Skip to content
This repository was archived by the owner on Mar 6, 2026. It is now read-only.

fix: removes content-header from AWS IMDS get request #1934

Merged
chalmerlowe merged 5 commits into from
Jan 14, 2026
Merged

fix: removes content-header from AWS IMDS get request #1934

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7e1049e
fix: removes content-header-from-aws-get
chalmerlowe Jan 13, 2026
008685c
updates assertions to removed expectation of content-header
chalmerlowe Jan 13, 2026
077fd25
fix: correct header initialization to avoid TypeError
chalmerlowe Jan 13, 2026
2139fd3
fix: update test expectations after removing Content-Type header
chalmerlowe Jan 13, 2026
7a9cdd0
updates linting
chalmerlowe Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion google/auth/aws.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,7 +530,7 @@ def _get_metadata_security_credentials(
google.auth.exceptions.RefreshError: If an error occurs while
retrieving the AWS security credentials.
"""
headers = {"Content-Type": "application/json"}
headers = None
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The change on this line initializes headers to None. However, if imdsv2_session_token is not None, the subsequent line (line 535) attempts to add an item to headers using headers["X-aws-ec2-metadata-token"] = imdsv2_session_token. This will result in a TypeError because NoneType objects do not support item assignment. To prevent this critical runtime error, headers should be initialized to an empty dictionary ({}) if it is intended to be mutable and potentially hold headers. While the PR description mentions initializing to None to match _get_metadata_role_name, the implementation pattern in _get_metadata_role_name involves reassigning headers to a dictionary, not modifying a None object.

headers = {}

if imdsv2_session_token is not None:
headers["X-aws-ec2-metadata-token"] = imdsv2_session_token

Expand Down
Loading