title: SSRF AWS Instance Metadata Endpoint Access
id: ATR-2026-01605
rule_version: 1
status: experimental
description: |
  Detects SSRF (Server-Side Request Forgery) attempts targeting the AWS EC2
  Instance Metadata Service (IMDS) at 169.254.169.254. When an agent's
  HTTP-fetch tool is redirected to this address, the agent retrieves IAM
  security credentials, instance identity documents, and other sensitive
  cloud configuration data accessible only from within the instance. This
  is the most impactful SSRF target in cloud-hosted agent deployments.
  Also detects the AWS IMDSv2 token endpoint at the same address.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI03:2026
    - ASI02:2026
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0049 - Exploit Public-Facing Application
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1552.005 - Cloud Instance Metadata API
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: AWS IMDS SSRF leads to exfiltration of IAM credentials that grant cloud-wide access.
      strength: primary
  owasp_agentic:
    - id: ASI03:2026
      context: IMDS access bypasses cloud IAM boundaries, granting the attacker the instance's full IAM role.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of SSRF to cloud metadata endpoints supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 requires robustness against adversarial inputs; SSRF to cloud metadata is a high-severity adversarial vector.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must detect and block agent tool inputs targeting the cloud instance metadata endpoint (169.254.169.254), the canonical SSRF vector for harvesting IAM credentials.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting IMDS-targeted SSRF that exfiltrates cloud role credentials is such a treatment.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: ssrf
  scan_target: tool_args
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)169\.254\.169\.254(?::\d+)?/
      description: AWS IMDS address as an HTTP fetch target (IP + path)
    - field: user_input
      operator: regex
      value: (?i)169\.254\.169\.254(?::\d+)?/
      description: AWS IMDS fetch target in user input (IP + path)
    - field: tool_args
      operator: regex
      value: (?i)169\.254\.169\.254[^\s"']{0,20}/latest/(meta-data|dynamic|user-data|api/token)
      description: AWS IMDS canonical metadata path
    - field: user_input
      operator: regex
      value: (?i)169\.254\.169\.254[^\s"']{0,20}/latest/(meta-data|dynamic|user-data|api/token)
      description: AWS IMDS canonical metadata path in user input
  condition: any
  false_positives:
    - Security scanning agents explicitly authorized to test IMDS exposure
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-01605] SSRF to AWS instance metadata service detected.
    Request to 169.254.169.254 intercepted. Tool call blocked.
confidence: 97