> I hope AWS mitigated this metadata endpoint weakness by now.
AWS offers a version 2 of the Instance Metadata Service (IMDS) API that includes mitigations for many common SSRF attacks.
IIRC both IMDSv1 and IMDSv2 are turned on by default and it's a recommended AWS best practice to disable IMDSv1 when launching new instances.
https://aws.amazon.com/blogs/security/defense-in-depth-open-...