No logs/eip with runner_instance_metadata_options_http_tokens set to required

[gerbenoostra]

The current logging & EIP setup in the user_data call the metadata service without tokens, which fails when tokens are set to be required.

If the variable runner_instance_metadata_options_http_tokens is set to "required", the Instance Metadata Service is set to Version 2 (IDMSv2) instead of v1 (IDMSv1).
With runner_instance_metadata_options_http_endpoint = "disabled", the Instance Medadata Service is disabled.

The current logging.tpl uses the IDMSv1 endpoint to retrieve the region and the instance.

Without IDMS this will fail, thus logging can't be setup.

WIth IDMSv2 (when http_options is set to required, but also allowed for optional) these lines should (probably) change to

TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
sed -i -e "s/region = us-east-1/region = $region/g" /etc/awslogs/awscli.conf

instanceId=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .instanceId)
sed -i -e "s/{instanceId}/$instanceId/g" /etc/awslogs/awslogs.conf

I'll see if I find some time to open a merge request, otherwise, maybe just a note in the variable section would suffice.

[kayman-mk]

IDMSv2 would be nice. There are many issues shown on SecurityHub.

Also check #445

[semantic-releaser]

🎉 This issue has been resolved in version 5.0.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