Hacker News Reader

nice http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMT...

That's interesting. How did you go from metadata to token?

the token is in the metadata haha. try creating a report for http://169.254.169.254/latest/meta-data/identity-credentials...

Thanks for pointing out. Shame on us. :)

Be careful, there's ways around just blocking the IP address;

https://myraah.io/index.php/visualmind/report/aHR0cDovL2F3c2...

Agreed. I put together a little library to handle denying access to "local" resources, to abstract this a little and avoid overlooking common mistakes:

https://github.com/skx/remotehttp

Good ol' metadata strikes again. I wish AWS would make a virtual block device for accessing this content instead of network (at least as an option). Much easier to protect at the OS level.

The v2 service helps with this but it doesn't beat awareness of the issue.