SSRF through PDF rendering in a document preview service
The service rendered uploaded PDFs on the server, and PDFs can load remote resources. That was enough to reach internal endpoints, including the cloud metadata service.
The full write-up for this one isn't online yet.