How to prevent/firewall calls to AWS EC2 Instance Metadata API?

Solution 1:

Firewall it off.

iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP

This rule prohibits any user other than the root user from opening connections to 169.254.169.254.