The AI answer we saw
AWS IMDSv2 introduces a session-oriented authentication model where clients must first obtain a session token via a PUT request with a TTL header, then use that token in subsequent GET requests. This mitigates SSRF vulnerabilities present in IMDSv1. Azure IMDS uses a simpler stateless header-based authentication requiring 'Metadata: true' on every request, without a session token mechanism. AWS allows enforcement of IMDSv2-only access at the instance or account level via IAM policies and instance metadata options, providing granular control. Azure does not have an equivalent IMDSv1/v2 distinction but achieves similar SSRF protection through its mandatory header requirement. For enterprises prioritizing security, AWS IMDSv2 enforcement is generally considered a stronger control due to its token-based session model, while Azure's approach is simpler to implement with comparable protection against common attack vectors.
Captured during this Readable report run. Answers can vary by AI tool and date.