# Remediating AWS IMDSv1

DevFeed: [Remediating AWS IMDSv1](<https://devfeed.tech/articles/remediating-aws-imdsv1-29175.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2021/08/11/remediating-aws-imdsv1/>)

Published: 2021-08-11T16:16:23Z

Content type: tutorial

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Amazon Simple Queue Service (SQS)](<https://devfeed.tech/topics/amazon-simple-queue-service-sqs.md>), [DynamoDB](<https://devfeed.tech/topics/dynamodb.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [bugs](<https://devfeed.tech/tags/bugs.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [dynamodb](<https://devfeed.tech/tags/dynamodb.md>), [ec2](<https://devfeed.tech/tags/ec2.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [iam](<https://devfeed.tech/tags/iam.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [sqs](<https://devfeed.tech/tags/sqs.md>), [technical](<https://devfeed.tech/tags/technical.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This technical article explains why AWS Instance Metadata Service version 1 is risky. Applications vulnerable to SSRF, XXE, or RCE may allow attackers to obtain temporary IAM role credentials from EC2-hosted applications and use them to access AWS services. The article presents defense in depth as a way to limit the impact of application vulnerabilities, although the supplied text ends before the remediation details.

## Source excerpt

2024-12-17 Updated to include Declarative Policies Compute resources in AWS (for example, EC2 instances, ECS tasks/services, etc.) get access to AWS credentials, such as temporary instance role credentials, via the Instance Metadata Service (IMDS). The compute resources use these credentials to access other AWS services such as SQS, DynamoDB and Secrets Manager. Introduction: Problems with IMDSv1 # There was originally only one version of IMDS, now called "v1," which unfortunately many people still use. The technical risks and high profile incidents (the Capital One breach comes to mind) associated with v1, as well as the existence of v2 are well-documented. When an application hosted on an EC2 instance is vulnerable to SSRF, XXE or RCE, attackers can likely steal the temporary AWS credentials of the IAM role configured for the instance. This service is a particularly interesting target for attackers: