imds.conf

# imds-filterd sample configuration file
# ======================================

# Lines starting with '#' are comments which are ignored.

# Blank lines are also ignored.

# Directives are of the form
# (Allow|Deny) [user name|group name] "/path/to/stuff"
# and the last matching rule applies.  If no rule matches, access is denied.

# The path string must be quoted, and is a prefix; e.g. "/path/to/stuff"
# matches a request for "/path/to/stuff/which/I/need" but not a request
# for "/evil/path/to/stuff".  A wildcard "*" matches any single path segment,
# e.g. "/*/foo" matches "/bar/foo" but does not match "/bar/baz/foo", and may
# not match a partial segment, i.e. "/a*" is a syntax error.

# Start by allowing access to anything
Allow "/"

# Deny access to IAM Roles and Amazon's mysterious "internal use only"
# credentials.
Deny "/*/meta-data/iam/security-credentials/"
Deny "/*/meta-data/identity-credentials/ec2/security-credentials/"

# Root gets to access everything anyway.
Allow user root "/"

# Examples
# ========

# Give a daemon access to an IAM Role:
# Allow user mydaemon "/*/iam/security-credentials/myrole"

# Give the "wheel" group access to everything:
# Allow group wheel "/"

# Blocking all access to the IMDS from a web proxy:
# Deny user www "/"