Elastic Compute Service:Instance metadata

Get instance metadata

Instance Metadata is a collection of an instance's attributes, including key properties like instance ID, network environment, and credentials.

Enable access in security hardening mode only

To prevent serious security risks, we recommend enabling Security Hardening Mode only for your ECS instances. Once enabled, you can only access metadata in security hardening mode. any attempt to access it in Normal Mode returns a 403 - Forbidden error. By default, ECS instances allow token-less metadata access (normal mode), which carries a significant risk of SSRF attacks.

Typical attack scenario: A common attack involves exploiting an application feature, like downloading an image from an external URL. An attacker can craft a malicious request that tricks the server into accessing the internal metadata service on their behalf. An attacker can use this to steal the Temporary Security Credentials of the RAM Role attached to the instance. If the role has high privileges, the attacker could gain control over cloud resources or even compromise the entire cloud account.

aliyun ecs RunInstances \
--region cn-hangzhou \
--RegionId 'cn-hangzhou' \
--ImageId 'aliyun_3_x64_20G_alibase_20250629.vhd' \
--InstanceType 'ecs.g7.large' \
--VSwitchId 'vsw-bp1******trg' \
--SecurityGroupId 'sg-bp1******dgl' \
--SystemDisk.Size 40 \
--SystemDisk.Category cloud_essd \
--HttpEndpoint enabled \
--HttpTokens required

aliyun ecs ModifyInstanceMetadataOptions \
--region cn-hangzhou \
--RegionId 'cn-hangzhou' \
--InstanceId 'i-bp1******ke' \
--HttpEndpoint enabled \
--HttpTokens required

Instance metadata details

{
    "AccessKeyId": "****",
    "AccessKeySecret": "****",
    "Expiration": "2024-11-08T09:44:50Z",
    "SecurityToken": "****",
    "LastUpdated": "2024-11-08T03:44:50Z",
    "Code": "Success"
}

FAQ

• What is an SSRF attack, and how does security hardening mode defend against it?

  Server-Side Request Forgery (SSRF) is a security vulnerability where an attacker tricks a server into making unauthorized network requests. This can be used to access protected internal systems like the metadata service or databases. For example, an attacker could submit a URL containing http://100.100.100.200/latest/meta-data/ to trick an application into fetching and returning sensitive information from the metadata, leading to a data leak.

  By default, ECS instances allow token-less metadata access (Normal Mode). Enabling Security Hardening Mode enforces a token validation mechanism: the client must first send a PUT request to obtain a temporary token and then include that token in subsequent GET requests. Because SSRF attacks generally cannot initiate PUT requests, they are unable to obtain a token. This effectively blocks access and enhances metadata security.

• I can't access instance metadata with commands in security hardening mode. How can I fix this?

  Here are some common command errors:

  • The token's validity period is out of range (400 - Missing or Invalid Parameters)

    The time-to-live (TTL) for an instance metadata access token is 1 to 21,600 seconds. If the value exceeds this limit, a 400 - Missing or Invalid Parameters error is returned.

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-aliyun-ecs-metadata-token-ttl-seconds: 21700"

  • The request contains the X-Forwarded-For header (403 - Forbidden)

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-Forwarded-For: www.ba****.com"

  • The specified instance metadata access token is invalid (401 - Unauthorized)

    curl -H "X-aliyun-ecs-metadata-token: aaa" -v http://100.100.100.200/latest/meta-data/

• What should I do if my high-frequency access to the metadata service is throttled?

  The metadata service has access frequency limits. A best practice is to retrieve metadata items that rarely change (like instance-id) once at application startup, then cache them in local memory or on disk with a reasonable cache expiration time.

• My application stopped working after changing the instance metadata access mode to Security Hardening Mode only. How do I troubleshoot?

  An application or script on the instance is likely still using normal mode. Please follow the steps in During an existing instance upgrade o thoroughly check for and upgrade any applications that depend on normal mode.

• Can I access the metadata address from my local machine?

