Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The AWS EC2 Instance Metadata API provides a lot of useful functionality. Anyone on the actual EC2 instance can make a call to and see metadata for the instance the call was made from. The security of the API is such that it only checks that the call originates from the instance. Therefore, if I am allowing someone to run code on my instance I would like to know how to best block access to that particular url while retaining access myself.

As a highlight, I was surprised to find that the Metadata API can be also accessed via http://instance-data/ (which I found by accident somewhere).

I am able to inspect the urls being called by all of the code running on this instance, but I assume that this is not a good approach given IPv6 addresses (possibly), or some weird URI encodings that would resolve into the Metadata IP (, or some undocumented (it seems) URLs like http://instance-data/.

share|improve this question
up vote 11 down vote accepted

Firewall it off.

iptables -A OUTPUT -m owner ! --uid-owner root -d -j DROP

This rule permits only the root user to open connections to

share|improve this answer
Thanks! I ended up going with iptables -A OUTPUT -d -j DROP after I did all my necessary configuration during the boot sequence. Thank you again. – Tristan Oct 8 '12 at 18:55
Could you explain that command? – Collin Jul 7 '15 at 16:31
@Collin What is it you want explained? It looks to me like a very simple and straightforward rule. – Michael Hampton Jul 7 '15 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.