Curl-url-http-3a-2f-2f169.254.169.254-2flatest-2fapi-2ftoken Link ❲2025❳

http://169.254.169.254/latest/api/token

Replace YOUR_TOKEN_HERE with the actual token received from the /latest/api/token endpoint.

• AWS GuardDuty (detects unusual API calls from EC2)
• Third-party agents on the VM
• VPC Flow Logs to detect outbound traffic to 169.254.169.254

First, request a token using PUT:

curl -H "X-aws-ec2-metadata-token: YOUR_TOKEN_HERE" http://169.254.169.254/latest/meta-data/instance-id

If you are a developer or security researcher: curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken

6. SSRF defenses

• Use allowlists for external URLs
• Never follow redirects internally
• Use localhost and 169.254.0.0/16 blocklists in URL validation libraries.