methods. +By default, there is no access to instance tags in the instance metadata. For each instance, you must explicitly enable access. @@ -48 +48 @@ Console -###### To allow access to tags in instance metadata during instance launch +###### To enable access to tags in instance metadata during instance launch @@ -58,0 +59,15 @@ Console +###### To enable access to tags in instance metadata after instance launch + + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + + 2. In the navigation pane, choose **Instances**. + + 3. Select your instance, and then choose**Actions** , **Instance settings** , **Allow tags in instance metadata**. + + 4. To allow access to tags in instance metadata, select the **Allow** checkbox. + + 5. Choose **Save**. + + + + @@ -62 +77 @@ AWS CLI -###### To allow access to tags in instance metadata during instance launch +###### To enable access to tags in instance metadata during instance launch @@ -64 +79 @@ AWS CLI -Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command and set `InstanceMetadataTags` to `enabled`. +Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command and add the following `--metadata-options` option. @@ -67,4 +81,0 @@ Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest - aws ec2 run-instances \ - --image-id ami-0abcdef1234567890 \ - --instance-type c3.large \ - ... @@ -73 +84 @@ Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest -Console +###### To enable access to tags in instance metadata after instance launch @@ -74,0 +86 @@ Console +Use the following [modify-instance-metadata-options](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-metadata-options.html) command. @@ -76 +87,0 @@ Console -###### To allow access to tags in instance metadata on a running or stopped instance @@ -78 +89,3 @@ Console - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + aws ec2 modify-instance-metadata-options \ + --instance-id i-1234567890abcdef0 \ + --instance-metadata-tags enabled @@ -80 +93 @@ Console - 2. In the navigation pane, choose **Instances**. +###### To verify that access to tags in instance metadata is enabled @@ -82 +95 @@ Console - 3. Select your instance, and then choose**Actions** , **Instance settings** , **Allow tags in instance metadata**. +Use the [describe-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html) command and check the value of `InstanceMetadataTags`. @@ -84 +96,0 @@ Console - 4. To allow access to tags in instance metadata, select the **Allow** checkbox. @@ -86 +98,3 @@ Console - 5. Choose **Save**. + aws ec2 describe-instances \ + --instance-ids i-1234567890abcdef0 \ + --query "Reservations[*].Instances[].MetadataOptions[].InstanceMetadataTags" @@ -88,0 +103 @@ Console +The following is example output. The value is either `enabled` or `disabled`. @@ -91 +106,3 @@ Console -AWS CLI + [ + "enabled" + ] @@ -92,0 +110 @@ AWS CLI +PowerShell @@ -94 +111,0 @@ AWS CLI -###### To allow access to tags in instance metadata on a running or stopped instance @@ -96 +113 @@ AWS CLI -Use the [modify-instance-metadata-options](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-metadata-options.html) command and set `--instance-metadata-tags` to `enabled`. +###### To enable access to tags in instance metadata during instance launch @@ -97,0 +115 @@ Use the [modify-instance-metadata-options](https://awscli.amazonaws.com/v2/docum +Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet and add the following `-MetadataOptions_InstanceMetadataTags` parameter. @@ -99,3 +117,25 @@ Use the [modify-instance-metadata-options](https://awscli.amazonaws.com/v2/docum - aws ec2 modify-instance-metadata-options \ - --instance-id i-123456789example \ - --instance-metadata-tags enabled + + -MetadataOptions_InstanceMetadataTags enabled + +###### To enable access to tags in instance metadata after instance launch + +Use the following [Edit-EC2InstanceMetadataOption](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2InstanceMetadataOption.html) cmdlet. + + + Edit-EC2InstanceMetadataOption ` + -InstanceId i-1234567890abcdef0 ` + -InstanceMetadataTags enabled + +###### To verify that access to tags in instance metadata is enabled + +Use the [Get-EC2Instance](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/Get-EC2Instance.html) cmdlet and check the value of `InstanceMetadataTags`. + + + (Get-EC2Instance -InstanceId i-1234567890abcdef0).Instances.MetadataOptions.InstanceMetadataTags + +The following is example output. The value is either `enabled` or `disabled`. + + + Value + ----- + enabled @@ -107,3 +147 @@ After you allow access to instance tags in the instance metadata, you can access -###### Instance Metadata Service Version 2 - -Run the following examples on your Amazon EC2 instance to retrieve the instance metadata for IMDSv2. +IMDSv2 @@ -111 +148,0 @@ Run the following examples on your Amazon EC2 instance to retrieve