Skip to content

Commit e78a322

Browse files
gdavisongdavison
authored
Merge pull request #240 from hashicorp/skip-metadata-check
Removes boolean `SkipEC2MetadataApiCheck` in favour of new tri-state `EC2MetadataServiceEnableState`
2 parents e9e5371 + f242a55 commit e78a322

File tree

5 files changed

+177
-12
lines changed

5 files changed

+177
-12
lines changed

‎aws_config.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {
173173
config.WithRegion(c.Region),
174174
config.WithHTTPClient(httpClient),
175175
config.WithAPIOptions(apiOptions),
176+
config.WithEC2IMDSClientEnableState(c.EC2MetadataServiceEnableState),
176177
}
177178

178179
if !c.SuppressDebugLog {
@@ -232,12 +233,10 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {
232233
)
233234
}
234235

235-
if c.SkipEC2MetadataApiCheck {
236-
loadOptions = append(loadOptions,
237-
config.WithEC2IMDSClientEnableState(imds.ClientDisabled),
238-
)
239-
240-
// This should not be needed, but https://github.com/aws/aws-sdk-go-v2/issues/1398
236+
// This should not be needed, but https://github.com/aws/aws-sdk-go-v2/issues/1398
237+
if c.EC2MetadataServiceEnableState == imds.ClientEnabled {
238+
os.Setenv("AWS_EC2_METADATA_DISABLED", "false")
239+
} else if c.EC2MetadataServiceEnableState == imds.ClientDisabled {
241240
os.Setenv("AWS_EC2_METADATA_DISABLED", "true")
242241
}
243242

‎aws_config_test.go‎

Lines changed: 131 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -841,14 +841,19 @@ source_profile = SourceSharedCredentials
841841
},
842842
{
843843
Config: &Config{
844-
Region: "us-east-1",
845-
SkipEC2MetadataApiCheck: true,
844+
Region: "us-east-1",
845+
EC2MetadataServiceEnableState: imds.ClientDisabled,
846846
},
847847
Description: "skip EC2 Metadata API check",
848848
ExpectedError: func(err error) bool {
849849
return IsNoValidCredentialSourcesError(err)
850850
},
851851
ExpectedRegion: "us-east-1",
852+
// The IMDS server must be enabled so that auth will succeed if the IMDS is called
853+
EnableEc2MetadataServer: true,
854+
MockStsEndpoints: []*servicemocks.MockEndpoint{
855+
servicemocks.MockStsGetCallerIdentityValidEndpoint,
856+
},
852857
},
853858
{
854859
Config: &Config{
@@ -1847,6 +1852,130 @@ use_fips_endpoint = true
18471852
}
18481853
}
18491854

