After a web application compromise, responders see outbound requests from the app tier to the instance metadata service collecting temporary cloud credentials. Which attack path should the city treat this as?
Select an answer to reveal the explanation.
Short Explanation
Instance metadata is like a sticky note on the server that holds short-lived cloud keys—super handy for legitimate apps, super dangerous if an attacker can read it. After a web foothold, grabbing those credentials is a classic cloud move. Lock down metadata hops and keep secrets off the public path.
Full Explanation
Cloud instance metadata services provide temporary credentials and instance identity material to authorized workloads. Attackers who achieve code execution or server-side request forgery often query those endpoints to escalate into the cloud control plane. Defenders should restrict metadata access, prefer hardened metadata versions, and monitor unusual IMDS retrieval patterns after application compromises.