A penetration tester exploits an authenticated Server-Side Request Forgery (SSRF) vulnerability in a cloud application. The tester successfully queries the AWS Instance Metadata Service at 169.254.169.254. What is the security impact?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the AWS IMDS (Instance Metadata Service) at 169.254.169.254/latest/meta-data/iam/security-credentials/ returns temporary IAM role credentials including access key ID, secret access key, and session token; an attacker with these credentials has the same AWS permissions as the EC2 instance's role, which can include S3 access, database access, or even account compromise. A is wrong because IMDS serves instance metadata (role credentials, user data, AMI ID) not application source code.
Full explanation below image
Full Explanation
B is correct because the AWS IMDS (Instance Metadata Service) at 169.254.169.254/latest/meta-data/iam/security-credentials/ returns temporary IAM role credentials including access key ID, secret access key, and session token; an attacker with these credentials has the same AWS permissions as the EC2 instance's role, which can include S3 access, database access, or even account compromise. A is wrong because IMDS serves instance metadata (role credentials, user data, AMI ID) not application source code. C is wrong because IMDS returns significantly more than public IP; it includes IAM credentials, user-data scripts, and security group information. D is wrong because AWS does not automatically terminate instances based on IMDS access; that would break legitimate application operations.