Introduction

boto.utils.get_instance_metadata() was a convenient helper in the old Boto library for reading EC2 instance metadata from inside an instance. Boto3 does not expose a direct public replacement with the same shape. In modern AWS code, the practical equivalent is to call the EC2 Instance Metadata Service directly, usually with IMDSv2, or let the SDK use metadata automatically for credential resolution.

What Boto3 does and does not do

Boto3 is built on Botocore and can automatically use instance metadata behind the scenes when it needs IAM role credentials on EC2. That is different from giving you a convenient helper for arbitrary metadata paths such as instance id, availability zone, or user data.

So the answer is:

• Boto3 uses instance metadata internally for some credential flows.
• Boto3 does not give you a general public helper that exactly replaces get_instance_metadata().
• If you want arbitrary metadata values, call IMDS yourself.

Use IMDSv2 directly

Modern EC2 environments often require IMDSv2, which means you first request a session token and then send that token with metadata requests.

1import requests
2
3TOKEN_URL = "http://169.254.169.254/latest/api/token"
4METADATA_URL = "http://169.254.169.254/latest/meta-data/"
5
6
7def get_imds_token():
8    response = requests.put(
9        TOKEN_URL,
10        headers={"X-aws-ec2-metadata-token-ttl-seconds": "21600"},
11        timeout=1,
12    )
13    response.raise_for_status()
14    return response.text
15
16
17def get_instance_metadata(path):
18    token = get_imds_token()
19    response = requests.get(
20        METADATA_URL + path,
21        headers={"X-aws-ec2-metadata-token": token},
22        timeout=1,
23    )
24    response.raise_for_status()
25    return response.text
26
27
28print(get_instance_metadata("instance-id"))
29print(get_instance_metadata("placement/availability-zone"))

This code runs only from inside the EC2 instance because the metadata endpoint is link-local. It does not require AWS credentials, but it does require that instance metadata access be enabled.

Common metadata paths

Once you have a helper, you can query different paths under latest/meta-data/:

• 'instance-id'
• 'placement/availability-zone'
• 'iam/security-credentials/'
• 'public-ipv4'

If you need user data rather than metadata, the path lives under latest/user-data instead of latest/meta-data.

1import requests
2
3token = requests.put(
4    "http://169.254.169.254/latest/api/token",
5    headers={"X-aws-ec2-metadata-token-ttl-seconds": "21600"},
6    timeout=1,
7).text
8
9user_data = requests.get(
10    "http://169.254.169.254/latest/user-data",
11    headers={"X-aws-ec2-metadata-token": token},
12    timeout=1,
13).text
14
15print(user_data)

When you do not need to call metadata yourself

If the only goal is "let my code authenticate with the instance role," do not fetch metadata manually. Boto3 already knows how to use the instance profile credential chain. Manual metadata calls are useful only when your application specifically needs metadata values for its own logic.

That distinction keeps your code simpler and avoids duplicating work the SDK already does well.

It also reduces coupling to metadata-path details. If AWS credentials are the only requirement, letting the SDK resolve them is both cleaner and easier to test across local and cloud environments.

Common Pitfalls

The biggest current pitfall is using an old IMDSv1-style example that sends a plain GET request without first acquiring an IMDSv2 token. That fails on instances configured to require IMDSv2.

Another issue is trying to call the metadata endpoint from your laptop, a container that lacks access, or any machine that is not the target EC2 instance. The endpoint is local to the instance environment.

Developers also forget timeouts. Metadata calls are local, but they can still hang if the route is unavailable or metadata access has been disabled. Keep the timeout short.

Finally, avoid assuming Boto3 will expose every metadata path as a friendly API. For arbitrary metadata retrieval, direct IMDS access is still the normal pattern.

Summary

• Boto3 has no public one-call equivalent to boto.utils.get_instance_metadata().
• It can still use instance metadata automatically for IAM role credentials.
• For your own metadata lookups, call the EC2 metadata endpoint directly.
• Use IMDSv2 token flow instead of old tokenless IMDSv1 examples.
• Add short timeouts and remember the endpoint is accessible only from inside the instance.