Your security team implements a host-based firewall on all of your Amazon Elastic Compute Cloud (EC2) instances to block all outgoing traffic. Exceptions must be requested for each specific requirement. Until you request a new rule, you cannot access the instance metadata service. Which firewall rule should you request to be added to your instances to allow instance metadata access?

The Amazon EC2 instance metadata service is an on-instance component that provides information about the running instance. To access it, the instance must make an HTTP request to a specific link-local IP address, 169.254.169.254, on port 80. Since the host-based firewall blocks all outgoing traffic by default, an explicit outbound rule is required. The rule must permit TCP traffic from the instance to the destination IP 169.254.169.254 on destination port 80. This allows the instance to initiate the connection to the metadata service.

A. Inbound rules are for traffic coming to the instance. The instance initiates this connection, so an outbound rule is needed.
B. This is an inbound rule. The connection to the metadata service is initiated by the instance, making it outbound traffic.
D. The instance metadata service uses HTTP, which operates on port 80, not HTTPS on port 443.

1. Amazon EC2 User Guide for Linux Instances. (2023). Instance metadata and user data. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html. In the "Retrieve instance metadata" section, it states, "The instance metadata service is available on all EC2 instances... You can access it from within the instance at http://169.254.169.254/latest/meta-data/."