Elastic Compute Service:Instance metadata

Get instance metadata

Instance metadata is a collection of instance attributes, including key properties such as instance ID, network environment, and access credentials.

Enable access in security hardening mode only

To prevent serious security risks, enable Security Hardening Mode for your ECS instances. After this mode is enabled, you can access metadata only in security hardening mode. Any attempt to access metadata in normal mode returns a 403 - Forbidden error. By default, ECS instances allow token-free access to metadata (normal mode), which poses a high risk of SSRF attacks.

A typical attack scenario involves exploiting an application feature, such as downloading an image from an external URL. An attacker can craft a malicious request that tricks the server into accessing the internal metadata service on their behalf. This can be used to steal the temporary access credentials of the RAM role that is attached to the instance. If the role has high-level permissions, the attacker could gain control over your cloud resources or even take over your entire Alibaba Cloud account.

aliyun ecs RunInstances \ --region cn-hangzhou \ --RegionId 'cn-hangzhou' \ --ImageId 'aliyun_3_x64_20G_alibase_20250629.vhd' \ --InstanceType 'ecs.g7.large' \ --VSwitchId 'vsw-bp1******trg' \ --SecurityGroupId 'sg-bp1******dgl' \ --SystemDisk.Size 40 \ --SystemDisk.Category cloud_essd \ --HttpEndpoint enabled \ --HttpTokens required

aliyun ecs ModifyInstanceMetadataOptions \ --region cn-hangzhou \ --RegionId 'cn-hangzhou' \ --InstanceId 'i-bp1******ke' \ --HttpEndpoint enabled \ --HttpTokens required

Instance metadata details

{ "AccessKeyId": "****", "AccessKeySecret": "****", "Expiration": "2024-11-08T09:44:50Z", "SecurityToken": "****", "LastUpdated": "2024-11-08T03:44:50Z", "Code": "Success" }

FAQ

• What is an SSRF attack, and how does security hardening mode defend against it?

  SSRF is a security vulnerability where an attacker tricks a server into making unauthorized network requests. This can be used to access protected internal systems such as the metadata service or databases. For example, an attacker can submit a URL that contains http://100.100.100.200/latest/meta-data/ to trick an application into fetching and returning sensitive information from the metadata. This causes a data breach.

  By default, ECS instances allow token-free access to metadata (normal mode). Enabling security hardening mode enforces a token validation mechanism. The client must first send a PUT request to obtain a temporary token and then include that token in subsequent GET requests. Because SSRF attacks cannot easily initiate PUT requests, they cannot obtain a token. This effectively blocks access and improves metadata security.

• I cannot access instance metadata using commands in security hardening mode. How do I fix this?

  The following command errors are common:

  • The TTL of the instance metadata access credential is out of range (400 - Missing or Invalid Parameters)

    The TTL for an instance metadata access credential is 1 to 21,600 seconds. If the value exceeds this limit, a 400 - Missing or Invalid Parameters error is returned.

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-aliyun-ecs-metadata-token-ttl-seconds: 21700"

  • The request contains the X-Forwarded-For header (403 - Forbidden)

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-Forwarded-For: www.ba****.com"

  • The specified instance metadata access credential is invalid (401 - Unauthorized)

    curl -H "X-aliyun-ecs-metadata-token: aaa" -v http://100.100.100.200/latest/meta-data/

• What do I do if my high-frequency access to the metadata service is throttled?

  The metadata service has access frequency limits. A best practice is to retrieve metadata items that rarely change, such as instance-id, once at application startup. Then, cache them in local memory or a file with a reasonable time-to-live.

• My application stopped working after I changed the instance metadata access mode to security hardening mode. How do I troubleshoot this issue?

  An application or script on the instance may still be using normal mode. Follow the steps in Upgrade an existing instance to security hardening mode to check for and upgrade any applications that use normal mode.

• Can I access the metadata address from a local host?

  No, you cannot. The address 100.100.100.200 is a link-local address that is reachable only from within an ECS instance over its virtual network interface. Any request sent to this address from outside the instance cannot be routed. This is a fundamental design principle for ensuring metadata security.

