When a server-side request forgery (SSRF) bug lands on a cloud workload, the forged request is only the first step. If the vulnerable server can reach its instance metadata service, an attacker who controls that outbound request may be able to retrieve the identity the workload runs as, in the form of a session credential, an access token, or a service-account token. What the attacker can then do depends on that identity’s permissions, not on the SSRF bug alone. Defending against this takes three layers: fix how the server makes outbound requests, control which code can reach metadata, and keep the attached identity small.
How SSRF turns into a cloud credential
SSRF is a server-side request primitive. The attacker does not need direct network access to an internal address. They need the application to make the request on their behalf. The chain has four stages, and not every SSRF bug can complete all of them:
As an Amazon Associate I earn from qualifying purchases.
- Attacker-influenced request. The application accepts a URL, hostname, or other input and makes a server-side request based on it, for example to fetch a remote image, call a webhook, or generate a link preview.
- Reaching an internal destination. URL parsing, redirect handling, DNS resolution, or egress rules must fail to block the destination. Only then can the server be induced to contact the metadata endpoint. On AWS, Azure, and Google Cloud that endpoint is addressed at the link-local IP 169.254.169.254, and Google also publishes the name metadata.google.internal.
- Getting data back out. If the metadata request succeeds, the returned value reaches the attacker through the vulnerable application’s response, an out-of-band channel, or a later action the attacker controls. Which channel exists depends on the specific bug and on how the application behaves, not on the bug’s label.
- Using the credential. The stolen credential is used from outside the workload, and it works only as far as its identity’s permissions and service-side restrictions allow.
OWASP’s SSRF Prevention Cheat Sheet puts the risk directly: “In cloud environments SSRF is often used to access and steal credentials and access tokens from metadata services (e.g.AWS Instance Metadata Service, Azure Instance Metadata Service, GCP metadata server).”
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Public, primary-source statistics on how often SSRF leads to metadata credential theft were not identified, so this article makes no prevalence claim. The risk is established by the mechanism and by provider design, not by an incident count.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What a stolen metadata credential can and cannot do
Metadata access is more than reading descriptive instance data when the workload has an attached identity. Google Cloud documents that processes on a resource with an attached service account can request access tokens and ID tokens for that account. Those tokens are only as powerful as the permissions behind them. Retrieving a credential therefore does not prove that every cloud resource is reachable. Three things bound the impact:
- The identity’s permissions, meaning what its policies allow on each service and resource.
- The scopes and audience the credential was issued for, which limit where it can be presented.
- Service-side restrictions, such as resource policies or conditions, which can deny a request even when the token itself is valid.
How the three major providers differ
The providers differ in how the metadata request is authenticated, whether older request modes remain available, and which host-level controls exist. Do not assume that one provider’s protection applies to the others. The comparison below reflects provider documentation as of October 2026. Defaults and console labels change, so confirm them against each provider’s current documentation before you roll out a change.
| Provider | Request requirement | Older or alternate mode | Which processes can reach it | Identity exposed |
|---|---|---|---|---|
| AWS EC2 | IMDSv2 starts a session with a PUT request; the returned token must accompany later GET requests. | Instance configuration can require IMDSv2, which makes IMDSv1 requests fail. | Any process on the instance can send requests unless host rules restrict it. | Credentials for the role attached to the instance. |
| Azure VM | Requests must include Metadata: true. Requests containing X-Forwarded-For are rejected. |
Not stated in Microsoft’s IMDS documentation as of October 2026. | Applications on the VM can access IMDS, according to Microsoft’s documentation. | The identity assigned to the VM, where one is attached. |
| Google Cloud | Requests go to the metadata server, which expects the Metadata-Flavor: Google header. |
Not stated in the cited Google Cloud guidance. | Not restricted to selected processes or users by default. | Access tokens and ID tokens for the service account attached to the resource. |
The AWS design matters most for SSRF specifically. AWS’s Security Blog states: “IMDSv2’s combination of beginning a session with a PUT request, and then requiring the secret session token in other requests, is always strictly more effective than requiring only a static header.” The practical point is that many SSRF primitives can issue only GET requests or cannot set custom headers. Such a primitive cannot complete the PUT step, and it cannot add the static header that a weaker design would accept. AWS describes IMDSv2 as defense in depth. It does not repair the SSRF bug or make broad instance permissions safe.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Fix the application layer first
Metadata controls reduce what a forged request can reach. They do not remove the forged request, so the application’s outbound behavior is the first place to fix.