1855+
func TestEC2MetadataServiceClientEnableState(t *testing.T) {
1856+
testCases := map[string]struct {
1857+
Config *Config
1858+
EnvironmentVariables map[string]string
1859+
SharedConfigurationFile string
1860+
ExpectedEC2MetadataServiceClientEnableState imds.ClientEnableState
1861+
}{
1862+
"no configuration": {
1863+
Config: &Config{
1864+
AccessKey: servicemocks.MockStaticAccessKey,
1865+
SecretKey: servicemocks.MockStaticSecretKey,
1866+
},
1867+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDefaultEnableState,
1868+
},
1869+
1870+
"config enabled": {
1871+
Config: &Config{
1872+
AccessKey: servicemocks.MockStaticAccessKey,
1873+
SecretKey: servicemocks.MockStaticSecretKey,
1874+
EC2MetadataServiceEnableState: imds.ClientEnabled,
1875+
},
1876+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1877+
},
1878+
"config disabled": {
1879+
Config: &Config{
1880+
AccessKey: servicemocks.MockStaticAccessKey,
1881+
SecretKey: servicemocks.MockStaticSecretKey,
1882+
EC2MetadataServiceEnableState: imds.ClientDisabled,
1883+
},
1884+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1885+
},
1886+
1887+
"envvar true": {
1888+
Config: &Config{
1889+
AccessKey: servicemocks.MockStaticAccessKey,
1890+
SecretKey: servicemocks.MockStaticSecretKey,
1891+
},
1892+
EnvironmentVariables: map[string]string{
1893+
"AWS_EC2_METADATA_DISABLED": "true",
1894+
},
1895+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1896+
},
1897+
"envvar false": {
1898+
Config: &Config{
1899+
AccessKey: servicemocks.MockStaticAccessKey,
1900+
SecretKey: servicemocks.MockStaticSecretKey,
1901+
},
1902+
EnvironmentVariables: map[string]string{
1903+
"AWS_EC2_METADATA_DISABLED": "false",
1904+
},
1905+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1906+
},
1907+
1908+
"config enabled envvar true": {
1909+
Config: &Config{
1910+
AccessKey: servicemocks.MockStaticAccessKey,
1911+
SecretKey: servicemocks.MockStaticSecretKey,
1912+
EC2MetadataServiceEnableState: imds.ClientEnabled,
1913+
},
1914+
EnvironmentVariables: map[string]string{
1915+
"AWS_EC2_METADATA_DISABLED": "true",
1916+
},
1917+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1918+
},
1919+
"config disabled envvar false": {
1920+
Config: &Config{
1921+
AccessKey: servicemocks.MockStaticAccessKey,
1922+
SecretKey: servicemocks.MockStaticSecretKey,
1923+
EC2MetadataServiceEnableState: imds.ClientDisabled,
1924+
},
1925+
EnvironmentVariables: map[string]string{
1926+
"AWS_EC2_METADATA_DISABLED": "false",
1927+
},
1928+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1929+
},
1930+
}
1931+
1932+
for testName, testCase := range testCases {
1933+
testCase := testCase
1934+
1935+
t.Run(testName, func(t *testing.T) {
1936+
oldEnv := servicemocks.InitSessionTestEnv()
1937+
defer servicemocks.PopEnv(oldEnv)
1938+
1939+
for k, v := range testCase.EnvironmentVariables {
1940+
os.Setenv(k, v)
1941+
}
1942+
1943+
if testCase.SharedConfigurationFile != "" {
1944+
file, err := ioutil.TempFile("", "aws-sdk-go-base-shared-configuration-file")
1945+
1946+
if err != nil {
1947+
t.Fatalf("unexpected error creating temporary shared configuration file: %s", err)
1948+
}
1949+
1950+
defer os.Remove(file.Name())
1951+
1952+
err = ioutil.WriteFile(file.Name(), []byte(testCase.SharedConfigurationFile), 0600)
1953+
1954+
if err != nil {
1955+
t.Fatalf("unexpected error writing shared configuration file: %s", err)
1956+
}
1957+
1958+
testCase.Config.SharedConfigFiles = []string{file.Name()}
1959+
}
1960+
1961+
testCase.Config.SkipCredsValidation = true
1962+
1963+
awsConfig, err := GetAwsConfig(context.Background(), testCase.Config)
1964+
if err != nil {
1965+
t.Fatalf("error in GetAwsConfig() '%[1]T': %[1]s", err)
1966+
}
1967+
1968+
ec2MetadataServiceClientEnableState, _, err := awsconfig.ResolveEC2IMDSClientEnableState(awsConfig.ConfigSources)
1969+
if err != nil {
1970+
t.Fatalf("error in ResolveEC2IMDSClientEnableState: %s", err)
1971+
}
1972+
if a, e := ec2MetadataServiceClientEnableState, testCase.ExpectedEC2MetadataServiceClientEnableState; a != e {
1973+
t.Errorf("expected EC2MetadataServiceClientEnableState %q, got: %q", awsconfig.EC2IMDSClientEnableStateString(e), awsconfig.EC2IMDSClientEnableStateString(a))
1974+
}
1975+
})
1976+
}
1977+
}
1978+
18501979
func TestEC2MetadataServiceEndpoint(t *testing.T) {
18511980
testCases := map[string]struct {
18521981
Config *Config

