A metadata service is a cloud endpoint that provides details about a running instance, such as its network identity, region, attached roles, and configuration. In some cloud setups, it also issues temporary credentials to software running on that instance. Because it sits inside the cloud trust boundary, it is usually meant to be reachable only from the host itself.
Security teams care about metadata services because attackers often target them after gaining server-side request forgery (SSRF) or similar request-routing bugs. If an exposed application can be tricked into calling the metadata endpoint, the attacker may learn sensitive instance information or obtain short-lived credentials and use them to access storage, APIs, or other internal resources. Defenses include blocking access from untrusted applications, using network controls and egress filtering, enforcing least privilege on instance roles, and hardening metadata access paths so only approved workloads can reach them.