EC2

Abusable AWS EC2 permissions that can lead to compromise or privilege escalation

ssm:SendCommand

---

IMDS

• If an EC2 is running IMDSv1 or v2, there may be an IAM Role attached to it and we can retrieve the role's credentials through this service

• We need code execution on the instance (e.g., via SSH, SSM, EC2 Connect) or