312-50 Question 449
Single answer▪ Cloud SecurityA company hosts a customer-facing web application on an AWS EC2 instance. During an authorized cloud security assessment, you discover that the application is vulnerable to Server-Side Request Forgery (SSRF). Your goal is to determine whether the EC2 instance is using an overly permissive IAM role without causing service disruption. Which action is the MOST appropriate next step?
- A
From the EC2 instance, attempt to access the AWS Instance Metadata Service and review the temporary credentials associated with the attached IAM role
- B
Run a network port scan against all AWS internal IP ranges to identify other metadata endpoints and enumerate available roles
- C
Exploit the SSRF to terminate and recreate the EC2 instance, then inspect the default permissions assigned during provisioning
- D
Use the SSRF to retrieve the hypervisor configuration files that store long-term AWS root account credentials
Show answer and explanation
Correct answer: A
Explanation
This question tests practical cloud security assessment knowledge in an AWS environment. SSRF is especially significant in cloud-hosted applications because it can sometimes be used to access the Instance Metadata Service and obtain temporary credentials for the EC2 instance profile or IAM role. The most appropriate next step is to attempt controlled access to IMDS and evaluate what permissions those credentials grant. This aligns with real-world cloud pentesting practices and with AWS guidance on securing instance metadata access. Relevant AWS documentation includes the EC2 Instance Metadata Service documentation and IAM role usage for Amazon EC2. Best practice is to use IMDSv2, apply least privilege to IAM roles, and restrict application paths that could reach metadata endpoints. From a CEH perspective, this scenario emphasizes validating exploitable impact safely and accurately rather than using disruptive or speculative techniques.
- A. Correct.
Correct. In AWS, EC2 instances can obtain temporary credentials for an attached IAM role through the Instance Metadata Service (IMDS), commonly reachable at 169.254.169.254. In a controlled assessment, using SSRF to test access to IMDS and then reviewing the permissions of the retrieved temporary credentials is a realistic way to determine whether the instance role is overly permissive. This directly validates the impact of the SSRF finding while minimizing disruption to the target service.
- B. Incorrect.
Incorrect. Broadly scanning AWS internal IP ranges is not an appropriate or reliable way to assess IAM role exposure for a specific EC2 instance. The metadata service is link-local to the instance, not a general internal network service to be discovered across AWS ranges. This option reflects a common misconception that cloud-internal services should be approached like traditional flat-network targets.
- C. Incorrect.
Incorrect. Terminating and recreating the instance is unnecessarily disruptive and goes beyond the stated goal of safely determining whether the attached IAM role is overly permissive. In an ethical hacking engagement, the assessor should use the least disruptive technique that validates risk. The permissions can be assessed by querying role credentials and reviewing the effective access, without affecting availability.
- D. Incorrect.
Incorrect. AWS does not store long-term root account credentials in hypervisor configuration files accessible from an EC2 instance. IAM roles provide temporary security credentials via the metadata service. This distractor is based on an incorrect assumption drawn from traditional infrastructure models rather than AWS's documented identity and credential handling.