Ravindra BagaleCourses & study guides

4. Amazon EC2: Launch and Connect to Your Linux Server

4.6 First Commands After Login and Instance Metadata

By Last updated:

Login zala ki pahile kahi commands – OS confirm kara, updates ghya, time zone set kara.

cat /etc/os-release                 # confirm distribution
sudo yum update -y                 # AL2023 / CentOS Stream
sudo apt update && sudo apt upgrade -y   # Ubuntu
curl -s http://169.254.169.254/latest/meta-data/ -H "X-aws-ec2-metadata-token: $(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')"
sudo timedatectl set-timezone Asia/Kolkata

Instance metadata (IMDSv2)

169.254.169.254 is a special address inside every instance that returns its metadata — instance ID, public IP, AZ, IAM role credentials. New instances require IMDSv2 (token-based), which is why the command above first requests a token. Example: append public-ipv4 or placement/availability-zone to the URL.

Why this matters for security

The metadata service at 169.254.169.254 can return temporary IAM role credentials. In an SSRF attack (Part 11), a vulnerable web app is tricked into fetching this URL for the attacker. IMDSv2 (session tokens) makes this much harder – keep it set to required on every instance.

Ravindra Bagale's Tip

Many students copy the old IMDSv1 curl command from the internet and get confused when they see "401". New instances need a token – use the IMDSv2 command above. And never make IMDSv2 "optional" – it's there for security.

Practice task

Using IMDSv2, print your instance ID, public IPv4 and availability zone (append instance-id, public-ipv4 and placement/availability-zone).