Question

A security engineer is reviewing a fleet of EC2 instances that run a web application behind an Application Load Balancer. A recent penetration test found that the application is vulnerable to server-side request forgery (SSRF), and the tester was able to retrieve temporary IAM role credentials from the instance metadata service. The engineer must harden the instances to prevent this specific class of credential theft without redeploying the application. Which action most directly mitigates the risk?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) with a session token requirement and set the metadata hop limit to 1 on the instances.

Answer

Attach a more restrictive IAM policy to the instance role so that the exposed credentials have no usable permissions.

Answer

Add a security group rule that blocks outbound traffic to 169.254.169.254 from the instances.

Answer

Enable termination protection and rotate the instance profile credentials every hour with a scheduled Lambda function.