Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New Feature Request] Security vulnerability - EC2 instances should use instance Metadata Service Version 2 (IMDSv2) for ROSA HCP #158

Open
maulik-modi22 opened this issue Nov 26, 2024 · 1 comment

Comments

@maulik-modi22
Copy link

maulik-modi22 commented Nov 26, 2024

Which service is this feature request for?
Red Hat OpenShift Service on AWS HCP

What are you trying to do?
As Amazon Security hub recommends - EC2 instances should use Instance Metadata Service Version 2 (IMDSv2), When I tried to create ROSA HCP cluster with
--ec2-metadata-http-tokens required, it resulted in an error showing --ec2-metadata-http-tokens is not available for ROSA HCP
ec2-metadata-http-tokens

Note that Amazon EKS supports IMDSV2 from 2020 and reasoning behind IMDSV2 support here - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

Describe the solution you'd like
Refer this screenshot showing all EC2 instances created with IMDSV2 - Optional. IMDSV2, we want to see Required

Describe alternatives you've considered
None available

Additional context
Amazon Security has documented https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/

@maulik-modi22
Copy link
Author

@wgordon17, Can you please arrange to assign this to appropriate team member?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant