Skip to content

Instantly share code, notes, and snippets.

@arianvp

arianvp/example.nix

Created November 14, 2024 09:48
Show Gist options
  • Save arianvp/bc2aae4315e9b8f17643d475abd8a41d to your computer and use it in GitHub Desktop.
Save arianvp/bc2aae4315e9b8f17643d475abd8a41d to your computer and use it in GitHub Desktop.
Download ZIP
Block IMDS globally, but allow per service.
Raw
example.nix
let imds = ["169.254.169.254" "fd00:ec2::254"]; in
{
systemd.slices."-".sliceConfig.IPAddressDeny = imds;
systemd.services.my-service-that-needs-aws.serviceConfig.IPAddressAllow = imds;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment