Metadata Service Attacks

Software developers normally use hard-coded credentials to access different services, to reduce the exposure of these credentials, cloud providers like AWS have introduced metadata services. When an app needs access to specific assets, it can query the metadata service to get temporary credentials which can be used to access services like AWS buckets and other resources.

If an attacker is able to access these resources, they will be able to get a set of credentials to interface with the API. Sensitive information can also be held in startup scripts which can be accessed via startup scripts.