Instance metadata

Instance metadata list

The metadata service allows you to obtain information such as hostname, instance type, instance name, and image ID. Expand the following table to view all metadata items.

{
  "AccessKeyId" : "****",
  "AccessKeySecret" : "****",
  "Expiration" : "2024-11-08T09:44:50Z",
  "SecurityToken" : "****",
  "LastUpdated" : "2024-11-08T03:44:50Z",
  "Code" : "Success"
}

Configure the security hardening mode as the only mode to access instance metadata

To enhance security, Alibaba Cloud allows you to configure the security hardening mode as the only mode to access instance metadata. After you configure this setting, requests that use the NAT mode to access instance metadata are rejected. This helps you defend against most SSRF-related risks that may arise from the NAT mode. The following sections describe how to configure this setting in different scenarios.

Configure the security hardening mode as the only mode when you create an ECS instance

Configure the security hardening mode as the only mode for an existing instance

For ECS instances on which business is already deployed, configuring the security hardening mode as the only mode causes requests that use the NAT mode to access metadata to be rejected. We recommend that you modify your application code to use the security hardening mode, make sure that the ECS instance does not use the NAT mode, and then configure the security hardening mode as the only mode for the instance.

Step 1: Modify your application code to use the security hardening mode

1. Identify the instances for which you need to modify the code to use the security hardening mode.

   • Method 1: On the CloudMonitor console Cloud Resources > > Cloud Service Monitoring page, search for ECS Metadata. Identify the ECS instances for which the Monitoring Chart shows that Number Of Successful NAT Mode Accesses is greater than 0. This indicates that applications on these instances use the NAT mode to access the metadata service. These instances need to be switched to the security hardening mode. To ensure data accuracy, we recommend that you set the time range to 14 days or longer.

   • Method 2: Use the ACS-ECS-ImdsPacketAnalyzer tool to identify the processes on an instance that use the NAT mode to access instance metadata.

     This tool is available only for Linux operating systems because the Cloud Assistant Agent is preinstalled on Linux instances when the instances are created. The Cloud Assistant Agent provides the ACS-ECS-ImdsPacketAnalyzer plug-in by default. However, operating system restrictions apply.

     Operating systems supported by the ACS-ECS-ImdsPacketAnalyzer tool and how to use the tool

     Deploying the ACS-ECS-ImdsPacketAnalyzer plug-in on an instance may affect the performance of the instance.

     The ACS-ECS-ImdsPacketAnalyzer plug-in supports the following operating systems:

     • Alibaba Cloud Linux 3

     • Anolis OS 8

     • CentOS Stream 8/9

     • CentOS 8

     • Ubuntu: 20/24

     • Debian:10,11,12

     • Fedora 35+

     • AlmaLinux 8/9

     • Rocky Linux 8/9

     • Red Hat Enterprise Linux 8/9

     • For Red Hat, you must download and install the RPM package of the Cloud Assistant Agent. For more information, see Install the Cloud Assistant Agent.

     • SUSE 15.1/15.2/15.3/15.4/15.5/15.6

     • OpenSuse 15.2/15.3/15.4/15.5/15.6

     Procedure:

     1. Connect to the ECS instance. For more information, see Overview of connection methods.

     2. Run the following command to check whether the Cloud Assistant Agent is installed on the instance and whether the ACS-ECS-ImdsPacketAnalyzer plug-in is provided:

        sudo acs-plugin-manager --list

        

     3. Run the following command to deploy the imds_tracer_tool service:

        sudo acs-plugin-manager --exec --plugin ACS-ECS-ImdsPacketAnalyzer

        A command output similar to the following one indicates that the NVMe module is configured:

        

     4. View the deployment status of the imds_tracer_tool service.

        sudo systemctl status imds_tracer_tool

        

     5. Run the following command to output all applications that use the NAT mode to access instance metadata to the terminal:

        cat /var/log/imds/imds-trace.* | grep WARNING

        

2. Make sure that the cloud-init version on the identified instances is 23.2.2 or later. If the version of cloud-init on an existing ECS instance is not 23.2.2, you can upgrade cloud-init to version 23.2.2 to use the security hardening mode. For information about how to check and upgrade the cloud-init version, see Install cloud-init.

3. Modify your application code to first obtain metadata server access credentials and then include the credentials in the request header to obtain metadata. For more information, see Access instance metadata in security hardening mode.

4. Make sure that your code does not use the NAT mode.

   On the CloudMonitor console ECS Metadata page, check whether Monitoring Chart shows Number Of Successful NAT Mode Accesses as No Data (which indicates that the number is 0) for the ECS instances for which you want to switch the access mode. If yes, you can proceed to Step 2. Otherwise, configuring the security hardening mode as the only mode may cause NAT mode accesses to be rejected, which may affect your business. To ensure data accuracy, we recommend that you set the time range to 14 days or longer.

Step 2: Configure the security hardening mode as the only mode for the instance

To prevent impacts on your business that may be caused by NAT mode access failures after you configure the security hardening mode as the only mode, you can configure alerts in the CloudMonitor console to notify you when NAT mode accesses are rejected. If NAT mode accesses are rejected after you configure the security hardening mode as the only mode, you must first switch the instance back to support both the NAT mode and the security hardening mode, make sure that the ECS instance does not use the NAT mode, and then reconfigure the security hardening mode as the only mode.

FAQ