aws-ec2-imds-token
Code running on an instance can read the instance-profile role token from IMDS.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanExecuteCommand {'instance': None}
{'instance': None} ExecutesAs {'role': None}
where
instance metadata HttpEndpoint != disabled
emit
| source | <principal> |
|---|---|
| target | <IAM role> |
| conditions | service_state network_reachability |
| state logic | ACTIVE if HttpEndpoint enabled; BLOCKED if MetadataOptions.HttpEndpoint == disabled |
Narrative
{principal.name}, able to run on {instance.name}, can query IMDS (169.254.169.254) to retrieve {role.name}'s temporary STS credentials.
Raw rule rules/derived/aws/ec2.yaml
id: aws-ec2-imds-token
emits: CanRetrieveToken
description: Code running on an instance can read the instance-profile role token from IMDS.
match:
- - principal: null
- CanExecuteCommand
- instance: null
- - instance: null
- ExecutesAs
- role: null
where:
- instance metadata HttpEndpoint != disabled
emit:
source: <principal>
target: <IAM role>
permissions: []
conditions:
- service_state
- network_reachability
state_logic: ACTIVE if HttpEndpoint enabled; BLOCKED if MetadataOptions.HttpEndpoint == disabled
false_positive_note: IMDS creds are only retrievable when the metadata endpoint is enabled. IMDSv2 required
+ HttpPutResponseHopLimit == 1 blocks SSRF/proxy theft from off-host; on-host code is still fine.
If HttpEndpoint disabled -> BLOCKED.
narrative: '{principal.name}, able to run on {instance.name}, can query IMDS (169.254.169.254) to retrieve
{role.name}''s temporary STS credentials.'