Function is_cloud_metadata_ip 

pub fn is_cloud_metadata_ip(ip: IpAddr) -> bool

True when ip is a known cloud instance-metadata service address.

The classifier covers the entire IPv4 link-local range used by instance, task, and pod metadata services; the AWS fd00:ec2::/64 service range; Google Compute Engine IPv6; Alibaba ECS IPv4; and Azure’s host-local WireServer address. IPv4-mapped and RFC 6052 well-known NAT64 forms receive the same classification. Metadata services can also use private DNS names or provider-specific addresses, so callers must not treat these ranges as provider discovery.

Known metadata addresses are refused unconditionally by both validate_resolved_ips_are_public and validate_resolved_ips_exclude_metadata, so an operator opt-in for private destinations never re-opens them.