Use Overridable `Ec2MetadataClient` for IMDS-backed Providers
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 1k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 51
Description
### Describe the feature
Make IMDS-backed providers accept an `Ec2MetadataClient` instance which respects [IMDS client](https://docs.aws.amazon.com/sdkref/latest/guide/feature-imds-client.html) configurations.
### Use Case
Various IMDS-backed providers like the `InstanceProfileRegionProvider` and `InstanceProfileCredentialsProvider` make IMDS requests using an `HttpURLConnection` via the SDK protected (`@SdkProtectedApi`) `software.amazon.awssdk.regions.util.HttpResourcesUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/util/HttpResourcesUtils.java)) class. This is instead of the public `Ec2MetadataClient` ([javadoc](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/imds/Ec2MetadataClient.html)).
In particular:
- `InstanceProfileRegionProvider`
- Uses the internal `software.amazon.awssdk.regions.internal.util.EC2MetadataUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/internal/util/EC2MetadataUtils.java)) class which uses the `HttpResourcesUtils` class.
- `InstanceProfileCredentialsProvider`
- Uses the `HttpResourcesUtils` class directly.
- __Hardcodes the IMDS token TTL to 21,600 seconds ([code](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java#L75)).__
These may not respect certain IMDS client configurations (e.g. IMDS session token TTL) nor have features like IMDS session token caching + auto-refresh (some fetch a new token every time).
Switch to the `Ec2MetadataClient` to de-duplicate IMDS functionality.
### Proposed Solution
Add builders for all providers and have an `ec2MetataClient` function on the builder. For example:
```java
import software.amazon.awssdk.http.urlconnection.UrlConnectionHttpClient
import software.amazon.awssdk.imds.Ec2MetadataClient
import software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider;
import software.amazon.awssdk.regions.providers.InstanceProfileRegionProvider;
httpClient = UrlConnectionHttpClient.create();
ec2MetadataClient = Ec2MetadataClient
.builder();
.httpClient(httpClient);
.build();
credentialsProvider = InstanceProfileCredentialsProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();
regionProvider = InstanceProfileRegionProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();
```
If the existing `InstanceProfile*Provider` providers shouldn't be refactored, create new `Ec2Metadata*Provider` classes instead and mark the `InstanceProfile*Provider` classes as deprecated.
### Other Information
Requires https://github.com/aws/aws-sdk-java-v2/issues/5764 to be fixed to reduce the likelihood of using stale IMDS session tokens.
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS Java SDK version used
2.30.16
### JDK version used
All
### Operating System and version
All
Contributor guide
Assessment
This issue has not been assessed yet.