Cloud instance metadata and workload identity

Mechanism

Instance metadata can expose configuration and temporary credentials to software running on a workload. The endpoint and protection model differ by provider. In AWS, IMDSv2 uses a session token and configurable response hop behavior. Access to metadata through an application fetch primitive is distinct from direct access inside the instance.

Practical method

Identify provider, endpoint, and metadata version from challenge evidence. Determine which HTTP methods and headers the fetch path supports. Use nonsecret metadata fields first. If credentials are in scope, establish their principal and permissions without printing their secret values into logs.

application fetch capability -> metadata protocol -> temporary identity
                               method/header support is a prerequisite

Interpreting evidence

A returned instance identifier demonstrates metadata reachability, not credential retrieval. Credential availability depends on an attached identity, protocol support, and access policy.

Pitfalls and limits

Different cloud endpoints are not interchangeable. Metadata tokens are not AWS API credentials. Temporary credentials expire and may have conditions tied to the workload context.