Expected, yes, but it’s not something you’d necessarily think about I guess. I never thought about the containers being able to access the EC2 metadata endpoint since ECS exposes a container specific one (although they obviously could, in hindsight).