Curl-url-http-3a-2f-2f169.254.169.254-2flatest-2fapi-2ftoken — [hot]

TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

For scripts that run periodically (e.g., cron jobs, systemd timers), you have two choices:

The keyword curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken is a URL‑encoded representation of a common AWS metadata service command:

The metadata service provides information about the instance, such as its ID, type, and IP address. Importantly, it can provide temporary security credentials, which are crucial for securely accessing AWS resources without needing to hard-code long-term access keys. curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken

Now you can request any metadata endpoint by adding the header:

get_cached_token() local now=$(date +%s) if [ $now -ge $TOKEN_EXPIRY ]; then TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 3600") TOKEN_EXPIRY=$((now + 3600 - 60)) # refresh 1 minute early fi echo "$TOKEN"

169.254.169.254 is a link-local IP address designed specifically for cloud environments (AWS, Azure, GCP). It is only accessible from within the running instance itself. It cannot be routed over the internet or accessed by other instances. It acts as a local repository for instance-specific data like: Instance ID IAM Security Credentials Network interfaces Security groups TOKEN=$(curl -X PUT "http://169

curl -X PUT "http://169.254.169.254/latest/api/token" -H "Content-Type: application/json"

→ Returns a 6-hour session token.

Once the token is securely stored in your shell variable $TOKEN , you can proceed to retrieve any metadata. You must pass the token in a custom header called X-aws-ec2-metadata-token . It is only accessible from within the running

It provides information about the instance, such as its IAM role credentials, security groups, instance ID, AMI ID, and network configuration.

"Version": "2012-10-17", "Statement": [ "Sid": "RequireImdsv2", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": "StringNotEquals": "ec2:MetadataHttpTokens": "required" ] Use code with caution. Summary of Best Practices

Any virtual machine running within AWS can query this IP address to discover information about itself without making an external internet request. The metadata available includes: IAM roles and temporary security credentials Instance ID, hostname, and security groups Network interface configurations User data scripts executed at launch The Evolution: IMDSv1 vs. IMDSv2