The specific path /latest/meta-data/iam/security-credentials/[role-name] hosts temporary security credentials (Access Key ID, Secret Access Key, and Token) associated with the IAM role assigned to that EC2 instance.

: If an attacker appends the role name to this URL (e.g., .../security-credentials/admin-role ), the service returns a JSON object containing a Secret Access Key , Access Key ID , and a Token . How the Attack Works

The vulnerable web server accepts the input, decodes it, and makes a backend HTTP request to the metadata IP on behalf of the attacker.

What or logs triggered this alert (e.g., AWS GuardDuty, WAF logs)?