Metabadger: Automating IMDS Protection at Scale in AWS
summary
An open source tool called Metabadger automates discovery by parsing CloudTrail and EC2 APIs, then upgrades or enforces IMDSv2 across accounts and regions with a single command (or targeted by tags/instance IDs), includes dry‑run and rollback, can disable metadata where unused, and emits coverage metrics; it handles pagination and scale (tested on 80,000+ instances), logs changes, and integrates with IAM and config rules so upgrades succeed without mass downtime.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:16What is Metadata
- 6:37V2 Attack Chain
- 9:52Why should we use it
- 13:00Tooling
- 16:26Discovery
- 20:32Metabadger
- 23:33Problem Statement
- 25:35Metabadger Overview
- 27:54Future Architecture Goals
- 30:13Demo
related talks
44mCloud Metadata Abuse
11mPatterns to securely manage your AWS services with Meta
37mOptimizing Cloud Detection & Response With Security Chaos Engineering
01h 00mVulnerability management at scale drives enterprise transformation
49mCloud operations: A catalyst for innovation
19mSecuring your AWS environment with automated DSPM
22mAutomating the CIS Foundations Benchmark for AWS with Terraform
48mDevSecOps: Spin Up Cloud Security, Discover, Classify and Protect Sensitive Data