aquasecurity / aquasecurity/cloudsploit

Support for IMDS

Open
#533 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

To avoid managing or storing access/secret keys, please add support for IMDSv1 and v2. This would avoid something like this to get IMDSv2 to work properly with CloudSploit:

```
TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && CREDS=$(curl -sH "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/MY-AWESOME_ROLE) && AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.AccessKeyId') AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.SecretAccessKey') AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.Token') ./index.js
```

Contributor guide

Open the contributing guide

Research direction

Start at the ./index.js entry point and trace how CloudSploit currently receives AWS credentials. Compare the requested IMDSv1 and IMDSv2 flows in the issue, including token retrieval and role credentials. Done means the tool can obtain credentials from instance metadata without manually managing access or secret keys.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.