ECS ON EC2: COVERING GAPS IN IMDS HARDENING

Summary from the TLDR InfoSec newsletter

When launching AWS ECS tasks on EC2 instances, each task, by default, has access to the Instance Metadata Service (IMDS), which can be used to access credentials of other tasks or to escalate privileges to the instance role. Using IMDSv2 with a hop limit of 1 is not effective for stopping this attack vector, as some networking modes can still access IMDS. The article includes details for blocking IMDS access in each networking mode.