I am running a Windows instance on AWS.
The instance has an IIS service running on it.
The IIS service has a user associated to it and it has no need to access the AWS instance metadata.
I was reading up on https://aws.amazon.com/answers/security/aws-securing-windows-instances/
Centrally manage Windows Firewall settings with Group Policy Objects (GPO) to further enhance network controls. Customers often use the Windows Firewall for further visibility into network traffic and to complement security group filters, creating advanced rules to block specific applications from accessing the network or to filter traffic from a subset IP addresses. For example, the Windows Firewall can limit access to the EC2 metadata service IP address to specific whitelisted users or applications. Alternatively, a public-facing service might use security groups to restrict traffic to specific ports and the Windows Firewall to maintain a blacklist of explicitly blocked IP addresses.
The part in Bold got me curious in scenario where SSRF is used.
- Can you restrict access to the AWS metadata just for the IIS service or the service user without impacting the service availability?
- How would the configuration look like?