You're not shooting the messenger. I signed off on this strategy. In our case, quite a number of customers lock down their IAM policies with IP address based permissions. They have rules like "This account can be used only from our datacenter", or "These EIPs are the only legitimate source for changes" that help them defend against credential theft. There are other defenses, but for some ... this simple defense makes sense. My understanding is that GitHub have a similar challenge, and you can see in their note at: https://docs.github.com/en/enterprise-cloud@latest/organizat...

If we turned IPv6 on like a light switch and suddenly broke all of those customers whose traffic would flip to IPv6 ... that'd be pretty bad. That's not dumb. So instead we have dedicated endpoints for IPv6 and are working with customers to get their policies updated and tested.

For IAM creds on an EC2 instance it's more common to use EC2 Instance Roles. Those are retrieved locally from the IMDS, which is available over IPv6. We have a number of customers, including some large ones, running IPv6-only on their EC2 setups.