title: Block docker access to specific IP
body: <p>I'd like my EC2 instance to have IAM-based permissions, but don't want the docker containers on that instance to have the same permissions. I believe it should be sufficient to block access to the magic IP <code>169.254.169.254</code>. Is it sufficient to run:
  <code>
  iptables -I DOCKER -s 169.254.169.254 -j DROP
  </code></p>
  
  <p>Do I also need to configure my docker daemon with <code>--icc=false</code> or <code>--iptables=false</code>?</p>