fix: Pass token to metadata service requests.

close: #476
cattle-ops · May 20, 2022 · 85f59ff · 85f59ff
1 parent c2f51b2
commit 85f59ff
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/template/eip.tpl b/template/eip.tpl
@@ -6,5 +6,5 @@ python3 get-pip.py --user
 export PATH=~/.local/bin:$PATH
 
 pip install aws-ec2-assign-elastic-ip
-export AWS_DEFAULT_REGION=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/document | grep region | awk -F\" '{print $4}')
+export AWS_DEFAULT_REGION=$(curl -s -H "X-aws-ec2-metadata-token: $token" http://169.254.169.254/latest/dynamic/instance-identity/document | grep region | awk -F\" '{print $4}')
 /usr/local/bin/aws-ec2-assign-elastic-ip --valid-ips ${eip}
diff --git a/template/logging.tpl b/template/logging.tpl
@@ -33,11 +33,11 @@ initial_position = start_of_file
 EOF
 
 # Set the region to send CloudWatch Logs data to (the region where the instance is located)
-region=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
+region=$(curl -s -H "X-aws-ec2-metadata-token: $token" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
 sed -i -e "s/region = us-east-1/region = $region/g" /etc/awslogs/awscli.conf
 
 # Replace instance id.
-instanceId=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r .instanceId)
+instanceId=$(curl -s -H "X-aws-ec2-metadata-token: $token" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .instanceId)
 sed -i -e "s/{instanceId}/$instanceId/g" /etc/awslogs/awslogs.conf
 
 if grep -q ':2$' /etc/system-release-cpe  ; then

diff --git a/template/user-data.tpl b/template/user-data.tpl
@@ -10,6 +10,8 @@ tee /etc/hosts <<EOL
 127.0.0.1   localhost localhost.localdomain $(hostname)
 EOL
 
+token=$(curl -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
+
 ${eip}
 
 for i in {1..7}; do
-Original file line number
+Diff line change
@@ Expand Up / @@ -10,6 +10,8 @@ tee /etc/hosts <<EOL @@
 .0.0.1   localhost localhost.localdomain $(hostname)
     EOL
+    token=$(curl -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
     ${eip}
     for i in {1..7}; do
@@ Expand Down @@