[ECS] Feature request: IMDSv2 support #670
Description
AWS announced support for IMDSv2 on November 19th here:
https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
You can launch an instance or update one after the fact to disallow the old metadata service, i.e. with:
aws ec2 modify-instance-metadata-options --instance-id <INSTANCE_ID> --http-token required --http-endpoint enabled
I've tried deploying this on my ecs-cluster and it causes the ecs-agent to fail to boot. I believe the fix should be as simple as updating the aws-sdk-go version - it's currently 1.25.19 and support for the new metadata service was added in 1.25.38:
https://github.com/aws/aws-sdk-go/releases/tag/v1.25.38
Supporting Log Snippets
With the v2 metadata api in enforce mode you'll see the following in ecs-init.log:
2019-12-27T22:45:29Z [INFO] Loading configuration
2019-12-27T22:45:29Z [INFO] Image excluded from cleanup: amazon/amazon-ecs-agent:latest
2019-12-27T22:45:29Z [INFO] Image excluded from cleanup: amazon/amazon-ecs-pause:0.1.0
2019-12-27T22:45:29Z [WARN] Unable to fetch user data: EC2MetadataError: failed to make EC2Metadata request caused by:
2019-12-27T22:45:29Z [CRITICAL] Unable to communicate with EC2 Metadata service to infer region: EC2MetadataRequestError: failed to get EC2 instance identity document
caused by: EC2MetadataError: failed to make EC2Metadata request
caused by: 2019-12-27T22:45:29Z [CRITICAL] Configuration key not set, key: AWSRegion
2019-12-27T22:45:29Z [CRITICAL] Error loading config: Multiple error:
0: Missing required fields: AWSRegion
Thanks!