Elastic Compute Service:Instance metadata

Get instance metadata

Instance metadata includes attributes such as instance ID, network configuration, and access credentials.

Enable security hardening mode only

Enable Security Hardening Mode so that metadata can only be accessed with a token. Normal mode requests return a 403 - Forbidden error. By default, ECS instances allow token-free access (normal mode), which poses a high risk of SSRF attacks.

A typical attack exploits an application feature such as downloading an image from an external URL. An attacker crafts a request that tricks the server into querying the metadata service, stealing the RAM role's temporary credentials. If the role has high-level permissions, the attacker could gain control over your cloud resources or your entire Alibaba Cloud account.

aliyun ecs RunInstances \
--region cn-hangzhou \
--RegionId 'cn-hangzhou' \
--ImageId 'aliyun_3_x64_20G_alibase_20250629.vhd' \
--InstanceType 'ecs.g7.large' \
--VSwitchId 'vsw-bp1******trg' \
--SecurityGroupId 'sg-bp1******dgl' \
--SystemDisk.Size 40 \
--SystemDisk.Category cloud_essd \
--HttpEndpoint enabled \
--HttpTokens required

aliyun ecs ModifyInstanceMetadataOptions \
--region cn-hangzhou \
--RegionId 'cn-hangzhou' \
--InstanceId 'i-bp1******ke' \
--HttpEndpoint enabled \
--HttpTokens required

Instance metadata details

Metadata is organized in a directory-like hierarchy. Accessing a directory returns its entries or subdirectories. For example, meta-data/instance/ returns instance-name and instance-type.

{
    "AccessKeyId": "****",
    "AccessKeySecret": "****",
    "Expiration": "2024-11-08T09:44:50Z",
    "SecurityToken": "****",
    "LastUpdated": "2024-11-08T03:44:50Z",
    "Code": "Success"
}

FAQ

• What is an SSRF attack, and how does security hardening mode defend against it?

  SSRF is a vulnerability where an attacker tricks a server into making unauthorized network requests to access internal systems such as the metadata service or databases. For example, an attacker can submit a URL containing http://100.100.100.200/latest/meta-data/ to trick an application into fetching and returning sensitive metadata.

  By default, ECS instances allow token-free access (normal mode). Security hardening mode enforces token validation: the client first sends a PUT request for a temporary token, then includes it in GET requests. Because SSRF attacks cannot initiate PUT requests, they cannot obtain a token, effectively blocking unauthorized access.

• I cannot access instance metadata using commands in security hardening mode. How do I fix this?

  Common command errors:

  • The TTL of the instance metadata access credential is out of range (400 - Missing or Invalid Parameters)

    The TTL must be 1 to 21,600 seconds. Values outside this range return 400 - Missing or Invalid Parameters.

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-aliyun-ecs-metadata-token-ttl-seconds: 21700"

  • The request contains the X-Forwarded-For header (403 - Forbidden)

    curl -X PUT "http://100.100.100.200/latest/api/token" -H "X-Forwarded-For: www.ba****.com"

  • The specified instance metadata access credential is invalid (401 - Unauthorized)

    curl -H "X-aliyun-ecs-metadata-token: aaa" -v http://100.100.100.200/latest/meta-data/

• What do I do if my high-frequency access to the metadata service is throttled?

  The metadata service has rate limits. Retrieve rarely-changing items such as instance-id once at startup and cache them locally with a reasonable TTL.

• My application stopped working after I changed the instance metadata access mode to security hardening mode. How do I troubleshoot this issue?

  An application or script on the instance may still use normal mode. Follow Upgrade an existing instance to check and upgrade them.

• Can I access the metadata address from a local host?

  No. 100.100.100.200 is a link-local address reachable only from within an ECS instance over its virtual network interface. Requests from outside the instance cannot be routed to this address.

• What do I do if I cannot select security hardening mode when I create an instance from a custom image?

  When creating an ECS instance from a custom Linux image, you may find that Security Hardening Mode is unavailable. This means the image does not meet the requirements. Upgrade the image as follows:

  1. Create a temporary instance: Use the custom image to create a temporary ECS instance.

  2. Modify the temporary instance: On the temporary instance, perform the following modifications. See Upgrade an existing instance.

     • Upgrade Cloud-init: Upgrade Cloud-init to version 23.2.2 or later.

     • Modify applications and scripts: Update all applications or scripts that use normal mode to security hardening mode.

  3. Create a new image and update its attributes: Create a new custom image from the instance. Then call ModifyImageAttribute to set Features.ImdsSupport to `v2`.

  4. Release resources: Release the temporary instance after the new image is created.

• Which versions of the Credentials tool support security hardening mode?

  Earlier versions of Credentials do not support metadata access in security hardening mode. Switching to security hardening mode without upgrading prevents the SDK from obtaining STS tokens, causing service interruptions.

  Upgrade the Credentials dependency to a supported version before switching modes:

  • Java: credentials-java version >= 0.3.10.

  • Node.js: credentials version >= 2.3.1.

  • PHP: credentials version >= 1.2.0.

  • Python: alibabacloud_credentials version >= 0.3.6.

  • Go: credentials-go version >= 1.3.10.

• How do I detect if an ECS instance is being accessed in normal mode?

  Use the following methods to detect and locate processes that access metadata in normal mode.

  Method 1: Use CloudMonitor to check for normal mode access

  Check ECS metadata monitoring data in the CloudMonitor console to determine whether the instance has been accessed in normal mode.

  1. Log on to the CloudMonitor console.

  2. In the left-side navigation pane, choose Cloud Resource Monitoring > Cloud Service Monitoring. Search for and go to the ECS Metadata monitoring page.

  3. View the Successful Normal Mode Accesses metric for the target instance.

  4. If this metric is not 0, the instance is being accessed in normal mode. Find and upgrade the applications using normal mode.

  Method 2: Use a Cloud Assistant plugin to locate a specific process

  Use a Cloud Assistant plugin to locate processes that access metadata in normal mode.

  Supported operating systems

  Alibaba Cloud Linux 3 Alibaba Cloud Linux 3 Pro Anolis OS 8 CentOS Stream 8/9 CentOS 8

  Ubuntu: 20/24 Debian:10,11,12 Fedora 35+ AlmaLinux 8/9 Rocky Linux 8/9

  Red Hat Enterprise Linux 8/9 For Red Hat, download an RPM package to install Cloud Assistant Agent. SUSE 15.1/15.2/15.3/15.4/15.5/15.6 OpenSuse 15.2/15.3/15.4/15.5/15.6

  Procedure

  1. Install and enable the Cloud Assistant plugin

     Log on to the ECS instance and install the monitoring service. This service consumes some instance resources.

     # Deploy the monitoring service.
     sudo acs-plugin-manager --exec --plugin ACS-ECS-ImdsPacketAnalyzer
     
     # Check the status of the monitoring service.
     sudo systemctl status imds_tracer_tool

     

  2. Locate the problematic process Check which processes still access metadata in normal mode. The log shows the process IDs (PIDs).

     cat /var/log/imds/imds-trace.* | grep WARNING

     

  3. Analyze and modify Find the applications or scripts corresponding to the PIDs and upgrade them to security hardening mode.