News for hackers. Stuff that matters.

A comment on EC2's most dangerous feature. Parent comment

Re:EC2's most dangerous feature by falcolas on Sunday October 09, 2016 @09:06AM (#12671028)
This won't help with IAM roles, since the credentials provided in the metadata expire. Of course, a small tweak to the iptables entry would help there as well.

Mind posting your entry for us iptables impared folks?

[ Parent | on HN ]
Re:EC2's most dangerous feature by cesarb on Sunday October 09, 2016 @09:13AM (#12671054)
I don't work there anymore, so I don't have access to the exact rule I used, but IIRC it was something like

iptables -t filter -I OUTPUT -d 169.254.169.254 -m owner \! --uid-owner 0 -j REJECT --reject-with icmp-admin-prohibited

[ Parent | on HN ]