A penetration tester exploits an authenticated Server-Side Request Forgery (SSRF) vulnerability in a cloud application. The tester successfully queries the AWS Instance Metadata Service at 169.254.169.254. What is the security impact?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when you hit the AWS Instance Metadata Service at 169.254.169.254, you can pull temporary IAM role credentials, including the access key ID, secret access key, and session token. Those credentials give you the same AWS permissions as the instance's role, which can lead to S3 access, database access, or even account compromise.
Full Explanation
The correct impact is that the tester can retrieve IAM role credentials (temporary access keys, secret, and session token) from the metadata endpoint, potentially gaining access to all AWS services the instance role has permission to use. The AWS IMDS at 169.254.169.254/latest/meta-data/iam/security-credentials/ returns temporary IAM role credentials including access key ID, secret access key, and session token; an attacker with these credentials has the same AWS permissions as the EC2 instance's role, which can include S3 access, database access, or even account compromise. The source-code claim is wrong because IMDS serves instance metadata (role credentials, user data, AMI ID), not application source code. The only-public-IP claim is wrong because IMDS returns significantly more than the public IP; it includes IAM credentials, user-data scripts, and security group information. The alert-termination claim is wrong because AWS does not automatically terminate instances based on IMDS access; that would break legitimate application operations.