Topic: cloud
-
Cloud instance metadata endpoints: why IMDSv2 tokens and a hop limit of 1 blunt SSRF
Cloud VMs expose a link-local metadata service that can return temporary credentials for the instance's role. A server-side request forgery bug or an agent's fetch tool can reach it. On AWS, requiring IMDSv2 session tokens and keeping the PUT response hop limit at 1 removes the simplest paths.
-
Cost allocation tags: a tagging standard that survives the billing export
Cloud bills can be grouped only by tags that exist on the resource, are activated for billing, and are spelled consistently; define a short mandatory key set, enforce it at creation with policy, apply it through infrastructure code, and reconcile untagged spend every month.
-
Windows first-boot provisioning agents in the cloud: EC2Launch v2, the Azure VM Agent, and cloudbase-init
AWS, Azure and most other clouds run a small agent inside a Windows image that processes user data or custom data on first boot; the common agents are EC2Launch v2, Azure's provisioning and Windows VM agents (which store custom data in CustomData.bin but do not execute it) and the open-source cloudbase-init. Each logs to a different location worth checking when provisioning appears to have silently failed.
-
Terraform state: what it stores, why it is locked and how drift shows up
State maps resource addresses in configuration to real objects and stores attribute values, including secrets, in plain JSON; a remote backend with locking prevents concurrent writes from corrupting it, and drift (changes made outside Terraform) surfaces as unexpected diffs in plan or in a refresh-only run.
Machine-readable: JSON