The Instance Metadata Service is an EC2-only endpoint that an instance can query from inside the host to learn about itself, such as its instance ID, network details, and, when an IAM role is attached, temporary AWS credentials. It is usually reached on a link-local address, which means the service is meant to be local to the instance and not exposed like a normal internet-facing API.
IMDS matters because any code, process, or tunnel that can reach it may be able to steal role credentials and impersonate the instance in AWS. Attackers often try to pivot from application bugs, server-side request forgery, or misconfigured port forwarding into IMDS to obtain short-lived credentials. Defenders reduce this risk by limiting local access paths, enforcing IMDSv2, restricting who can create tunnels or proxy requests, and treating metadata as a sensitive credential source rather than harmless machine information.