nodeInit() - https://github.com/aws/amazon-vpc-cni-k8s/blob/master/ipamd/ipamd.go#L271) function grabs all the ENIs for the worker node, then grabs all pods on the worker node and loops through all the pods setting up iptables rules.
This piece of code: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/ipamd/ipamd.go#L373-L378
can and should be pulled out of that loop since it's not dependent on the contents of the loop iteration. This would eliminate N-1 calls to IMDS to get the subnets associated with the node, where N == #pods