312-50 Question 447
Single answer▪ Cloud SecurityA company hosts a customer-facing web application on AWS using EC2 instances behind an Application Load Balancer. During an authorized security assessment, you discover that one EC2 instance has an IAM role attached that allows broad access to S3 buckets. The application also accepts user-supplied URLs and fetches them server-side to generate previews. You suspect an SSRF vulnerability could be used to obtain temporary AWS credentials from the instance metadata service. Which action would MOST effectively reduce the risk of credential theft through this attack path while preserving the application's functionality?
- A
Disable the EC2 instance's public IP address so the metadata service cannot be reached from the Internet
- B
Require the use of IMDSv2 on the EC2 instances and restrict the IAM role to the minimum permissions required
- C
Move the application behind a Network ACL that blocks outbound traffic to all RFC 1918 address ranges
- D
Encrypt the S3 buckets with AWS KMS so any stolen credentials cannot be used to access bucket contents
Show answer and explanation
Correct answer: B
Explanation
This scenario combines two common cloud security issues: SSRF in a web application and excessive IAM permissions on an EC2 instance role. In AWS, applications running on EC2 can obtain temporary credentials from the Instance Metadata Service at 169.254.169.254. Historically, SSRF vulnerabilities have been used to access IMDS and steal role credentials. AWS recommends using IMDSv2, which adds session authentication and helps mitigate many SSRF exploitation paths, and also recommends applying the principle of least privilege to IAM roles. Together, these controls both reduce exploitability and limit impact. Relevant guidance appears in AWS documentation for EC2 Instance Metadata Service (IMDSv2) and IAM best practices, including least-privilege access and minimizing permissions for instance profiles.
- A. Incorrect.
Incorrect. The EC2 instance metadata service is accessed locally from the instance at 169.254.169.254, not through the instance's public IP. Disabling the public IP does not prevent a server-side request forgery from causing the application to query the metadata endpoint. This option reflects a common misconception that metadata exposure depends on Internet reachability rather than local instance access.
- B. Correct.
Correct. Requiring IMDSv2 significantly reduces the risk of straightforward SSRF-based credential theft because IMDSv2 uses session-oriented requests that require a PUT to obtain a token before metadata can be accessed, making many simple SSRF primitives ineffective. Limiting the IAM role to least privilege also reduces the impact if credentials are obtained. This is the most effective control here because it directly addresses the attack path and minimizes blast radius while allowing the application to continue operating.
- C. Incorrect.
Incorrect. Blocking RFC 1918 ranges would not address access to the AWS metadata service because the metadata endpoint uses the link-local address 169.254.169.254, which is not part of RFC 1918 private space. In addition, aggressive outbound filtering could break legitimate application behavior if the app needs to fetch external content. This distractor is plausible because it resembles egress filtering, but it targets the wrong address space.
- D. Incorrect.
Incorrect. Encrypting S3 buckets with KMS protects data at rest, but AWS credentials with appropriate permissions can still request decryption and access objects through AWS APIs if the IAM role permits it. KMS encryption does not neutralize stolen temporary credentials by itself. This option confuses storage encryption with identity-based access control.