Allow only the destinations the feature needs
OWASP recommends an allowlist when the application has a defined set of valid outbound destinations. Apply it to the destination the connection will actually use, not to the string the user supplied. That means checking the scheme, hostname, port, and the IP address the name resolves to. Because a name can resolve to different addresses over time, the address checked and the address connected to should be the same one. Redirects need the same check at every hop. A feature that only ever calls one partner API should have a single allowed host and nothing else.
Why deny-lists fail
OWASP describes deny-lists as a last resort because they are bypass-prone. Blocking the literal string 169.254.169.254 is not a complete defense. The same address can be written in other numeric forms, a hostname can resolve to it, and a permitted URL can redirect to it. A block list that matches only the obvious form leaves those paths open. Treat any single IP block list as one control among several, never as the SSRF fix.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Control which code can reach metadata
Each provider needs different work. The steps below assume you run the workload yourself on the provider’s compute service.
AWS: require IMDSv2 and check existing instances
Require token-based requests on each instance. For an existing instance, run the following command, replacing the example instance ID with your own:
aws ec2 modify-instance-metadata-options --instance-id i-0123456789abcdef0 --http-tokens required --http-endpoint enabledFor new launches, pass --metadata-options HttpTokens=required to aws ec2 run-instances. Then confirm the setting:
aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query 'Reservations[].Instances[].MetadataOptions.HttpTokens'The expected output is a list containing "required". Before enforcing the setting, confirm that every SDK and agent on the instance sends the session token. Code using an old SDK will fail once IMDSv1 is blocked, and AWS recommends keeping SDKs current for this reason.
AWS also documents local firewall rules that limit metadata access by process. On a Linux host, the following rules allow only the process running as user ID 1001 to reach the endpoint:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner 1001 -j ACCEPT
sudo iptables -A OUTPUT -d 169.254.169.254 -j DROPSeveral limits apply. The rule matches the process owner, so anything else running as UID 1001 can still reach metadata. A root process is blocked by the second rule, which can break a root-level agent that needs metadata, so check your agents first. The rules are not persistent across reboots unless you save them with your distribution’s firewall tooling. If workloads reach metadata through a proxy or network appliance, the forwarded path needs its own restriction, and the rule belongs on that component.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Azure: treat the required header as a protocol guard
Azure IMDS requires the Metadata: true header and rejects requests that carry X-Forwarded-For. A request in the expected form looks like this:
curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"The header removes some forwarded-request paths, and it blocks an SSRF primitive that cannot set custom headers. It does not stop code on the VM. Microsoft documents that applications on the VM can access IMDS, so the controls that matter are which code runs on the VM and what the VM’s identity is allowed to do.
Google Cloud: isolate untrusted code and scope the attached identity
By default, Google Cloud does not restrict metadata access to selected processes or users, so any process on the resource can ask for the attached service account’s tokens. Google advises three measures. Sandbox processes that should not query metadata. Avoid running less-protected code on resources that carry privileged service accounts. Limit service-account privileges. In practice, a component that fetches remote URLs or renders untrusted documents belongs on a separate VM or in a sandbox with no privileged account attached, rather than beside the service that holds the broad identity.
Limit the identity so a stolen token is worth less
A metadata credential is useful to the workload by design, so the defensive goal is to constrain what an exposed identity can do.
- Give each workload its own identity instead of sharing a broad project-wide or default identity.
- Grant only the actions and resources the code path uses. Remove roles that were added for convenience and never revoked.
- Keep privileged identities off hosts that run fetch, render, import, or webhook code.
- Re-review the attached identity whenever a feature adds a new server-side request.
Verify the controls
- Outbound features. On systems you operate, send each feature that makes server-side requests a destination of 169.254.169.254, in literal and alternate forms, and in a redirect. Expected result: the request is blocked and no metadata content appears in the response or in any downstream channel.
- AWS. Run the
describe-instancesquery above on every instance. Expected result:"required"for each one. - Azure. Confirm that a request to the metadata endpoint without the
Metadata: trueheader is rejected. - Google Cloud. Confirm which service account each resource carries, and that the set of processes able to request its tokens matches your design.
- Identity. Compare each attached identity’s granted permissions with what its code path actually calls, and remove the difference.
The Bottom Line
An SSRF finding on a cloud host should be rated by the identity it can reach and the processes that can reach metadata, not only by the request bug itself. Fix the outbound request path, but also restrict metadata access to the code that needs it and shrink the attached identity. Those two steps determine how much an attacker gains from the bug.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
