I need to find out the public-ip of an EC2 instance. I was trying this command:
Is there any security threat of using that method? Like exposing our IP or something?
If there is a remote execution bug in curl or any lib it relies on, there is a chance curl will run arbitrary code. That might be a security risk if you don't patch your system and run this command using a cron job.
To answer your question: Of course, you are exposing your IP to this service, as you are exposing on any router, country and intelligence. But your ip is public anyway, the known default ports will be scanned like any minute as soon as it's booted.
Also if they give you a wrong IP, and you assume it's yours and you connect using ssh for example, your credentials will go to the server they might control. Also there might be a man-in-the middle attack that will result in showing you the wrong IP and trick you into sending credentials or other data to a wrong server.
The only issue that I can think about is that the company ipinfo.io after you make the request use the IP for do other things.
Other answers have already exposed 2 threats:
But I must say that I can hardly imagine a real use case for that. In order to execute the command on a system, you must be connected to it (or have been connected at a time), and to connect to it you need either a direct access (unlikely on a EC2 instance) or a network connection. And to establish the network connection, you must know a remote system address: either an IP one or a name that you can ask your DNS server for.
So the only use case for that would be for execution on a system where the script was installed by accident - or by a malware. And even in that case, it would be more simple to directly try to connect to a system controlled by the script owner.
Said differently, without more context, I really suspect an X-Y problem: you are trying to solve a problem that only exists because you tried a wrong solution to another question.