> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Metadata Blocking

> Verify that the cloud metadata service (169.254.169.254) is unreachable from a sandbox — it is blocked by default on every Declaw sandbox — while keeping normal internet access available.

## What You'll Learn

* That `169.254.169.254` is blocked **by default** on every Declaw sandbox — no opt-in required
* Verifying the metadata endpoint is unreachable (SSRF protection)
* Verifying normal internet access still works in the same sandbox
* How to add an explicit `deny_out` rule as belt-and-suspenders documentation of intent
* Understanding why blocking the metadata service matters

## Why This Matters

In cloud environments (AWS, GCP, Azure), the instance metadata service at `169.254.169.254` can expose:

* IAM credentials and access tokens
* Instance identity documents
* User data scripts (which may contain secrets)
* Network configuration details

An SSRF vulnerability could allow untrusted code inside a sandbox to reach this endpoint and steal credentials. Declaw blocks `169.254.169.254` by default — it is a hardcoded rule applied to every sandbox, so the metadata endpoint is never reachable even with no network policy set. Adding `169.254.169.254/32` to `deny_out` is therefore redundant; the example below uses it to make the intent explicit and to **verify** the default protection holds, not to provide it.

## Prerequisites

<Snippet file="snippets/env-setup.mdx" />

<Note>This example is available in Python. TypeScript version coming soon.</Note>

## Code Walkthrough

The metadata IP is already blocked by default. The explicit `deny_out` rule below documents that intent and lets you assert it in tests — it does not change the behavior:

```python theme={null}
from declaw import Sandbox

# 169.254.169.254 is blocked by default; this deny_out rule is belt-and-suspenders.
sbx = Sandbox.create(
    template="python",
    timeout=300,
    network={"deny_out": ["169.254.169.254/32"]},
)
```

The metadata test script tries to open a TCP connection to port 80 on the metadata IP:

```python theme={null}
METADATA_TEST = """
import socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("169.254.169.254", 80))
    s.close()
    print("CONNECTED")
except Exception as e:
    print(f"BLOCKED: {e}")
"""
```

Test 1 — metadata endpoint should be blocked:

```python theme={null}
sbx.files.write("/tmp/meta_test.py", METADATA_TEST)
result = sbx.commands.run("python3 /tmp/meta_test.py", timeout=15)
print(f"  Output: {result.stdout.strip()}")

if "BLOCKED" in result.stdout:
    print("  [PASS] Cloud metadata endpoint blocked (SSRF mitigated).")
else:
    print("  [INFO] Metadata endpoint may not exist in this environment,")
    print("         but the deny rule is still applied.")
```

Test 2 — normal internet should still work (only metadata is denied):

```python theme={null}
INTERNET_TEST = """
import socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5)
    s.connect(("1.1.1.1", 80))
    s.close()
    print("CONNECTED")
except Exception as e:
    print(f"BLOCKED: {e}")
"""

sbx.files.write("/tmp/inet_test.py", INTERNET_TEST)
result = sbx.commands.run("python3 /tmp/inet_test.py", timeout=15)

if "CONNECTED" in result.stdout:
    print("  [PASS] Normal internet access works (only metadata blocked).")
```

## Expected Output

```
============================================================
Network Metadata Blocking Example (SSRF Protection)
============================================================

--- Creating sandbox with deny_out=[169.254.169.254/32] ---
Sandbox created: sbx_abc123

--- Test 1: Connect to metadata endpoint (should FAIL) ---
  Output: BLOCKED: timed out
  [PASS] Cloud metadata endpoint blocked (SSRF mitigated).

--- Test 2: Connect to normal internet (should SUCCEED) ---
  Output: CONNECTED
  [PASS] Normal internet access works (only metadata blocked).

--- Why Metadata Blocking Matters ---
  Cloud metadata services (169.254.169.254) expose:
    - IAM credentials and access tokens
    - Instance identity documents
    - Network configuration
  SSRF attacks trick apps into querying this endpoint.
  Blocking it prevents credential theft from compromised sandboxes.

--- Cleaning Up ---
  Sandbox sbx_abc123 killed.

============================================================
Done!
============================================================
```