the instance -cURL @@ -112,0 +150 @@ cURL +###### Linux @@ -114 +152 @@ cURL -This example gets all the tag keys for an instance. +Run the following command from your Linux instance to list all the tag keys for the instance. @@ -117 +155 @@ This example gets all the tag keys for an instance. - [ec2-user ~]$ TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ + TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ @@ -119,4 +156,0 @@ This example gets all the tag keys for an instance. - Name - Environment - -This example gets the value of the `Name` key that was obtained in the previous example. The IMDSv2 request uses the stored token that was created using the command in the previous example. The token must not be expired. @@ -123,0 +158 @@ This example gets the value of the `Name` key that was obtained in the previous +This example gets the value of a key obtained in the previous example. The IMDSv2 request uses the stored token that was created using the command in the previous example. The token must not be expired. @@ -125,2 +159,0 @@ This example gets the value of the `Name` key that was obtained in the previous - [ec2-user ~]$ curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/Name - MyInstance @@ -128 +161 @@ This example gets the value of the `Name` key that was obtained in the previous -PowerShell + curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/tag-key @@ -129,0 +163 @@ PowerShell +###### Windows @@ -131 +165 @@ PowerShell -This example gets all the tag keys for an instance. +Run the following cmdlet from your Windows instance to list all the tag keys for the instance. @@ -134 +168,3 @@ This example gets all the tag keys for an instance. - PS C:\> $token = Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token-ttl-seconds" = "21600"} -Method PUT -Uri http://169.254.169.254/latest/api/token + $token = Invoke-RestMethod ` + -Headers @{"X-aws-ec2-metadata-token-ttl-seconds" = "21600"} ` + -Method PUT -Uri http://169.254.169.254/latest/api/token @@ -137,3 +173,3 @@ This example gets all the tag keys for an instance. - PS C:\> Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token" = $token} -Method GET -Uri http://169.254.169.254/latest/meta-data/tags/instance - Name - Environment + Invoke-RestMethod ` + -Headers @{"X-aws-ec2-metadata-token" = $token} ` + -Method GET -Uri http://169.254.169.254/latest/meta-data/tags/instance @@ -141 +177 @@ This example gets all the tag keys for an instance. -This example gets the value of the `Name` key that was obtained in the previous example. The IMDSv2 request uses the stored token that was created using the command in the previous example. The token must not be expired. +This example gets the value of a key obtained in the previous example. The IMDSv2 request uses the stored token that was created using the command in the previous example. The token must not be expired. @@ -144,2 +180,3 @@ This example gets the value of the `Name` key that was obtained in the previous - PS C:\> Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token" = $token} -Method GET -Uri http://169.254.169.254/latest/meta-data/tags/instance/Name - MyInstance + Invoke-RestMethod ` + -Headers @{"X-aws-ec2-metadata-token" = $token} ` + -Method GET -Uri http://169.254.169.254/latest/meta-data/tags/instance/tag-key @@ -147 +184 @@ This example gets the value of the `Name` key that was obtained in the previous -###### Instance Metadata Service Version 1 +IMDSv1 @@ -149 +185,0 @@ This example gets the value of the `Name` key that was obtained in the previous -Run the following examples on your Amazon EC2 instance to retrieve the instance metadata for IMDSv1. @@ -151 +187 @@ Run the following examples on your Amazon EC2 instance to retrieve the instance -cURL +###### Linux @@ -152,0 +189 @@ cURL +Run the following command from your Linux instance to list all the tag keys for the instance. @@ -154 +190,0 @@ cURL -This example gets all the tag keys for an instance. @@ -155,0 +192 @@ This example gets all the tag keys for an instance. + curl http://169.254.169.254/latest/meta-data/tags/instance @@ -157,3 +194 @@ This example gets all the tag keys for an instance. - [ec2-user ~]$ curl http://169.254.169.254/latest/meta-data/tags/instance - Name - Environment +This example gets the value of a key obtained in the previous example. @@ -161 +195,0 @@ This example gets all the tag keys for an instance. -This example gets the value of the `Name` key that was obtained in the previous example. @@ -162,0 +197 @@ This example gets the value of the `Name` key that was obtained in the previous + curl http://169.254.169.254/latest/meta-data/tags/instance/tag-key @@ -164,2 +199 @@ This example gets the value of the `Name` key that was obtained in the previous - [ec2-user ~]$ curl http://169.254.169.254/latest/meta-data/tags/instance/Name - MyInstance +###### Windows