aws / aws/aws-sdk-java-v2

Use Overridable `Ec2MetadataClient` for IMDS-backed Providers

Open
#5,876 1 comment 0 reactions 0 assignees View on GitHub
ec2-metadata-client feature-request p2
Dominant language
Java
Stars
2.6k
Forks
1k
Avg merge
2d 9h
Merged PRs (30d)
51

Description

### Describe the feature

Make IMDS-backed providers accept an `Ec2MetadataClient` instance which respects [IMDS client](https://docs.aws.amazon.com/sdkref/latest/guide/feature-imds-client.html) configurations.

### Use Case

Various IMDS-backed providers like the `InstanceProfileRegionProvider` and `InstanceProfileCredentialsProvider` make IMDS requests using an `HttpURLConnection` via the SDK protected (`@SdkProtectedApi`) `software.amazon.awssdk.regions.util.HttpResourcesUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/util/HttpResourcesUtils.java)) class. This is instead of the public `Ec2MetadataClient` ([javadoc](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/imds/Ec2MetadataClient.html)).

In particular:

- `InstanceProfileRegionProvider`
- Uses the internal `software.amazon.awssdk.regions.internal.util.EC2MetadataUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/internal/util/EC2MetadataUtils.java)) class which uses the `HttpResourcesUtils` class.
- `InstanceProfileCredentialsProvider`
- Uses the `HttpResourcesUtils` class directly.
- __Hardcodes the IMDS token TTL to 21,600 seconds ([code](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java#L75)).__

These may not respect certain IMDS client configurations (e.g. IMDS session token TTL) nor have features like IMDS session token caching + auto-refresh (some fetch a new token every time).

Switch to the `Ec2MetadataClient` to de-duplicate IMDS functionality.

### Proposed Solution

Add builders for all providers and have an `ec2MetataClient` function on the builder. For example:

```java
import software.amazon.awssdk.http.urlconnection.UrlConnectionHttpClient
import software.amazon.awssdk.imds.Ec2MetadataClient
import software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider;
import software.amazon.awssdk.regions.providers.InstanceProfileRegionProvider;

httpClient = UrlConnectionHttpClient.create();

ec2MetadataClient = Ec2MetadataClient
.builder();
.httpClient(httpClient);
.build();

credentialsProvider = InstanceProfileCredentialsProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();

regionProvider = InstanceProfileRegionProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();
```

If the existing `InstanceProfile*Provider` providers shouldn't be refactored, create new `Ec2Metadata*Provider` classes instead and mark the `InstanceProfile*Provider` classes as deprecated.

### Other Information

Requires https://github.com/aws/aws-sdk-java-v2/issues/5764 to be fixed to reduce the likelihood of using stale IMDS session tokens.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS Java SDK version used

2.30.16

### JDK version used

All

### Operating System and version

All

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.