This is an interesting attack that I must confess I hadn't thought of, but surely any service that accepts an arbitrary URL has a list of IP ranges to avoid. Ho

This is an interesting attack that I must confess I hadn't thought of, but surely any service that accepts an arbitrary URL has a list of IP ranges to avoid. However, to harden a role in the event of instance role credentials leaking, you could use an IAM Condition [0]. There is actually an example of this in the IAM documentation [1], although the source VPC parameter doesn't work for all services, and I can't see a list of services that support this parameter. This would ensure that the requests actually came from instances within your VPC. [0] http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Condition http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_po... [1] http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucke...