Skip to content

Commit f242a55

Browse files
gdavisongdavison
committed
Removes boolean SkipEC2MetadataApiCheck in favour of new tri-state EC2MetadataServiceEnableState parameter
1 parent ad7ee72 commit f242a55

File tree

5 files changed

+177
-12
lines changed

5 files changed

+177
-12
lines changed

‎aws_config.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {
173173
config.WithRegion(c.Region),
174174
config.WithHTTPClient(httpClient),
175175
config.WithAPIOptions(apiOptions),
176+
config.WithEC2IMDSClientEnableState(c.EC2MetadataServiceEnableState),
176177
}
177178

178179
if !c.SuppressDebugLog {
@@ -232,12 +233,10 @@ func commonLoadOptions(c *Config) ([]func(*config.LoadOptions) error, error) {
232233
)
233234
}
234235

235-
if c.SkipEC2MetadataApiCheck {
236-
loadOptions = append(loadOptions,
237-
config.WithEC2IMDSClientEnableState(imds.ClientDisabled),
238-
)
239-
240-
// This should not be needed, but https://github.com/aws/aws-sdk-go-v2/issues/1398
236+
// This should not be needed, but https://github.com/aws/aws-sdk-go-v2/issues/1398
237+
if c.EC2MetadataServiceEnableState == imds.ClientEnabled {
238+
os.Setenv("AWS_EC2_METADATA_DISABLED", "false")
239+
} else if c.EC2MetadataServiceEnableState == imds.ClientDisabled {
241240
os.Setenv("AWS_EC2_METADATA_DISABLED", "true")
242241
}
243242

‎aws_config_test.go‎

Lines changed: 131 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -804,14 +804,19 @@ source_profile = SourceSharedCredentials
804804
},
805805
{
806806
Config: &Config{
807-
Region: "us-east-1",
808-
SkipEC2MetadataApiCheck: true,
807+
Region: "us-east-1",
808+
EC2MetadataServiceEnableState: imds.ClientDisabled,
809809
},
810810
Description: "skip EC2 Metadata API check",
811811
ExpectedError: func(err error) bool {
812812
return IsNoValidCredentialSourcesError(err)
813813
},
814814
ExpectedRegion: "us-east-1",
815+
// The IMDS server must be enabled so that auth will succeed if the IMDS is called
816+
EnableEc2MetadataServer: true,
817+
MockStsEndpoints: []*servicemocks.MockEndpoint{
818+
servicemocks.MockStsGetCallerIdentityValidEndpoint,
819+
},
815820
},
816821
{
817822
Config: &Config{
@@ -1803,6 +1808,130 @@ use_fips_endpoint = true
18031808
}
18041809
}
18051810

