Security
Instance metadata service
Quick answer
The instance metadata service is a link-local HTTP endpoint that gives a cloud VM information about itself, including temporary IAM credentials.
Also: IMDS
The instance metadata service is a link-local HTTP endpoint that gives a cloud VM information about itself, including temporary IAM credentials.
Why it matters
IMDSv1 is trivially reachable from a compromised build step; IMDSv2 requires a session token and should be enforced on any runner that executes untrusted code.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
Audit logAn audit log is an append-only record of configuration and access changes, capturing who did what, when, and from where.Data residencyData residency is the requirement that data be stored and processed within a defined geographic boundary.GitHub AppA GitHub App is an integration that authenticates as itself with scoped, short-lived installation tokens rather than as a user.GITHUB_TOKENGITHUB_TOKEN is the automatically generated, short-lived token available to every workflow run for authenticating to the GitHub API.