AWS Metadata Service Access - Possible SSRF

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to access the AWS EC2 Instance Metadata Service (IMDS) by looking for HTTP requests containing the IP address '169.254.169.254' in the URI. This IP address is a well-known link-local address used by AWS instances to retrieve metadata. Such access attempts, especially when originating from an unexpected source or in an unusual context, can indicate a Server-Side Request Forgery (SSRF) vulnerability being exploited.