312-50 Question 448
Single answer▪ Cloud SecurityA company hosts a customer portal on an AWS EC2 instance. During a sanctioned cloud security assessment, you discover that the application allows server-side request forgery (SSRF). The EC2 instance uses an IAM role to access other AWS services. The client wants to understand the most immediate risk created by this SSRF issue in their cloud environment. Which action would an attacker most likely attempt next to escalate access?
- A
Query the EC2 Instance Metadata Service (IMDS) to obtain temporary credentials for the attached IAM role
- B
Exploit AWS Security Groups directly to extract the private SSH key from the hypervisor
- C
Use the SSRF flaw to decrypt AWS KMS customer-managed keys without any IAM permissions
- D
Trigger automatic cross-region replication to copy all EBS snapshots into the attacker's AWS account
Show answer and explanation
Correct answer: A
Explanation
This question tests practical cloud attack-path reasoning rather than simple recall. In AWS, SSRF on an EC2-hosted application is particularly dangerous when the instance has an attached IAM role. Attackers commonly attempt to access the EC2 Instance Metadata Service at 169.254.169.254 to obtain temporary role credentials, which can then be used against AWS APIs within the role's scope. This is a recognized cloud exploitation technique and aligns with AWS guidance on securing IMDS, especially by requiring IMDSv2 and limiting application behaviors that permit arbitrary outbound requests. Relevant AWS documentation includes guidance on the EC2 Instance Metadata Service, IAM roles for Amazon EC2, and AWS best practices for mitigating SSRF risks through IMDSv2, least privilege, and application-layer request validation.
- A. Correct.
Correct. In AWS, an EC2 instance can retrieve temporary security credentials for its attached IAM role through the Instance Metadata Service, historically available at 169.254.169.254. If an application is vulnerable to SSRF, an attacker may be able to force the server to send requests to IMDS and retrieve role credentials, depending on controls such as IMDSv2 enforcement and request handling. Those temporary credentials can then be used to access AWS resources allowed by the role, making this a well-known and practical post-exploitation path in cloud environments.
- B. Incorrect.
Incorrect. Security Groups are virtual firewall controls that filter network traffic to instances; they do not provide a mechanism to extract private SSH keys from the hypervisor. This option reflects a misunderstanding of the shared responsibility model and AWS isolation boundaries. Even if Security Groups are misconfigured, that would not let an attacker directly access the underlying hypervisor or retrieve instance secrets in this manner.
- C. Incorrect.
Incorrect. AWS KMS does not allow arbitrary decryption of customer-managed keys merely because an SSRF exists. Decrypt operations require appropriate IAM permissions and access to ciphertext generated under the relevant key policy and permissions model. SSRF alone does not bypass KMS authorization. A candidate might choose this option if they confuse application-layer access with cloud control-plane privilege escalation.
- D. Incorrect.
Incorrect. EBS snapshot sharing and cross-account copying are controlled operations that require valid AWS permissions. SSRF does not automatically trigger replication or copy snapshots to an attacker's account. While compromised IAM credentials obtained through SSRF could potentially be abused for snapshot-related actions if permissions allowed, the direct and immediate next step would be credential theft via IMDS rather than automatic snapshot exfiltration.