What it means
Cloud instance metadata security protects workload identity and configuration services that can expose temporary credentials or sensitive context to code running on a compute resource.
Why it matters
If an attacker can reach metadata services through a compromised workload or request-forgery path, the workload's cloud permissions may become the next attack step.
Practical focus
- Use the provider's hardened metadata mode
- Restrict unnecessary metadata access
- Limit workload identity permissions
- Detect unusual credential and metadata use
Common mistakes
- Assuming metadata is safe because it is link-local
- Granting broad roles to workloads
- Ignoring proxy and request-forgery paths
- Relying only on network filtering
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: