Log all outbound HTTP requests made by your URL-fetching services. Alert immediately on:

• Any request to 169.254.169.254 — this is a high-confidence SSRF indicator. No legitimate application request should go to the metadata endpoint after deployment.

• Any request to RFC 1918 IP ranges (10.x, 172.16-31.x, 192.168.x) — fetching internal IPs from a URL-fetching service is anomalous.

• Any request using file:// protocol — should never appear in application logs from a URL-fetching service.

• Unusual DNS resolution patterns — domains that resolve to private IPs after passing checks (DNS rebinding indicator).

AWS CloudTrail logs API calls made with the EC2 instance’s credentials. If SSRF successfully steals IAM credentials, the subsequent S3 API calls (from a different IP) will appear in CloudTrail as calls made by the EC2 role. Anomaly: the EC2 role is making API calls from an IP outside your infrastructure. Enable CloudTrail and alert on geographic or IP anomalies for role-based API calls.

Monitoring detects SSRF after it has occurred. In the Capital One breach, the attacker had access for nearly four months before discovery. Detection matters — but pair it with prevention (MIT 01–06) so that by the time monitoring alerts fire, the attacker was already blocked at an earlier layer.