--- title: "Mitigating the Risks of Instance Metadata in AWS EKS" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/mitigating-the-risks-of-instance-metadata-in-aws-eks/" description: "How can you remediate the AWS Instance Metadata vulnerability? The recommended workaround is to deploy Calico Network Policy." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Mitigating the Risks of Instance Metadata in AWS EKS By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on Sep 01, 2020 • 3 min read Compromising a pod in a [Kubernetes](http://kubernetes.io/) cluster can have disastrous consequences on resources in an [AWS Elastic Kubernetes Service (EKS)](http://aws.amazon.com/eks/) account if access to the [Instance Metadata service](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) is not explicitly blocked. The Instance Metadata service is an AWS API listening on a link-local IP address. Only accessible from EC2 instances, it enables the retrieval of metadata that is used to configure or manage an instance. Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. ## AWS Instance Metadata vulnerability A recent blog described a scenario where an attacker compromised a pod in an EKS cluster by exploiting a vulnerability in the web application it was running, thus enabling the attacker to enumerate resources in the cluster and in the associated AWS account. This scenario was simulated by running a pod and attaching to a shell inside it. By querying the Instance Metadata service from the compromised pod, the attacker was able to access the service and retrieve temporary credentials for the identity and access management (IAM) role assigned to the EC2 instances acting as Kubernetes worker nodes. At that point, the attacker was able to pursue multiple exploits, including mapping the network by listing and describing VPCs, subnets, and security groups *exposed across the entire AWS account!* How can you remediate this vulnerability? The recommended workaround is to deploy [Calico Network Policy](http://docs.projectcalico.org/security/calico-network-policy), which will enable you to enforce network policy to deny egress traffic access to the Instance Metadata service. For more details on the AWS Instance Metadata vulnerability as well as the complete workaround, [check out this blog.](http://blog.christophetd.fr/privilege-escalation-in-aws-elastic-kubernetes-service-eks-by-compromising-the-instance-role-of-worker-nodes/) ## Calico for network security For EKS customers, Tigera offers two CNI solutions: [Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/), and [Calico Enterprise](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/calico-commercial-editions/). Calico provides network security for hosted Kubernetes services on Amazon EKS, while Calico Enterprise builds on top of open source Calico to provide additional functionality and capabilities for Kubernetes networks on AWS and Amazon EKS. Calico Enterprise can help you meet security and regulatory requirements with [Zero-Trust Network Security](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/zero-trust/), including least privilege access controls, as well as an [Intrusion Detection System (IDS)](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/zero-trust/) that provides multiple layers of threat defense. Plus, it integrates with your existing AWS tools including [CloudWatch](http://aws.amazon.com/cloudwatch/) and [Security Hub](http://aws.amazon.com/security-hub/?aws-security-hub-blogs.sort-by=item.additionalFields.createdDate&aws-security-hub-blogs.sort-order=desc) so you can leverage existing processes and workflows in your EKS or Kubernetes infrastructure. ————————————————- **[Free Online Training](https://wordpress-1075849-4005834.cloudwaysapps.com/events/)** Access Live and On-Demand Kubernetes Training [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Network Security, Monitoring, and Troubleshooting for Microservices Running on Kubernetes [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/)[Kubernetes Vulnerabilities](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/kubernetes-vulnerabilities/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) [![Why Kubernetes Flat Networks Fail at Scale—and Why Your Cluster Needs a Security Hierarchy](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Why-Kubernetes-Flat-Networks-Fail-at-Scale.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/why-kubernetes-flat-networks-fail-at-scale-and-why-your-cluster-needs-a-security-hierarchy/) #### [Why Kubernetes Flat Networks Fail at Scale—and Why Your Cluster Needs a Security Hierarchy](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/why-kubernetes-flat-networks-fail-at-scale-and-why-your-cluster-needs-a-security-hierarchy/) By [Reza Ramezanpour](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/rezar/) on Jan 28, 2026 Kubernetes networking offers incredible power, but scaling that power often transforms a clean architecture into a tangled web of complexity. Managing traffic flow between hundreds of microservices across dozens of namespaces presents a challenge that... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/why-kubernetes-flat-networks-fail-at-scale-and-why-your-cluster-needs-a-security-hierarchy/)