A penetration tester exploits an authenticated Server-Side Request Forgery (SSRF) vulnerability in a cloud application. The tester successfully queries the AWS Instance Metadata Service at 169.254.169.254. What is the security impact?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because the AWS IMDS (Instance Metadata Service) at 169.254.169.254/latest/meta-data/iam/security-credentials/ returns temporary IAM role credentials including access key ID, secret access key, and session token; an attacker with these credentials has the same AWS permissions as the EC2 instance's role, which can include S3 access, database access, or even account compromise. A is wrong because IMDS serves instance metadata (role credentials, user data, AMI ID) not application source code.
Full Explanation
B is correct because the AWS IMDS (Instance Metadata Service) at 169.254.169.254/latest/meta-data/iam/security-credentials/ returns temporary IAM role credentials including access key ID, secret access key, and session token; an attacker with these credentials has the same AWS permissions as the EC2 instance's role, which can include S3 access, database access, or even account compromise. A is wrong because IMDS serves instance metadata (role credentials, user data, AMI ID) not application source code. C is wrong because IMDS returns significantly more than public IP; it includes IAM credentials, user-data scripts, and security group information. D is wrong because AWS does not automatically terminate instances based on IMDS access; that would break legitimate application operations.