[Omnipresent]

> The problem is common and well-known, but hard to prevent and does not have any mitigations built in to the AWS platform.

Does anyone know if this is fixed by AWS now?

[thedougd]

IMDSv2 with tokens required is the fix:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configur...

[zsims]

Partial mitigation. It's not SSRF "proof" but I suppose nothing really is.