  No. The address 100.100.100.200 is a link-local address that is only reachable from within an ECS instance via its virtual network interface. Any request sent to this address from outside the instance cannot be routed. This is a fundamental design principle for ensuring metadata security.

• I can't select security hardening mode only when creating an instance with a Custom Image. How can I resolve this?

  When creating an ECS instance from a custom Linux image, if you find that you cannot select or enable Security Hardening Mode only, the image likely does not meet the requirements for this security feature. Follow the procedure below to upgrade the image:

  1. Create a temporary instance: Use the custom image that needs upgrading to create a temporary ECS instance for diagnostics and modification.

  2. Modify the temporary instance: On the temporary instance created in the first step, perform the following modifications as described in During an existing instance upgrade:

     • Upgrade Cloud-init: Upgrade it to version 23.2.2 or later.

     • Modify applications/scripts: Modify all applications or scripts that rely on normal mode to be compatible with security hardening mode.

  3. Create a new image and modify its attributes: After the modifications are complete, create a new version of the custom image based on this instance. Then, call ModifyImageAttribute to adjust the image attribute Features.ImdsSupport=v2.

  4. Release resources: To save costs, release the temporary instance used for diagnostics and modification once the new image is created.

• Which versions of the credentials tool support security hardening mode?

  Older versions of Credentials do not support accessing metadata via security hardening mode. When you switch to Security Hardening Mode only, these older versions cannot initialize the SDK because they cannot obtain the STS token from the metadata via normal mode, causing service disruptions.

  Before switching, please upgrade your credentials dependency to a version that supports security hardening mode. The required versions are:

  • Java: credentials-java version >= 0.3.10.

  • Node.js: credentials version >= 2.3.1.

  • PHP: credentials version >= 1.2.0.

  • Python: alibabacloud_credentials version >= 0.3.6.

  • Go: credentials-go version >= 1.3.10.

• How do I detect if an ECS instance is being accessed by using normal mode?

  To find application code that uses normal mode, use these two methods to identify the processes that require upgrades.

  Method 1: Confirm normal mode access via CloudMonitor

  You can quickly confirm if the instance has had any recent normal mode access by checking the ECS Metadata monitoring in the CloudMonitor console.

  1. Go to the CloudMonitor console.

  2. In the left-side navigation pane, select Cloud Resource Monitoring > Cloud Service Monitoring, then search for and go to the ECS Metadata monitoring page.

  3. View the metric The number of successful accesses in normal mode for the target instance.

  4. If this metric's value is not 0, it indicates that the instance is being accessed via normal mode. You need to find the applications that depend on this mode and upgrade them to use security hardening mode.

  Method 2: Use a Cloud Assistant plugin to locate the specific process

  You can use a Cloud Assistant plugin to help you accurately locate the processes within an instance that are using normal mode to access metadata.

  Supported operating systems

  Alibaba Cloud Linux 3 Alibaba Cloud Linux 3 Pro Anolis OS 8 CentOS Stream 8/9 CentOS 8

  Ubuntu: 20/24 Debian: 10, 11, 12 Fedora 35+ AlmaLinux 8/9 Rocky Linux 8/9

  Red Hat Enterprise Linux 8/9 For Red Hat, you need to download an RPM package to install Cloud Assistant Agent. SUSE 15.1/15.2/15.3/15.4/15.5/15.6 OpenSuse 15.2/15.3/15.4/15.5/15.6

  Procedure

  1. Install and enable the Cloud Assistant plugin

     Log on to the ECS instance and run the following commands to install and start the monitoring service. Enabling this service consumes some instance resources.

     # Deploy the monitoring service
     sudo acs-plugin-manager --exec --plugin ACS-ECS-ImdsPacketAnalyzer
     
     # Check the monitoring service status
     sudo systemctl status imds_tracer_tool

     

  2. Locate the problematic process Run the command to see which processes are still accessing metadata in normal mode. The log will show the PID of the relevant processes.

     cat /var/log/imds/imds-trace.* | grep WARNING

     

  3. Analyze and modify Based on the PID in the log, find the corresponding application or script and upgrade it to access metadata in security hardening mode.