Tech Challenge

This Node.js endpoint fetches any URL the client supplies and returns the body. An attacker submits `http://169.254.169.254/latest/meta-data/iam/security-credentials/web-role`. On AWS, why is this SSRF target especially dangerous, and what mitigates it?

app.get('/fetch', async (req, res) => {
  const r = await fetch(req.query.url); // url fully attacker-controlled
  res.send(await r.text());
});