SEC310: Security best practices for the Amazon EC2 instance metadata service

The Amazon EC2 instance metadata service (IMDS) provides a rich set of relevant data to software on that instance. The IMDS ability to perform introspection about the runtime environment, as well as to pass parameters and code through user data, greatly simplifies software development and deployment. At the same time, an instance's metadata includes private information, such as AWS credentials, that should be limited to the software or humans that need access. In this session, we take a close look at the IMDS and mechanisms for protecting it from unintended access, including new capabilities provided by the recently launched IMDS version.