This is accurate. Remember that even ELB's in AWS have IP's that change all the time, and this itself is actually a source of vulnerabilities from apps that do

This is accurate. Remember that even ELB's in AWS have IP's that change all the time, and this itself is actually a source of vulnerabilities from apps that don't respect DNS TTL's (as has been seen in the forums repeatedly -- apps get connected to the previous IP instead of the new one). It's probably safer to retrieve and verify the IP for each request, and just cache if the IP is 'safe'. (And just doing IP subnet calculations is non-trivial in most less-common languages.) Also, request throttling should be maintained and HTTP verb checking, to prevent being turned into a proxy for other attacks. Actually, any decision to accept an arbitrary URL should be carefully examined in light of how hard it is to do safely.