Use IMDSv2 token flow in instance bootstrap scripts - #74656
Open
cat5inthecradle wants to merge 1 commit into
Open
Use IMDSv2 token flow in instance bootstrap scripts#74656cat5inthecradle wants to merge 1 commit into
cat5inthecradle wants to merge 1 commit into
Conversation
Update the remaining instance-metadata curl calls (frontend UserData, AMI-builder UserData, and the Chef bootstrap script used by daemon and console instances) to the session-token (IMDSv2) request pattern, matching what the AWS SDKs, Ohai, and our Drone config already use. No behavior change: token-authenticated requests work under either metadata service configuration. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the last few tokenless instance-metadata calls (
curl http://169.254.169.254/...) in our CloudFormation bootstrap scripts to the IMDSv2 session-token pattern — the same flow we already use elsewhere:.drone.yml#L34-L35— identical two-step curl (PUT for a token, GET with the token header), same 21600s TTLlib/cdo/aws/ec2.rb#L100-L106— our Ruby metadata client's token fetch, used byfetch_metadatafor every requestThe AWS SDKs and Ohai/Chef also negotiate the token flow automatically, so this just brings the remaining hand-rolled curls in line with AWS's current recommended request pattern ahead of standardizing our instance config on IMDSv2.
No behavior change: token-authenticated requests work under either metadata-service configuration.
Testing: templates ERB-compile cleanly; exercised on the next adhoc/stack update as part of normal instance bootstrap (script failure would surface as a failed CloudFormation resource signal).
🤖 Generated with Claude Code