CyberGuard dictionary / Cloud Security
Cloud Metadata Service
A cloud metadata service provides a running instance with information about itself and, in some platforms, temporary credentials for its assigned identity.
In simple terms
Applications on a virtual machine may query local metadata for instance details. Access to that endpoint must be considered when processing untrusted URLs.
Technical explanation
If an application can be tricked into requesting internal addresses, metadata access may expose role credentials. Platform protections such as AWS IMDSv2 add a session token requirement, but application-side SSRF defenses remain necessary.
Metadata endpoints provide instance configuration and sometimes temporary credentials to cloud workloads. Applications that fetch user-selected URLs must not be allowed to reach such internal endpoints.
Examples in practice
A vulnerable URL preview service fetches an internal metadata address and returns instance identity data to an external requester.
An image importer receives a URL pointing at the instance metadata address. The application rejects internal destinations and redirects, preventing the request from exposing workload credentials.
Why it matters
Metadata controls protect a valuable boundary between application input and cloud credentials.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.