jperezduerto.info
Security in depth · Unit 25 · Lesson 9 of 12
Metadata can be an identity dependency
Review whether two processes on one cloud instance should share its attached identity.
Helpful before thisCloud identity
After this lesson you can
- Distinguish metadata transport protection from authorization of individual applications.
A platform identity belongs inside an explicit application boundary.
Know what the mechanism provides
An instance metadata service exposes information associated with a running cloud instance. On Amazon EC2, metadata can also supply temporary credentials for its attached IAM role. Not every metadata value is a credential, and not every platform uses the same mechanism.
IMDSv2 requires a session token for metadata requests. That protection does not itself assign distinct business identities to individual applications sharing the instance.
The shared worker
M1: The instance requires IMDSv2 and has the InvoiceReader role attached.
M2: The supplied process review confirms that Invoice and Thumbnail can both obtain that role’s credentials through the supported runtime mechanism.
M3: The owner approves invoice reads only for Invoice. Thumbnail needs public image processing and no cloud data permission.
Assume M2 describes the effective configuration and no additional restriction separates those processes. The identity boundary does not match the intended duties. This is evidence of credential availability to both components, not proof that Thumbnail read an invoice.
A defensible proposal separates the workloads into supported identity boundaries, keeping Invoice’s narrow access and leaving Thumbnail without invoice authority. Identify the owner, expected application dependencies, and an acceptance record showing that Invoice still works while Thumbnail cannot obtain or use Invoice’s identity.
Disabling metadata for the existing shared worker without considering Invoice could break its credential renewal. Keeping the worker unchanged merely because IMDSv2 is required leaves M2 unexplained. Compare these consequences in your written proposal.
Finally, keep metadata access and resource permission as separate checks: obtaining a role’s credentials does not remove the policies applied when a resource request is evaluated.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which conclusion is supported by the supplied process review?
Show the answer
Correct answer: Identity separation remains unresolved because both processes can obtain the attached role’s credentials. M2 confirms access for both, while M3 approves only Invoice. Requiring IMDSv2 does not by itself distinguish the business purpose of those local processes.
Try it
- WriteWrite a boundary proposal for M1-M3. Name the process that needs the identity, the process that does not, and positive/negative acceptance evidence. Explain what requiring IMDSv2 does not establish by itself.