There was also the address of the other internal services. I think the best way here is to put the "fetch random URLs" service out in its own subnet, where it

There was also the address of the other internal services. I think the best way here is to put the "fetch random URLs" service out in its own subnet, where it cannot access any other internal services like the EC2 status service. You'll also have to validate the URLs (no non-HTTP-or-HTTPS URLs) and prevent things like the redirect attack from working.