How is CloudFormation metadata access controlled?

Question

As I understand it, an instance needs to be granted access to cloudformation:* resources in order to do anything with CloudFormation.

But when I run this on a Beanstalk web server instance:

cfn-get-metadata -s awseb-e-xxxxxxxxx-stack -r AWSEBAutoScalingGroup

I get a full metadata dump, no problem.

1. I don't specify any access/secret keys in the command line.
2. My instance role was manually created (by me) and definitely does NOT grant any permissions on cloudformation:* resources.

How come I can still read any CF metadata?

I noticed that in the client code, the script goes to use instance credentials (self.using_instance_identity is True)

signer = CFNSigner() \
    if self.using_instance_identity \
    else V4Signer(region, 'cloudformation')

Is it some CF-specific magic going on, or I'm missing some place where CF permissions are granted?

Answer 1

Yes, the CloudFormation service has a special undocumented authentication mechanism to allow cfn-* scripts from any instance in the stack to view the stack’s metadata without using IAM. It probably works like this:

• cfn-get-metadata and other cfn-* scripts include the contents of http://169.254.169.254/latest/dynamic/instance-identity/document (a JSON document including instanceId) and http://169.254.169.254/latest/dynamic/instance-identity/signature (a base64-encoded 128-byte value) in the CloudFormation DescribeStackResource request.
• CloudFormation verifies that the request comes from the EC2 instance by checking that the signature of the instance document was signed by the EC2 service. Since the signature is 128 bytes, it is likely a signature using an RSA 1024-bit private key maintained by EC2.
• CloudFormation takes the instanceId from the identity document and calls DescribeTags or DescribeInstances to get the tags associated with it.
• CloudFormation compares the values of the tags aws:cloudformation:stack-name and aws:cloudformation:logical-id (which can’t be modified by the user) and performs the DescribeStackResource request if they match the request’s StackName and LaunchConfig.