Your security team implements a host-based firewall on all of your Amazon Elastic Compute Cloud (EC2) instances to block all outgoing traffic…

The Amazon EC2 Instance Metadata Service (IMDS) is an on-instance component that provides information about the running instance. Instances access the IMDS by making an HTTP request to a special link-local IP address, 169.254.169.254. Since the request originates from the EC2 instance and is sent to the IMDS endpoint, it is considered outbound traffic from the perspective of the instance's host-based firewall. The service uses the standard HTTP protocol, which operates over TCP on port 80. Therefore, to allow access, an outbound firewall rule must be created to permit TCP traffic to the destination IP 169.254.169.254 on destination port 80.

A. This rule is for inbound traffic, but the instance initiates the connection to the metadata service, which is an outbound request.

B. This rule is for inbound traffic. The request to the instance metadata service is outbound from the instance, not inbound to it.

D. This rule specifies the correct direction and destination IP but uses the incorrect destination port (443 for HTTPS). The IMDS uses HTTP on port 80.

---

References:

1. Amazon EC2 User Guide for Linux Instances: This document explicitly states the IP address and access method for the instance metadata service.

Source: AWS Documentation, "Instance metadata and user data".

Reference: In the section "Retrieve instance metadata," it states, "The instance metadata service is available at a special 'link-local' IP address of 169.254.169.254." The examples provided use curl http://169.254.169.254/..., which confirms the protocol is HTTP (TCP port 80) and the connection is initiated from the instance (outbound).

2. Amazon EC2 User Guide for Linux Instances: This guide details how to configure access to the IMDS, reinforcing the endpoint details.

Source: AWS Documentation, "Configure the instance metadata options".

Reference: In the section "Transition to using Instance Metadata Service Version 2," the guide consistently refers to the endpoint as http://169.254.169.254, confirming the use of HTTP on port 80.

3. AWS Security Blog: A blog post on enhancing EC2 metadata security discusses the nature of the IMDS connection.

Source: AWS Security Blog, "EC2 Instance Metadata Service-Add defense in depth against open firewalls, reverse proxies, and SSRF vulnerabilities with enhancements to the EC2 Instance Metadata Service".

Reference: The post describes how local software on the EC2 instance makes requests to 169.254.169.254. This confirms the traffic originates from the instance, making it an outbound connection that a host-based firewall would need to permit.