Cloud instance metadata access

cloud_metadata_probe

Requests instance credentials from the link-local metadata service at 169.254.169.254 for AWS, Azure and GCP, including the token-free IMDSv1 path that turns any request-forgery bug into stolen cloud keys. Only whether each endpoint answered is recorded, never any credential.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1552.005	Cloud Instance Metadata API	Credential Access	coverage statistics
T1580	Cloud Infrastructure Discovery	Discovery	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other cloud and identity tests

Other tests in the Cloud and identity category.
Test	What it does	Severity
Container runtime and CI exposure cloud_container_exposure	Checks for a reachable Docker or containerd socket (which is root on the host), a mounted Kubernetes service-account token, container membership, and …	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.