> I hope AWS mitigated this metadata endpoint weakness by now. AWS offers a version 2 of the Instance Metadata Service (IMDS) API that includes mitigations for

> I hope AWS mitigated this metadata endpoint weakness by now. AWS offers a version 2 of the Instance Metadata Service (IMDS) API that includes mitigations for many common SSRF attacks. IIRC both IMDSv1 and IMDSv2 are turned on by default and it's a recommended AWS best practice to disable IMDSv1 when launching new instances. https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ https://aws.amazon.com/blogs/security/defense-in-depth-open-...