aws / aws/aws-sdk-java-v2

Use Overridable `Ec2MetadataClient` for IMDS-backed Providers

Offen
#5,876 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
ec2-metadata-client feature-request p2
Vorherrschende Sprache
Java
Sterne
2.6k
Forks
1k
Ø Merge
2 T. 9 Std.
Gemergte PRs (30 T.)
51

Beschreibung

### Describe the feature

Make IMDS-backed providers accept an `Ec2MetadataClient` instance which respects [IMDS client](https://docs.aws.amazon.com/sdkref/latest/guide/feature-imds-client.html) configurations.

### Use Case

Various IMDS-backed providers like the `InstanceProfileRegionProvider` and `InstanceProfileCredentialsProvider` make IMDS requests using an `HttpURLConnection` via the SDK protected (`@SdkProtectedApi`) `software.amazon.awssdk.regions.util.HttpResourcesUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/util/HttpResourcesUtils.java)) class. This is instead of the public `Ec2MetadataClient` ([javadoc](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/imds/Ec2MetadataClient.html)).

In particular:

- `InstanceProfileRegionProvider`
- Uses the internal `software.amazon.awssdk.regions.internal.util.EC2MetadataUtils` ([def](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/regions/src/main/java/software/amazon/awssdk/regions/internal/util/EC2MetadataUtils.java)) class which uses the `HttpResourcesUtils` class.
- `InstanceProfileCredentialsProvider`
- Uses the `HttpResourcesUtils` class directly.
- __Hardcodes the IMDS token TTL to 21,600 seconds ([code](https://github.com/aws/aws-sdk-java-v2/blob/fbb1f40459daa698587913af85566583ec3e7a6a/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java#L75)).__

These may not respect certain IMDS client configurations (e.g. IMDS session token TTL) nor have features like IMDS session token caching + auto-refresh (some fetch a new token every time).

Switch to the `Ec2MetadataClient` to de-duplicate IMDS functionality.

### Proposed Solution

Add builders for all providers and have an `ec2MetataClient` function on the builder. For example:

```java
import software.amazon.awssdk.http.urlconnection.UrlConnectionHttpClient
import software.amazon.awssdk.imds.Ec2MetadataClient
import software.amazon.awssdk.auth.credentials.InstanceProfileCredentialsProvider;
import software.amazon.awssdk.regions.providers.InstanceProfileRegionProvider;

httpClient = UrlConnectionHttpClient.create();

ec2MetadataClient = Ec2MetadataClient
.builder();
.httpClient(httpClient);
.build();

credentialsProvider = InstanceProfileCredentialsProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();

regionProvider = InstanceProfileRegionProvider
.builder()
.ec2MetadataClient(ec2MetadataClient)
.build();
```

If the existing `InstanceProfile*Provider` providers shouldn't be refactored, create new `Ec2Metadata*Provider` classes instead and mark the `InstanceProfile*Provider` classes as deprecated.

### Other Information

Requires https://github.com/aws/aws-sdk-java-v2/issues/5764 to be fixed to reduce the likelihood of using stale IMDS session tokens.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS Java SDK version used

2.30.16

### JDK version used

All

### Operating System and version

All

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Beginne mit InstanceProfileRegionProvider und InstanceProfileCredentialsProvider. Lies anschließend core/regions/src/main/java/software/amazon/awssdk/regions/util/HttpResourcesUtils.java, core/regions/src/main/java/software/amazon/awssdk/regions/internal/util/EC2MetadataUtils.java und den referenzierten Code von InstanceProfileCredentialsProvider. Vergleiche deren IMDS-Anfragen mit der Ec2MetadataClient API und ermittle, wie Builder einen Client akzeptieren sollten; abgeschlossen ist die Aufgabe, wenn beide Provider den bereitgestellten Client verwenden und dessen Konfigurationen berücksichtigen, ohne das bestehende fest codierte Verhalten.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
aws, java
Bereich
cloud
Issue-Typ
Feature
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
32/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.