Instance metadata and user data in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What data can an EC2 instance retrieve from its metadata service?

An EC2 instance can query its instance metadata service to get information about itself. Which of the following types of data can it retrieve?

A The instance's public IP address, instance ID, and security groups attached

B The contents of all S3 buckets in the AWS account

C The private keys of the AWS account root user

D The billing details of the AWS account

💡 Hint

Think about what information is specific to the instance itself and what would be sensitive or unrelated.

The instance metadata service provides information about the instance such as its ID, IP addresses, and security groups. It does not provide access to account-wide sensitive data like root keys or billing info.

❓ Configuration

intermediate

What is the correct way to pass user data to an EC2 instance during launch?

You want to run a script automatically when your EC2 instance starts. How should you provide this script using user data?

A Attach the script as a file to the instance's EBS volume after launch

B Include the script as plain text in the user data field when launching the instance

C Upload the script to an S3 bucket and provide the S3 URL in user data

D Send the script via SSH after the instance is running

💡 Hint

User data is designed to run commands or scripts at instance boot time.

User data is passed as plain text or base64-encoded text during instance launch. The instance reads and executes it on first boot. Uploading to S3 or attaching files after launch is not how user data works.

❓ security

advanced

What security risk is associated with instance metadata service (IMDS) version 1?

IMDSv1 allows EC2 instances to access metadata via HTTP requests. What is a known security risk of using IMDSv1 compared to IMDSv2?

A IMDSv1 is vulnerable to SSRF attacks that can expose sensitive metadata

B IMDSv1 encrypts metadata with weak algorithms

C IMDSv1 disables instance role permissions by default

D IMDSv1 requires manual credential rotation

💡 Hint

Consider how metadata is accessed and what an attacker might exploit.

IMDSv1 uses simple HTTP GET requests without session tokens, making it vulnerable to Server-Side Request Forgery (SSRF) attacks. IMDSv2 adds session tokens to mitigate this risk.

❓ Architecture

advanced

How can you securely provide secrets to an EC2 instance without exposing them in user data?

You want your EC2 instance to access database credentials securely without embedding them in user data. Which approach is best?

A Hardcode the credentials in the instance AMI

B Store the credentials in user data encrypted with base64

C Assign an IAM role to the instance with permissions to access AWS Secrets Manager

D Send the credentials via email to the instance owner

💡 Hint

Think about AWS services designed for secret management and secure access.

Assigning an IAM role to the instance allows it to securely retrieve secrets from AWS Secrets Manager without exposing them in user data or AMIs. Base64 encoding is not encryption and is insecure.

✅ Best Practice

expert

What is the recommended way to enforce use of IMDSv2 on EC2 instances to improve security?

You want to ensure all EC2 instances in your environment use IMDSv2 only, disabling IMDSv1. How can you enforce this?

A Disable the EC2 instance's network interface

B Block all HTTP traffic to 169.254.169.254 from the instance

C Remove the instance profile attached to the instance

D Configure the instance metadata options to require IMDSv2 and disable IMDSv1 during instance launch or via API

💡 Hint

Look for instance metadata options that control IMDS versions.

EC2 allows configuring metadata options to require IMDSv2 and disable IMDSv1. This is the recommended best practice to protect against SSRF and other attacks.