• What do I do if I cannot select security hardening mode when I create an instance from a custom image?

  When you create an ECS instance from a custom Linux image, you may find that you cannot select or enable Security Hardening Mode. This usually means that the image does not meet the requirements for this security feature. To resolve this issue, upgrade the image as follows:

  1. Create a temporary instance: Use the custom image that you want to upgrade to create a temporary ECS instance for diagnostics and modification.

  2. Modify the temporary instance: On the temporary instance that you created in Step 1, perform the following modifications. For more information, see Upgrade an existing instance to security hardening mode.

     • Upgrade Cloud-init: Upgrade Cloud-init to version 23.2.2 or later.

     • Modify applications and scripts: Modify all applications or scripts that use normal mode to adapt them to security hardening mode.

  3. Create a new image and modify its attributes: After you complete the modifications, create a new custom image from the instance. Then, call the ModifyImageAttribute operation to set the Features.ImdsSupport attribute of the image to `v2`.

  4. Release resources: After the new image is created, promptly release the temporary instance to save costs.

• Which versions of the Credentials tool support security hardening mode?

  Earlier versions of Credentials do not support access to metadata in security hardening mode. If you switch to security hardening mode, these versions cannot obtain an STS token from the metadata in normal mode to initialize the SDK. This causes service interruptions.

  Before you switch modes, upgrade the Credentials dependency to a version that supports security hardening mode. The version requirements are as follows:

  • Java: credentials-java version >= 0.3.10.

  • Node.js: credentials version >= 2.3.1.

  • PHP: credentials version >= 1.2.0.

  • Python: alibabacloud_credentials version >= 0.3.6.

  • Go: credentials-go version >= 1.3.10.

• How do I detect if an ECS instance is being accessed in normal mode?

  When you check for application code on an instance that uses normal mode, you can use the following methods to detect and locate the specific processes. This helps you perform the required upgrades.

  Method 1: Use CloudMonitor to check for normal mode access

  You can check the ECS metadata monitoring data in the CloudMonitor console to quickly confirm whether the instance has been recently accessed in normal mode.

  1. Log on to the CloudMonitor console.

  2. In the navigation pane on the left, choose Cloud Resource Monitoring > Cloud Service Monitoring. Then, search for and go to the ECS Metadata monitoring page.

  3. View the Successful Normal Mode Accesses metric for the target instance.

  4. If the value of this metric is not 0, the instance is being accessed in normal mode. You must find the applications that use this mode and upgrade them to use security hardening mode.

  Method 2: Use a Cloud Assistant plugin to locate a specific process

  You can use a Cloud Assistant plugin to help you accurately locate the processes within an instance that are using normal mode to access metadata.

  Supported operating systems

  Alibaba Cloud Linux 3 Alibaba Cloud Linux 3 Pro Anolis OS 8 CentOS Stream 8/9 CentOS 8

  Ubuntu: 20/24 Debian:10,11,12 Fedora 35+ AlmaLinux 8/9 Rocky Linux 8/9

  Red Hat Enterprise Linux 8/9 For Red Hat, you must download an RPM package to install Cloud Assistant Agent. SUSE 15.1/15.2/15.3/15.4/15.5/15.6 OpenSuse 15.2/15.3/15.4/15.5/15.6

  Procedure

  1. Install and enable the Cloud Assistant plugin

     Log on to the ECS instance and run the following commands to install and start the monitoring service. After this service is enabled, it consumes some instance resources.

     # Deploy the monitoring service. sudo acs-plugin-manager --exec --plugin ACS-ECS-ImdsPacketAnalyzer # Check the status of the monitoring service. sudo systemctl status imds_tracer_tool

     

  2. Locate the problematic process Run the command to check which processes are still accessing metadata in normal mode. The log displays the process IDs (PIDs) of the relevant processes.

     cat /var/log/imds/imds-trace.* | grep WARNING

     

  3. Analyze and modify Based on the PIDs in the log, find the corresponding applications or scripts and upgrade them to access metadata in security hardening mode.