‎internal/awsconfig/resolvers.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,36 @@ func DualStackEndpointStateString(state aws.DualStackEndpointState) string {
6868
return fmt.Sprintf("unknown aws.FIPSEndpointStateUnset (%d)", state)
6969
}
7070

71+
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
72+
type EC2IMDSClientEnableStateResolver interface {
73+
GetEC2IMDSClientEnableState() (imds.ClientEnableState, bool, error)
74+
}
75+
76+
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
77+
func ResolveEC2IMDSClientEnableState(sources []interface{}) (value imds.ClientEnableState, found bool, err error) {
78+
for _, source := range sources {
79+
if resolver, ok := source.(EC2IMDSClientEnableStateResolver); ok {
80+
value, found, err = resolver.GetEC2IMDSClientEnableState()
81+
if err != nil || found {
82+
return value, found, err
83+
}
84+
}
85+
}
86+
return value, found, err
87+
}
88+
89+
func EC2IMDSClientEnableStateString(state imds.ClientEnableState) string {
90+
switch state {
91+
case imds.ClientDefaultEnableState:
92+
return "ClientDefaultEnableState"
93+
case imds.ClientDisabled:
94+
return "ClientDisabled"
95+
case imds.ClientEnabled:
96+
return "ClientEnabled"
97+
}
98+
return fmt.Sprintf("unknown imds.ClientEnableState (%d)", state)
99+
}
100+
71101
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
72102
type EC2IMDSEndpointResolver interface {
73103
GetEC2IMDSEndpoint() (value string, found bool, err error)

‎internal/config/config.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"os"
77
"time"
88

9+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
910
"github.com/hashicorp/aws-sdk-go-base/v2/internal/expand"
1011
)
1112

@@ -17,6 +18,7 @@ type Config struct {
1718
CallerDocumentationURL string
1819
CallerName string
1920
CustomCABundle string
21+
EC2MetadataServiceEnableState imds.ClientEnableState
2022
EC2MetadataServiceEndpoint string
2123
EC2MetadataServiceEndpointMode string
2224
HTTPProxy string
@@ -29,7 +31,6 @@ type Config struct {
2931
SharedCredentialsFiles []string
3032
SharedConfigFiles []string
3133
SkipCredsValidation bool
32-
SkipEC2MetadataApiCheck bool
3334
SkipRequestingAccountId bool
3435
StsEndpoint string
3536
StsRegion string

‎v2/awsv1shim/session_test.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515

1616
retryv2 "github.com/aws/aws-sdk-go-v2/aws/retry"
1717
configv2 "github.com/aws/aws-sdk-go-v2/config"
18+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
1819
"github.com/aws/aws-sdk-go/aws"
1920
"github.com/aws/aws-sdk-go/aws/awserr"
2021
"github.com/aws/aws-sdk-go/aws/client"
@@ -886,14 +887,19 @@ region = us-east-1
886887
},
887888
{
888889
Config: &awsbase.Config{
889-
Region: "us-east-1",
890-
SkipEC2MetadataApiCheck: true,
890+
Region: "us-east-1",
891+
EC2MetadataServiceEnableState: imds.ClientDisabled,
891892
},
892-
Description: "skip EC2 metadata API check",
893+
Description: "skip EC2 Metadata API check",
893894
ExpectedError: func(err error) bool {
894895
return awsbase.IsNoValidCredentialSourcesError(err)
895896
},
896897
ExpectedRegion: "us-east-1",
898+
// The IMDS server must be enabled so that auth will succeed if the IMDS is called
899+
EnableEc2MetadataServer: true,
900+
MockStsEndpoints: []*servicemocks.MockEndpoint{
901+
servicemocks.MockStsGetCallerIdentityValidEndpoint,
902+
},
897903
},
898904
{
899905
Config: &awsbase.Config{

0 commit comments

Comments
 (0)