BluePallet runs Amazon ECS on EC2. An internal audit showed containers could reach 169.254.169.254 to fetch instance profile credentials, bypassing task‑level least privilege. They cannot migrate to Fargate. What is the most effective change to prevent containers from accessing instance metadata while preserving task IAM roles?

The correct answer is to switch tasks to awsvpc network mode and set ECSAWSVPCBLOCKIMDS=true. This configuration, when used with awsvpc network mode, effectively blocks access to the EC2 instance metadata service (IMDS) from within the container's network namespace. This prevents containers from retrieving instance profile credentials, enforcing task-level IAM roles for least privilege. Minimizing the instance profile and relying on task roles is a best practice for security. Using bridge network mode and managing iptables is less scalable and more complex to maintain across a dynamic ECS environment. Setting the IMDSv2 hop-limit to 1 is a good security measure for IMDSv2 but doesn't specifically block access from containers in the same way ECSAWSVPCBLOCKIMDS=true does for awsvpc mode, and it doesn't preserve task roles if not combined with other measures. Adding a VPC interface endpoint for STS and denying calls from containers is an indirect and less effective method for preventing IMDS access, as containers could still potentially retrieve credentials before attempting STS calls.