IPtables bootstrap scripts breaks new EKS Pod Identity

[pupapaik]

botocore.exceptions.CredentialRetrievalError: Error when retrieving credentials from container-role: Error retrieving metadata: Received error when attempting to retrieve container metadata: Connect timeout on endpoint URL: "http://169.254.170.23/v1/credentials"

I feel there has to be some update in this script, because it is missing rule for this endpoint. I cannot get credentials when I keep default DROP rule

https://github.com/aws-samples/containers-blog-maelstrom/blob/main/cis-bottlerocket-benchmark-eks/bottlerocket-cis-bootstrap-image/bootstrap-script.sh

[pupapaik]

when I remove this

# 3.4.1.1 Ensure IPv4 default deny firewall policy (Automated)
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

it starts working