What is EC2 instance metadata?
EC2 instance metadata is data about a running EC2 instance that is accessible from within the instance itself via a special link-local HTTP endpoint at 169.254.169.254. It provides information such as the instance ID, AMI ID, public IP, IAM role credentials, availability zone, and more.
Instance metadata is a powerful built-in AWS feature that allows applications running inside an EC2 instance to discover information about themselves and their environment without any external API calls or hardcoded configuration. It is served by a special link-local address (169.254.169.254) that is only accessible from within the instance — not from the internet.
- 1
instance-id — The unique identifier of the instance (e.g., i-0123456789abcdef0)
- 2
instance-type — The type of the instance (e.g., t3.micro, m5.large)
- 3
ami-id — The ID of the AMI used to launch the instance
- 4
public-ipv4 — The public IPv4 address of the instance
- 5
local-ipv4 — The private IPv4 address within the VPC
- 6
public-hostname — The public DNS hostname
- 7
placement/availability-zone — The AZ where the instance is running (e.g., us-east-1a)
- 8
iam/security-credentials/ — Temporary IAM role credentials (Access Key, Secret Key, Session Token)
- 9
security-groups — The names of the security groups attached to the instance
- 10
hostname — The private hostname of the instance
- 11
mac — The MAC address of the network interface
- 12
user-data — The User Data script that was passed at launch
- 1
IMDSv1 — Simple GET request, no token required. Vulnerable to SSRF (Server-Side Request Forgery) attacks where a malicious application could steal IAM credentials.
- 2
IMDSv2 — Requires a PUT request to obtain a session token first. Protects against SSRF because the PUT method cannot be made by a simple redirect. AWS strongly recommends enforcing IMDSv2 on all instances.
- 3
Enforcing IMDSv2 — Set HttpTokens to required when launching: aws ec2 run-instances --metadata-options HttpTokens=required