Ubuntu
resource-agents package

  1. Focal (20.04)
  2. Bug #1915203
  3. Comment #0

Comment 0 for bug 1915203

Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote : Backport AWS agent with IMDSv2 support

Last year, AWS released "IMDSv2" in an effort to protect customers against some potentially severe information leaks
related to accidentally proxying this local data to the network. Details
at https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/

IMDSv2 makes use of a session-based protocol, requiring clients to first retrieve a time-limited session token, and then to include that token with subsequent requests.

Because the intended purpose of IMDSv2 is to provide an additional layer of defense against network abuses, customers utilizing it may choose to disable IMDSv1. Disabling IMDSv2 today causes fence_aws to fail.