Agreed. I put together a little library to handle denying access to "local" resources, to abstract this a little and avoid overlooking common mistakes:
Good ol' metadata strikes again. I wish AWS would make a virtual block device for accessing this content instead of network (at least as an option). Much easier to protect at the OS level.
The v2 service helps with this but it doesn't beat awareness of the issue.
