Certified Ethical Hacker (CEH) Practice Question

With IMDSv1, requests to the EC2 instance metadata endpoint are not protected by hop-limit or session tokens. If an attacker can coerce the instance itself to make HTTP calls-as is possible through SSRF-they can query the path that returns the temporary security credentials for the IAM role attached to the instance. These short-lived access key, secret key, and session token values can then be used off-instance to interact with AWS APIs and pivot further into the account. While user-data can also be read through IMDS, it rarely contains SSH private keys, and enumerating S3 ACLs or forcing a container pull do not rely on IMDS exposure. Therefore, harvesting instance-role credentials is the principal and most impactful threat.