Retrieving EC2 Instance ID via Instance Metadata Service (IMDSv2)
Retrieving your EC2 instance ID from within a running script is a foundational task — but using the wrong metadata approach exposes your workload to SSRF-based credential theft. TL;DR: IMDSv1 vs IMDSv2 for Retrieving Instance ID Approach Mechanism Best For Complexity IMDSv1 (legacy) Single unauthenticated GET Isolated dev environments only Low IMDSv2 (recommended) Session-oriented PUT + GET with token All production workloads Low-Medium Why IMDSv2 Is Safer for EC2 Instance Metadata Retrieval IMDSv2 requires a session token obtained via an HTTP PUT request before any metadata can be read. This session-oriented design defeats the most common SSRF attack vector: a forged GET request from a compromised application that silently reads IAM credentials or the instance ID from 169.254.169.254 . IMDSv1 has no such gate — any process or proxied request reaching that IP gets a response. IMDSv2 enforces a two-step hands...