AWS autoscaling high security documentation change
Summary
Updated instance metadata retrieval to use IMDSv2 tokens
Security assessment
Implements Instance Metadata Service v2 which protects against SSRF vulnerabilities by requiring tokens, directly addressing a known security concern
Diff
diff --git a/autoscaling/ec2/userguide/tutorial-lifecycle-hook-instance-metadata.md b/autoscaling/ec2/userguide/tutorial-lifecycle-hook-instance-metadata.md index cd407f624..b38771706 100644 --- a//autoscaling/ec2/userguide/tutorial-lifecycle-hook-instance-metadata.md +++ b//autoscaling/ec2/userguide/tutorial-lifecycle-hook-instance-metadata.md @@ -121,0 +122,4 @@ When you used the IAM console to create an IAM role, the console automatically c + function token { + echo "X-aws-ec2-metadata-token: $(curl -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600')" + } + @@ -123 +127 @@ When you used the IAM console to create an IAM role, the console automatically c - echo $(curl -s http://169.254.169.254/latest/meta-data/autoscaling/target-lifecycle-state) + echo $(curl -H "$(token)" -s http://169.254.169.254/latest/meta-data/autoscaling/target-lifecycle-state) @@ -127 +131 @@ When you used the IAM console to create an IAM role, the console automatically c - echo $(curl -s http://169.254.169.254/latest/meta-data/instance-id) + echo $(curl -H "$(token)" -s http://169.254.169.254/latest/meta-data/instance-id)