Intermediate LevelWeb Security & Cyber Defense
How do you defend against SSRF targeting AWS IMDSv2 and internal VPC endpoints?
❓ Interview Prompt: Explain SSRF mitigation, AWS Instance Metadata Service v2 (IMDSv2 `token` requirement), DNS rebinding defenses, and IP parsing.
Defending cloud workloads against SSRF attacks targeting internal metadata endpoints:
AWS IMDSv2 Enforcement:
AWS IMDSv2 neutralizes standard SSRF by requiring a session token obtained via a 'PUT' request with a custom header:
•
'PUT /latest/api/token' with header 'X-aws-ec2-metadata-token-ttl-seconds: 21600'.
•
Standard SSRF exploits (which issue 'GET' requests) CANNOT obtain the IMDSv2 token!
Code Defense:
Parse and resolve DNS hostnames, verifying that resolved IP addresses do NOT match loopback ('127.0.0.1'), private RFC 1918 CIDRs, or link-local addresses ('169.254.169.254').
Code Implementation Example
bash
# Enforce IMDSv2 on AWS EC2 instance via AWS CLI:
aws ec2 modify-instance-metadata-options \
--instance-id i-1234567890abcdef0 \
--http-tokens required \
--http-endpoint enabled💡Enforcing mandatory AWS IMDSv2 on EC2 instances.
🎯 Interview Key Takeaway
Enforce AWS IMDSv2 and validate resolved IP addresses to block SSRF attacks against cloud metadata.
#SSRF Defense#AWS IMDSv2#Cloud Security#Intermediate
Back to all Web Security & Cyber Defense Questions→