# What is the cloud metadata service, and why do attackers want it?

It is a special internal address on every cloud virtual machine from which the machine can read information about itself, including temporary credentials for the permissions assigned to it. Software running on the server uses those credentials to reach storage, databases and other cloud services without a password in its configuration, which is good practice. The risk is that anything able to make the server send a web request to that address can read the credentials too. A common route is server-side request forgery (SSRF): a flaw in a web application that lets an attacker make the server fetch a URL of their choice. With the credentials in hand, the attacker acts in your cloud account with the server's permissions. Defences: require the newer, session-based version of the metadata service where your provider offers one, which blocks simple forged requests; give each server role only the permissions it needs; fix SSRF flaws and validate URLs that applications fetch; and alert on credentials from a server's role being used from outside your environment, which the provider's activity logs can show.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-is-the-cloud-metadata-service-and-why-do-attackers-want-it

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [How do we spot cryptomining in a compromised cloud account?](https://netsenx.com/en/faq/how-to-spot-cryptomining-in-a-compromised-cloud-account)
- [How do we find SaaS apps that nobody approved?](https://netsenx.com/en/faq/how-to-find-saas-apps-nobody-approved)
- [What are CSPM, CASB and SSPM, and do we need them?](https://netsenx.com/en/faq/what-are-cspm-casb-and-sspm)
- [What should we ask a SaaS vendor about security before signing?](https://netsenx.com/en/faq/what-should-we-ask-a-saas-vendor-about-security)
- [Who is responsible when our SaaS provider is breached?](https://netsenx.com/en/faq/who-is-responsible-when-a-saas-provider-is-breached)