1811+
func TestEC2MetadataServiceClientEnableState(t *testing.T) {
1812+
testCases := map[string]struct {
1813+
Config *Config
1814+
EnvironmentVariables map[string]string
1815+
SharedConfigurationFile string
1816+
ExpectedEC2MetadataServiceClientEnableState imds.ClientEnableState
1817+
}{
1818+
"no configuration": {
1819+
Config: &Config{
1820+
AccessKey: servicemocks.MockStaticAccessKey,
1821+
SecretKey: servicemocks.MockStaticSecretKey,
1822+
},
1823+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDefaultEnableState,
1824+
},
1825+
1826+
"config enabled": {
1827+
Config: &Config{
1828+
AccessKey: servicemocks.MockStaticAccessKey,
1829+
SecretKey: servicemocks.MockStaticSecretKey,
1830+
EC2MetadataServiceEnableState: imds.ClientEnabled,
1831+
},
1832+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1833+
},
1834+
"config disabled": {
1835+
Config: &Config{
1836+
AccessKey: servicemocks.MockStaticAccessKey,
1837+
SecretKey: servicemocks.MockStaticSecretKey,
1838+
EC2MetadataServiceEnableState: imds.ClientDisabled,
1839+
},
1840+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1841+
},
1842+
1843+
"envvar true": {
1844+
Config: &Config{
1845+
AccessKey: servicemocks.MockStaticAccessKey,
1846+
SecretKey: servicemocks.MockStaticSecretKey,
1847+
},
1848+
EnvironmentVariables: map[string]string{
1849+
"AWS_EC2_METADATA_DISABLED": "true",
1850+
},
1851+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1852+
},
1853+
"envvar false": {
1854+
Config: &Config{
1855+
AccessKey: servicemocks.MockStaticAccessKey,
1856+
SecretKey: servicemocks.MockStaticSecretKey,
1857+
},
1858+
EnvironmentVariables: map[string]string{
1859+
"AWS_EC2_METADATA_DISABLED": "false",
1860+
},
1861+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1862+
},
1863+
1864+
"config enabled envvar true": {
1865+
Config: &Config{
1866+
AccessKey: servicemocks.MockStaticAccessKey,
1867+
SecretKey: servicemocks.MockStaticSecretKey,
1868+
EC2MetadataServiceEnableState: imds.ClientEnabled,
1869+
},
1870+
EnvironmentVariables: map[string]string{
1871+
"AWS_EC2_METADATA_DISABLED": "true",
1872+
},
1873+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientEnabled,
1874+
},
1875+
"config disabled envvar false": {
1876+
Config: &Config{
1877+
AccessKey: servicemocks.MockStaticAccessKey,
1878+
SecretKey: servicemocks.MockStaticSecretKey,
1879+
EC2MetadataServiceEnableState: imds.ClientDisabled,
1880+
},
1881+
EnvironmentVariables: map[string]string{
1882+
"AWS_EC2_METADATA_DISABLED": "false",
1883+
},
1884+
ExpectedEC2MetadataServiceClientEnableState: imds.ClientDisabled,
1885+
},
1886+
}
1887+
1888+
for testName, testCase := range testCases {
1889+
testCase := testCase
1890+
1891+
t.Run(testName, func(t *testing.T) {
1892+
oldEnv := servicemocks.InitSessionTestEnv()
1893+
defer servicemocks.PopEnv(oldEnv)
1894+
1895+
for k, v := range testCase.EnvironmentVariables {
1896+
os.Setenv(k, v)
1897+
}
1898+
1899+
if testCase.SharedConfigurationFile != "" {
1900+
file, err := ioutil.TempFile("", "aws-sdk-go-base-shared-configuration-file")
1901+
1902+
if err != nil {
1903+
t.Fatalf("unexpected error creating temporary shared configuration file: %s", err)
1904+
}
1905+
1906+
defer os.Remove(file.Name())
1907+
1908+
err = ioutil.WriteFile(file.Name(), []byte(testCase.SharedConfigurationFile), 0600)
1909+
1910+
if err != nil {
1911+
t.Fatalf("unexpected error writing shared configuration file: %s", err)
1912+
}
1913+
1914+
testCase.Config.SharedConfigFiles = []string{file.Name()}
1915+
}
1916+
1917+
testCase.Config.SkipCredsValidation = true
1918+
1919+
awsConfig, err := GetAwsConfig(context.Background(), testCase.Config)
1920+
if err != nil {
1921+
t.Fatalf("error in GetAwsConfig() '%[1]T': %[1]s", err)
1922+
}
1923+
1924+
ec2MetadataServiceClientEnableState, _, err := awsconfig.ResolveEC2IMDSClientEnableState(awsConfig.ConfigSources)
1925+
if err != nil {
1926+
t.Fatalf("error in ResolveEC2IMDSClientEnableState: %s", err)
1927+
}
1928+
if a, e := ec2MetadataServiceClientEnableState, testCase.ExpectedEC2MetadataServiceClientEnableState; a != e {
1929+
t.Errorf("expected EC2MetadataServiceClientEnableState %q, got: %q", awsconfig.EC2IMDSClientEnableStateString(e), awsconfig.EC2IMDSClientEnableStateString(a))
1930+
}
1931+
})
1932+
}
1933+
}
1934+
18061935
func TestEC2MetadataServiceEndpoint(t *testing.T) {
18071936
testCases := map[string]struct {
18081937
Config *Config

