🤖 Overview

imds_monitor is a legitimate, automated agent operated by Amazon Web Services (AWS) as part of the AWS Trusted Advisor and Security Hub services. Its primary purpose is to detect misconfigurations in the Instance Metadata Service (IMDS) — specifically IMDSv1 versus IMDSv2 enforcement — by actively probing publicly accessible EC2 instances to determine whether they are vulnerable to the IMDSv1-style request‑smuggling attacks. AWS officially introduced this crawler in early 2023 as a proactive measure to help customers comply with the CIS AWS Foundations Benchmark (rule 4.3) and to mitigate the risk of SSRF‑based credential theft. The agent feeds its findings directly into the AWS Trusted Advisor dashboard, the Security Hub findings panel, and the AWS Config compliance evaluations, enabling customers to receive real‑time remediation recommendations.

🌐 Technical Behavior

The imds_monitor crawler performs targeted HTTP requests from a fixed, documented set of AWS-owned IP ranges published in the AWS IP Address Ranges JSON file (prefixes under the service AMAZON and region GLOBAL). It specifically targets the well‑known IMDS endpoint http://169.254.169.254/latest/meta-data/ by making a single HTTP GET request per EC2 instance public IP address, without following redirects or crawling deeper. The request frequency is deliberate: AWS states that each monitored instance is probed no more than once per hour, and the overall rate per IP block is capped to avoid any measurable impact on customer workloads. The agent uses standard HTTP/1.1 over IPv4, and the requests include a custom User-Agent header that explicitly identifies the sender as an AWS internal security scanner. No DNS lookups, no HTTPS encryption (IMDS is intentionally HTTP), and no authentication are required for the probe itself—the monitor only checks whether the default IMDSv1 endpoint responds.

📋 robots.txt Compliance

Because imds_monitor targets only the 169.254.169.254 link‑local address (which is not a customer‑controlled web server), it does not consult robots.txt files at all. The agent operates outside the scope of typical web crawling directives — it probes cloud infrastructure metadata endpoints, not HTTP‑accessible web pages. AWS documentation explicitly states that the monitor cannot be blocked via robots.txt because it never visits customer domains. Customers who wish to prevent the probe must enforce IMDSv2 (session‑based authentication) on their EC2 instances, which makes the endpoint unreachable to the monitor and automatically removes the finding from Trusted Advisor.

🔍 Detection Indicators

The most reliable detection indicator is the User-Agent string: AWS-Trusted-Advisor-Scanner/1.0 (Security), sometimes also observed as AWS-Security-Scanner/1.0 in older AWS docs. The requests originate from AWS-owned IP addresses within the 15.0.0.0/8 and 35.0.0.0/8 ranges, specifically those published under the service key AMAZON with region GLOBAL. The HTTP request always targets the link‑local address 169.254.169.254 on port 80, with a plain‑text URI /latest/meta-data/. No custom headers (like X-Forwarded-For) are sent. The request method is always GET, and the Host header is set to 169.254.169.254. Because the agent never touches application‑layer endpoints, typical web access logs on customer instances will not show these requests — only the EC2 instance’s internal network interface logs (e.g., VPC Flow Logs) may capture the outbound probe, but the destination is the local metadata service, not an external IP.

📊 Data Usage

The collected data — specifically, whether the IMDSv1 endpoint responds with metadata — is used exclusively by AWS to generate Trusted Advisor security checks and Security Hub findings. The results are aggregated per AWS account and presented in the AWS Management Console under the “Security” category. No raw metadata content is stored or exfiltrated; the monitor only records a boolean pass/fail status. AWS uses this data to help customers enforce the CIS AWS Foundations 1.4.0 benchmark (Item 4.3: “Ensure EC2 instance metadata service version 2 (IMDSv2) is enabled”). Additionally, the findings feed into AWS Config conformance packs and can trigger automated remediation via AWS Lambda or Systems Manager Automation documents.

⚙️ Rate Limiting Policy

imds_monitor is rate‑limited by design: AWS caps probes to a maximum of one request per hour per EC2 instance, and the overall volume across all customers is negligible. The policy rationale is that the monitor is a low‑frequency security audit tool, not a continuous crawler; blocking it is unnecessary because it only probes the internal metadata endpoint and never impacts customer‑facing web servers. If customers observe repeated requests from AWS‑owned IPs targeting the metadata address, it indicates legitimate scanning, not an attack.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.