SSRF AWS Instance Metadata Endpoint Access - ATR-2026-01605 (99e47e34-fd7e-5adc-af3c-f0ce43a46314)
Detects SSRF (Server-Side Request Forgery) attempts targeting the AWS EC2 Instance Metadata Service (IMDS) at 169.254.169.254. When an agent's HTTP-fetch tool is redirected to this address, the agent retrieves IAM security credentials, instance identity documents, and other sensitive cloud configuration data accessible only from within the instance. This is the most impactful SSRF target in cloud-hosted agent deployments. Also detects the AWS IMDSv2 token endpoint at the same address.