{"version":"2.1.277","anchor":"awsgcp-metadata-ssrf-blocklist-extended","canonical_anchor":"awsgcp-metadata-ssrf-blocklist-extended","heading":"AWS\/GCP metadata SSRF blocklist extended","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277\/e\/awsgcp-metadata-ssrf-blocklist-extended","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277","markdown":"### AWS\/GCP metadata SSRF blocklist extended\n\nCloud metadata blocklist now also covers EC2's instance-data hostname\n\n**What**\n\nClaude Code maintains a list of hostnames used by cloud providers to serve instance metadata, which is blocked from being fetched as a security precaution. That list now also includes `instance-data.ec2.internal`, an Amazon EC2 metadata hostname.\n\n**Why**\n\nThis closes a gap where a request to this EC2 metadata hostname might not have been blocked, reducing the risk of leaking cloud instance credentials or metadata through a fetched URL.\n\n- Area: Sandbox\n- Names: `instance-data.ec2.internal`\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}