Notable IP addresses / 169.254.169.254

169.254.169.254
169.254.169.254 — cloud instance metadata

Link-local service addressNot owned — link-local (used by AWS, Azure, GCP, Oracle)

The address where cloud virtual machines fetch their own metadata — instance ID, region, user-data and temporary IAM credentials.

AWS (IMDS), Google Cloud, Azure, Oracle Cloud and DigitalOcean all serve instance metadata at http://169.254.169.254. Because it returns credentials to any process on the VM, it is the number-one target of SSRF attacks; the 2019 Capital One breach used exactly this path. AWS IMDSv2 requires a session token (PUT then GET) to mitigate it, and you should enforce it.

If you see requests to this address in an application log from user-supplied URLs, treat it as an attack attempt and block it at the egress layer.

Related addresses

169.254.1.1
169.254.x.x — link-local (APIPA) address
127.0.0.1
127.0.0.1 — localhost

Frequently asked questions

How do I protect the metadata endpoint?

Enforce IMDSv2 (AWS) or equivalent, block 169.254.169.254 in your application's outbound HTTP client, and give instances the minimum IAM role.