Enabled by default, and it should be

IMDSv2 enforcement

Why instance metadata service v2 is enforced on BYOC runners and what breaks if it is not.

The instance metadata service hands out temporary IAM credentials to anything that can reach it. On IMDSv1 that is a single unauthenticated HTTP GET — trivially reachable from a compromised build step or a server-side request forgery in a test fixture.

IMDSv2 requires a session token obtained with a PUT, which defeats the common attack shapes. It is enforced by default on BYOC runners and we would push back on turning it off.

bash

# IMDSv2: token first, then the request
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

Your next build could be twice as fast, at half the price

Start free. Migrating away is the same one line, and we publish that diff too.

Start building See pricing

Instance profiles for BYOC runnersCredentials without stored secrets BYOC security checklistWhat to verify before you go organisation-wide

IMDSv2 enforcement

Your next build could be twice as fast, at half the price

Related