‎internal/awsconfig/resolvers.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,36 @@ func DualStackEndpointStateString(state aws.DualStackEndpointState) string {
6868
return fmt.Sprintf("unknown aws.FIPSEndpointStateUnset (%d)", state)
6969
}
7070

71+
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
72+
type EC2IMDSClientEnableStateResolver interface {
73+
GetEC2IMDSClientEnableState() (imds.ClientEnableState, bool, error)
74+
}
75+
76+
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
77+
func ResolveEC2IMDSClientEnableState(sources []interface{}) (value imds.ClientEnableState, found bool, err error) {
78+
for _, source := range sources {
79+
if resolver, ok := source.(EC2IMDSClientEnableStateResolver); ok {
80+
value, found, err = resolver.GetEC2IMDSClientEnableState()
81+
if err != nil || found {
82+
return value, found, err
83+
}
84+
}
85+
}
86+
return value, found, err
87+
}
88+
89+
func EC2IMDSClientEnableStateString(state imds.ClientEnableState) string {
90+
switch state {
91+
case imds.ClientDefaultEnableState:
92+
return "ClientDefaultEnableState"
93+
case imds.ClientDisabled:
94+
return "ClientDisabled"
95+
case imds.ClientEnabled:
96+
return "ClientEnabled"
97+
}
98+
return fmt.Sprintf("unknown imds.ClientEnableState (%d)", state)
99+
}
100+
71101
// Copied and renamed from https://github.com/aws/aws-sdk-go-v2/blob/main/feature/ec2/imds/internal/config/resolvers.go
72102
type EC2IMDSEndpointResolver interface {
73103
GetEC2IMDSEndpoint() (value string, found bool, err error)

‎internal/config/config.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"os"
77
"time"
88

9+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
910
"github.com/hashicorp/aws-sdk-go-base/v2/internal/expand"
1011
)
1112

@@ -16,6 +17,7 @@ type Config struct {
1617
CallerDocumentationURL string
1718
CallerName string
1819
CustomCABundle string
20+
EC2MetadataServiceEnableState imds.ClientEnableState
1921
EC2MetadataServiceEndpoint string
2022
EC2MetadataServiceEndpointMode string
2123
HTTPProxy string
@@ -28,7 +30,6 @@ type Config struct {
2830
SharedCredentialsFiles []string
2931
SharedConfigFiles []string
3032
SkipCredsValidation bool
31-
SkipEC2MetadataApiCheck bool
3233
SkipRequestingAccountId bool
3334
StsEndpoint string
3435
StsRegion string

‎v2/awsv1shim/session_test.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515

1616
retryv2 "github.com/aws/aws-sdk-go-v2/aws/retry"
1717
configv2 "github.com/aws/aws-sdk-go-v2/config"
18+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
1819
"github.com/aws/aws-sdk-go/aws"
1920
"github.com/aws/aws-sdk-go/aws/awserr"
2021
"github.com/aws/aws-sdk-go/aws/client"
@@ -849,14 +850,19 @@ region = us-east-1
849850
},
850851
{
851852
Config: &awsbase.Config{
852-
Region: "us-east-1",
853-
SkipEC2MetadataApiCheck: true,
853+
Region: "us-east-1",
854+
EC2MetadataServiceEnableState: imds.ClientDisabled,
854855
},
855-
Description: "skip EC2 metadata API check",
856+
Description: "skip EC2 Metadata API check",
856857
ExpectedError: func(err error) bool {
857858
return awsbase.IsNoValidCredentialSourcesError(err)
858859
},
859860
ExpectedRegion: "us-east-1",
861+
// The IMDS server must be enabled so that auth will succeed if the IMDS is called
862+
EnableEc2MetadataServer: true,
863+
MockStsEndpoints: []*servicemocks.MockEndpoint{
864+
servicemocks.MockStsGetCallerIdentityValidEndpoint,
865+
},
860866
},
861867
{
862868
Config: &awsbase.Config{

0 commit comments

Comments
 (0)