Apparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role.

Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.