Learn how a Vultr Cloud Compute instance or Bare Metal server requests a signed JWT identity token from its metadata service to authenticate IAM role requests.
A Vultr Cloud Compute instance or Bare Metal server can request a signed identity token from its local metadata service. The token is a JWT that identifies the specific server, your Vultr account, and the server's resource type, and it is used to assume an IAM role without a stored API key or user credentials. The metadata service is only reachable from inside the server itself, at the fixed link-local address 169.254.169.254.
Follow this guide to request an identity token from within a running instance or bare metal server.
Connect to the instance or bare metal server as a user with shell access.
Request the identity token from the metadata service.
The response is the raw JWT string, not wrapped in JSON. Decoding its payload shows claims similar to the following, differing by server type:
On a Bare Metal server, iss ends in /baremetal, sub is prefixed baremetal:, and resource_type is baremetal. The token expires 5 minutes after issuance (exp minus iat), so request a fresh token immediately before using it rather than caching it.
0 Comments
Be the first to comment and share your perspective with the community.