IMDSv1 vs IMDSv2: why the metadata endpoint changed

On AWS, the Instance Metadata Service at 169.254.169.254 exposes the instance role's credentials. The version matters.

The IMDSv1 flaw

IMDSv1 answers a plain GET. An SSRF in the application is enough to read the credentials:

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE
-> AccessKeyId, SecretAccessKey, Token

It was the mechanic of major breaches (Capital One).

IMDSv2

IMDSv2 first requires a PUT to obtain a session token, with a special header and low TTL. A classic SSRF (GET only, no custom headers) cannot obtain the token, so it fails. It does not remove RCE, but it closes trivial SSRF.

Defence

Enforce IMDSv2 (HttpTokens: required), lower the hop limit to 1 (blocks access from containers), least privilege on the instance role. On the app side, fix the SSRF anyway.