3

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as:

X-Backend: i-8af67c92e0f3d89b6b
X-Via: i-5b8146e7102940c75b-us-east-2b

Is there any security issue with doing this? Is the instanceId considered sensitive in any way?

Improve this question

2 Answers 2

Reset to default
1

I personally don't feel that EC2 Instance IDs are a security problem. These IDs are only useful within AWS and this requires authentication and authorization.

However, there is another method. Tag your EC2 instances with unique information. Then provide that unique tag instead of the instance ID.

Tagging Your Amazon EC2 Resources

Improve this answer
0

Since instance ID's can be used via AWS API to do modifications to the instance I wouldn't make these publicly known.

If you want to send these back for debugging reason's you best off logging them to a log services like logstash

Improve this answer
1
  • So you're saying the AWS API has a security problem that would allow someone who simply knows a valid instanceId to do operations on that id?
    – gregmac
    Nov 21, 2017 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .