aquasecurity / aquasecurity/cloudsploit
Support for IMDS
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
To avoid managing or storing access/secret keys, please add support for IMDSv1 and v2. This would avoid something like this to get IMDSv2 to work properly with CloudSploit:
```
TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && CREDS=$(curl -sH "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/MY-AWESOME_ROLE) && AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.AccessKeyId') AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.SecretAccessKey') AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.Token') ./index.js
```
Contributor guide
Research direction
Start at the ./index.js entry point and trace how CloudSploit currently receives AWS credentials. Compare the requested IMDSv1 and IMDSv2 flows in the issue, including token retrieval and role credentials. Done means the tool can obtain credentials from instance metadata without manually managing access or secret keys.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100