Skip to content

Commit 27fb954

Browse files
RohitJha-awsRohitJha-aws
authored
Update EC2 template to use IMDSv2 as IMDSv1 is deprecated (#274)
1 parent f6339fc commit 27fb954

5 files changed

Lines changed: 64 additions & 20 deletions

File tree

‎.bumpversion.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
[bumpversion]
2-
current_version = 3.5.2
2+
current_version = 3.5.3
33
commit = True
44
tag = False

‎.cfnlintrc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ ignore_templates:
99
ignore_checks:
1010
# Supress "This code may only work with `package` cli command as the property <xyz> is a string".
1111
- W3002
12+
# Suppress false positive where Ref on SecurityGroup incorrectly flagged as Name instead of ID
13+
- E1041

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ repos:
3030

3131
# CloudFormation
3232
- repo: https://github.com/aws-cloudformation/cfn-lint
33-
rev: v1.20.2
33+
rev: v1.37.2
3434
hooks:
3535
- id: cfn-lint-rc
3636
files: code/solutions/.*\.(ya?ml|template)$
@@ -55,20 +55,20 @@ repos:
5555

5656
# Python
5757
- repo: https://github.com/pycqa/pylint
58-
rev: v3.3.2
58+
rev: v3.3.7
5959
hooks:
6060
- id: pylint
6161
args:
6262
- --errors-only
6363
- --disable=E0401
6464

6565
- repo: https://github.com/psf/black
66-
rev: 24.10.0
66+
rev: 25.1.0
6767
hooks:
6868
- id: black
6969

7070
- repo: https://github.com/PyCQA/isort
71-
rev: 5.13.2
71+
rev: 6.0.1
7272
hooks:
7373
- id: isort
7474
args: ["--profile", "black"]

‎code/solutions/cross-stacks/ec2.yaml‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,23 +60,40 @@ Resources:
6060
<body>
6161
<center>
6262
<?php
63-
# Get the instance ID from meta-data and store it in the $instance_id variable
63+
# Get session token for IMDSv2
64+
$token_url = "http://169.254.169.254/latest/api/token";
65+
$context = stream_context_create([
66+
"http" => [
67+
"method" => "PUT",
68+
"header" => "X-aws-ec2-metadata-token-ttl-seconds: 21600"
69+
]
70+
]);
71+
$token = file_get_contents($token_url, false, $context);
72+
73+
# Create context with token for metadata requests
74+
$metadata_context = stream_context_create([
75+
"http" => [
76+
"header" => "X-aws-ec2-metadata-token: " . $token
77+
]
78+
]);
79+
80+
# Get the instance ID from meta-data
6481
$url = "http://169.254.169.254/latest/meta-data/instance-id";
65-
$instance_id = file_get_contents($url);
66-
# Get the instance's availability zone from metadata and store it in the $zone variable
82+
$instance_id = file_get_contents($url, false, $metadata_context);
83+
# Get the instance's availability zone from metadata
6784
$url = "http://169.254.169.254/latest/meta-data/placement/availability-zone";
68-
$zone = file_get_contents($url);
69-
# Get the instance AMI ID and store it in the $ami_id variable
85+
$zone = file_get_contents($url, false, $metadata_context);
86+
# Get the instance AMI ID
7087
$url = "http://169.254.169.254/latest/meta-data/ami-id";
71-
$ami_id = file_get_contents($url);
88+
$ami_id = file_get_contents($url, false, $metadata_context);
7289
?>
7390
<h2>EC2 Instance ID: <?php echo $instance_id ?></h2>
7491
<h2>Availability Zone: <?php echo $zone ?></h2>
7592
<h2>AMI ID: <?php echo $ami_id ?></h2>
7693
</center>
7794
</body>
7895
</html>
79-
mode: 000644
96+
mode: 644
8097
owner: apache
8198
group: apache
8299
/etc/cfn/cfn-hup.conf:
@@ -85,7 +102,7 @@ Resources:
85102
stack=${AWS::StackId}
86103
region=${AWS::Region}
87104
interval=1
88-
mode: 000400
105+
mode: 400
89106
owner: root
90107
group: root
91108
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
@@ -116,6 +133,10 @@ Resources:
116133
- InstanceType
117134
SecurityGroupIds:
118135
- !Ref WebServerSecurityGroup
136+
MetadataOptions:
137+
HttpTokens: required
138+
HttpPutResponseHopLimit: 1
139+
HttpEndpoint: enabled
119140
Tags:
120141
- Key: Name
121142
Value: !Join

‎code/workspace/cross-stacks/ec2.yaml‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -72,23 +72,40 @@ Resources:
7272
<body>
7373
<center>
7474
<?php
75-
# Get the instance ID from meta-data and store it in the $instance_id variable
75+
# Get session token for IMDSv2
76+
$token_url = "http://169.254.169.254/latest/api/token";
77+
$context = stream_context_create([
78+
"http" => [
79+
"method" => "PUT",
80+
"header" => "X-aws-ec2-metadata-token-ttl-seconds: 21600"
81+
]
82+
]);
83+
$token = file_get_contents($token_url, false, $context);
84+
85+
# Create context with token for metadata requests
86+
$metadata_context = stream_context_create([
87+
"http" => [
88+
"header" => "X-aws-ec2-metadata-token: " . $token
89+
]
90+
]);
91+
92+
# Get the instance ID from meta-data
7693
$url = "http://169.254.169.254/latest/meta-data/instance-id";
77-
$instance_id = file_get_contents($url);
78-
# Get the instance's availability zone from metadata and store it in the $zone variable
94+
$instance_id = file_get_contents($url, false, $metadata_context);
95+
# Get the instance's availability zone from metadata
7996
$url = "http://169.254.169.254/latest/meta-data/placement/availability-zone";
80-
$zone = file_get_contents($url);
81-
# Get the instance AMI ID and store it in the $ami_id variable
97+
$zone = file_get_contents($url, false, $metadata_context);
98+
# Get the instance AMI ID
8299
$url = "http://169.254.169.254/latest/meta-data/ami-id";
83-
$ami_id = file_get_contents($url);
100+
$ami_id = file_get_contents($url, false, $metadata_context);
84101
?>
85102
<h2>EC2 Instance ID: <?php echo $instance_id ?></h2>
86103
<h2>Availability Zone: <?php echo $zone ?></h2>
87104
<h2>AMI ID: <?php echo $ami_id ?></h2>
88105
</center>
89106
</body>
90107
</html>
91-
mode: 000644
108+
mode: 644
92109
owner: apache
93110
group: apache
94111
/etc/cfn/cfn-hup.conf:
@@ -125,6 +142,10 @@ Resources:
125142
InstanceType: !FindInMap [EnvironmentToInstanceType, !Ref EnvironmentType, InstanceType]
126143
SecurityGroupIds:
127144
- !Ref WebServerSecurityGroup
145+
MetadataOptions:
146+
HttpTokens: required
147+
HttpPutResponseHopLimit: 1
148+
HttpEndpoint: enabled
128149
Tags:
129150
- Key: Name
130151
Value: !Join [ ' ', [ !Ref EnvironmentType, Web Server ] ]

0 commit comments

Comments
 (0)