An Engineer's Notes on Cloud and AI Security

How Capital One was breached: SSRF against IMDSv1

In 2019, a server-side request forgery reached EC2 instance metadata, stole temporary instance-role credentials, and used them to read private objects from S3. IMDSv1 accepted a plain GET; requiring IMDSv2 returns HTTP 401 on the same request.