Block non-root access to EC2 instance metadata endpoint

[furkansahin]

Summary

• Adds nftables rules to block non-root users from accessing the EC2 Instance Metadata Service (IMDS) at 169.254.169.254 and fd00:ec2::254
• Uses a systemd oneshot service (imds-protection.service) that conditionally activates only on EC2 instances by checking DMI sys_vendor
• On non-EC2 deployments (bare metal, other clouds), the service exits cleanly and no rules are loaded, so 169.254.169.254 remains reachable for legitimate use (e.g. replication)

Commits

• 62a6fc2 Block non-root access to EC2 instance metadata endpoint

Test plan

• Build image and launch on EC2, verify nft list ruleset shows the IMDS protection table
• Verify curl http://169.254.169.254/ works as root but fails as postgres user
• Build image and launch on non-EC2 (e.g. bare metal), verify no nftables rules are loaded

🤖 Generated with Claude Code