Homepage
About Snyk

SageMaker Notebook instance accepts IMDSv1 Affecting Sagemaker service in AWS

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    IAM / Authentication

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-AWS
  • Snyk ID SNYK-CC-00782
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing IMDSv2 on SageMaker Notebook instances mitigates the risk of unauthorized retrieval of instance metadata, which could lead to credential exposure and privilege escalation. IMDSv1 does not require session-oriented requests, making it more susceptible to SSRF attacks.

How to fix?

Set the instance_metadata_service_configuration.minimum_instance_metadata_service_version attribute in aws_sagemaker_notebook_instance resource to 2.

Example Configuration

resource "aws_sagemaker_notebook_instance" "allow1" {
  name          = "rule-782-ni"
  role_arn      = aws_iam_role.rule-782-role.arn
  instance_type = "ml.t2.medium"
  instance_metadata_service_configuration {
    minimum_instance_metadata_service_version = 2
  }
}