Consider blocking AWS metadata service access to non-root processes

[gozer]

Not sure it's such a good idea, but would be easy as pie.

Adding this at the end of bootup:

Block AWS metadata service to non-root users

iptables -A OUTPUT -p tcp -d 169.254.169.254 -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -d 169.254.169.254 -j REJECT

[gozer]

Even simpler, turns out cloud-init supports this out of the box with the disable_ec2_metadata configuration option, just need to drop that in /etc/cloud.cfg.d/