Feature request: block metadata requests missing a correct User-Agent header

[arkadiyt]

Netflix wrote about this protection mechanism here (under Metadata Service Protection):
https://medium.com/netflix-techblog/netflix-information-security-preventing-credential-compromise-in-aws-41b112c15179

The idea is to block requests without a User-Agent header corresponding to the official aws-sdk clients, because in the vast majority of server side request forgery instances the attacker cannot set arbitrary request headers.

They provided a sample implementation here: https://github.com/Netflix-Skunkworks/aws-metadata-proxy
but if we're running kube2iam anyway it seems silly to run 2 metadata proxies - it would be neat if kube2iam supported this out of the box

[joshbranham]

This is something we are also interested in