> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vulpy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# The AWS IMDS lock and why Fox is fenced off

> How Vulpy blocks EC2 and Lightsail instance metadata to keep Fox off the VM IAM role, and when to opt out or provide explicit provider keys.

Vulpy installs a host-level firewall rule that blocks the AWS Instance Metadata Service (IMDS) endpoint. This prevents Fox from silently picking up the VM's IAM role and acting with cloud permissions you never intended to grant an AI operator.

<Tip>
  **Ask Fox to check the lock.** Fox knows whether the IMDS lock is on and can explain the trade-off before you change it.

  Try prompts like:

  * "Is the IMDS lock on right now?"
  * "Explain the risk of setting `VULPY_IMDS_LOCK=0`."
  * "Run `pnpm vulpy hermes doctor` and tell me the IMDS status."
</Tip>

## What IMDS is and why it matters

The Instance Metadata Service runs at `169.254.169.254` on EC2 and Lightsail instances. Any process on the VM can request temporary credentials from this address if the instance has an IAM instance profile attached. For a containerized AI operator like Fox, unrestricted access means it could read the VM's role, call AWS APIs, and perform actions under your cloud account.

## What Vulpy installs

Vulpy adds an `nft` reject rule that drops traffic to `169.254.169.254` for the host and for all containers. The lock is active by default because Fox ships without a Docker socket and without cloud credentials of its own. Blocking IMDS closes a path where Fox could otherwise inherit the VM's identity.

## Default behavior and how to check it

The lock is on by default. `VULPY_IMDS_LOCK` is set to `1` in your environment unless you override it.

Run the doctor command to verify the current state:

```bash theme={null}
pnpm vulpy hermes doctor
```

The report shows whether the IMDS lock is active on AWS and whether host egress is restricted separately.

## When to opt out

You should only disable the lock if Fox needs to use Amazon Bedrock through the VM's IAM instance profile and you do not want to pass explicit AWS credentials.

Set the variable before starting Fox:

```bash theme={null}
VULPY_IMDS_LOCK=0
```

<Warning>
  Opting out gives Fox any permission attached to the VM IAM role. Scope the role narrowly and review its policy before you disable the lock.
</Warning>

## Preferred alternative: explicit credentials

Instead of opening IMDS to Fox, keep the lock on and pass explicit AWS keys as environment variables. This limits Fox to the exact permissions you define and keeps the metadata endpoint blocked for every other container on the host. See the AI providers page for how to configure Bedrock keys.

## Host egress lock

The IMDS rule is separate from host egress restrictions. `pnpm vulpy hermes doctor` reports both. If you see a failure on egress, review your firewall rules independently of the IMDS setting.

<CardGroup cols={2}>
  <Card title="AI Providers" icon="bot" href="/fox/ai-providers">
    Configure Bedrock, OpenAI, and other providers with explicit keys instead of relying on VM roles.
  </Card>

  <Card title="Security" icon="shield" href="/deploy/security">
    Review firewall rules, access modes, and hardening guidance for production deployments.
  </Card>
</CardGroup>