Skip to content
This repository has been archived by the owner on Aug 22, 2024. It is now read-only.

Metadata service compatible with imdsv2 #55

Merged
merged 6 commits into from
Nov 8, 2022
Merged

Conversation

BenCodeOcean
Copy link
Contributor

@BenCodeOcean BenCodeOcean commented Sep 4, 2022

imdsv2 is a required security standard. To achieve imdsv2 compatibility, it is required to change the entire metadata service requests by adding a header with a token.
This fix is necessary since the EBS Autoscale service failed on an EC2 instance with a configured option of a required http-tokens:

aws ec2 modify-instance-metadata-options \
    --instance-id i-1234567898abcdef0 \
    --http-tokens required

Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html

Description of changes:
The get_metadata function changed and a request for a token was added before the metadata request itself. Also, all the metadata service requests are sent using the get_metadata function.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Copy link
Contributor

@wleepang wleepang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks reasonable. However, using IMDSv2 is currently optional and not all AMIs may be configured to use it according to the docs.

Can this be a configuration parameter that users can opt-in as needed?

@BenCodeOcean
Copy link
Contributor Author

BenCodeOcean commented Oct 31, 2022

Yes, configuration parameter will be a fit solution.
I added an optional flag for imdsv2 enabling:

    -i, --imdsv2        
                        Enable imdsv2 for instance metadata API requests.     

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants