Cheat notes · Module 02 · Runtime and cloud
Cloud metadata and OIDC
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Follow a request-forgery path to a mock metadata endpoint and test CI trust. S08 is covered and S08a records a dated public HTTPS exception.
Remember
- Surface: IMDSv2 requires a session token before metadata credentials are returned.
- Trust: A GitHub OIDC subject identifies the repository, event or environment.
- Evidence: The local mock returns sample values that open no cloud account.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
IMDSv2 requires a session token before metadata credentials are returned.
What do you test?
Use the local metadata mock and fake role credentials, close the path with an application host allowlist, IMDSv2 and network policy, then narrow OIDC trust to a production environment.
What evidence proves the fix?
S08 is covered and S08a records a dated public HTTPS exception.
Where module 02 leaves you: S08 is covered and S08a records a dated public HTTPS exception.