title: AWS Retrieving Security Credentials from Instance Metadata
body: <p>This is not a duplicate of the question "Getting my AWS credentials using an API call" because I am asking specifically about what Amazon means in the example that they give.</p>
  
  <p>I am looking here: <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" rel="noreferrer">http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html</a></p>
  
  <p>I see this bit:</p>
  
  <blockquote>
    <p><strong>Warning</strong></p>
    
    <p>If you use services that use instance metadata with IAM roles, ensure that you don't expose your credentials when the services make HTTP calls on your behalf. The types of services that could expose your credentials include HTTP proxies, HTML/CSS validator services, and XML processors that support XML inclusion.</p>
    
    <p>The following command retrieves the security credentials for an IAM role named s3access.</p>
  
  <pre><code>$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access
  </code></pre>
  </blockquote>
  
  <p>Where does this IP address come from? What is 169.254.169.254? It can't be my server, since I don't have software running on port 80, nor would I grant Amazon an alias on my server. </p>
  
  <p>But I did actually run the above, and it simply timed out. So the IP address 169.254.169.254 is not a service that Amazon is actively running. So what is it? </p>
  
  <p>Does anyone understand this example that Amazon offers? </p>