Definition. AWS's Instance Metadata Service provides an EC2 instance with metadata at 169.254.169.254, including temporary credentials for its IAM role. IMDSv2 requires a session token for this, requested via PUT. By default, the response to that request has a hop limit of 1.

Why it matters. Anyone running code on an instance can take over its role via IMDS. On Kubernetes nodes this applies to every pod that can reach IMDS. The EKS best practices therefore recommend enforcing IMDSv2 and setting the hop limit to 1 for pods that do not need the node role.

Example. After the LiteLLM incident in October 2026, Wiz observed attackers using harvested instance roles from CI runners and Kubernetes nodes.

Related. Kubernetes Worker Node, NetworkPolicy, Supply chain attack