fix(mmds): Set token TTL header in response to PUT /latest/api/token #5328
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zulinx86
force-pushed
the
mmds_ttl_header_in_response
branch
from
06d768b to
dfa0951
Compare
zulinx86
changed the title
EC2 IMDS sets X-Aws-Ec2-Metadata-Token-Ttl-Seconds header in the response to PUT /latest/api/token, while MMDS didn't. AWS SDK for Go tries to parse it as integer (i.e. tries to parse an empty string "" as integer) [1]. [1]: https://github.com/aws/aws-sdk-go-v2/blob/7a614d9fcccd492af3b87aa43c7c203cb636804e/feature/ec2/imds/api_op_GetToken.go#L82-L85 Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
To get more details in case of test failures, enable debug logging. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
That is a leftover installed when I tried to use AWS CLI at first for the credential provider integration test. Let's keep the rootfs as small as possible. Fixes: 1fef547 ("test: Check AWS SDK credential provider work with MMDS") Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
Since the binaries are compiled in prepare_and_build_rootfs(), delete them there for unity. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
It is no longer used in the function. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
zulinx86
force-pushed
the
mmds_ttl_header_in_response
branch
from
dfa0951 to
945b2af
Compare
zulinx86
requested review from
xmarcalx,
kalyazin,
pb8o and
Manciukic
as code owners
zulinx86
changed the title
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #5328 +/- ##
==========================================
+ Coverage 82.98% 83.03% +0.05%
==========================================
Files 250 250
Lines 26828 26837 +9
==========================================
+ Hits 22262 22285 +23
+ Misses 4566 4552 -14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
zulinx86
force-pushed
the
mmds_ttl_header_in_response
branch
from
945b2af to
2a1a47e
Compare
zulinx86
added
the
Status: Awaiting review
roypat
previously approved these changes
Jul 25, 2025
To test AWS SDK for Go, we will build Go projects and put the binaries to the guest rootfs. Note that the Go lang and AWS SDK for Go are not put to the guest rootfs. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
* Only pass source path to compile_and_install * Remove unneeded output directory creation Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
compile_and_install() expects a Go project to end with ".go" to distinguish from C sources and places the compiled binary with a name without ".go". Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
It will be compiled as part of CI artifacts build and the built binary will be placed in guest rootfs. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
Add a regression test that ensures the token TTL header is set in the MMDS response to "PUT /latest/api/token". AWS SDK for Go tries to parse the header even if the header is not included (i.e. treat as an empty string if not exist). Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
When a custom endpoint is configured, AWS SDK for Go sets "Accept: application/json" in request, although not set Accept header by default. This will be used in an integration test to be added in the next commit. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
AWS SDK for Go sets "Accept: application" in a request to retrieve AWS credentials. If imds_compat is true, it should work. If false, it should NOT work, because MMDS responds a string of a JSON object containing the credentials (i.e. wrapped with doulequotes) with "Content-Type: application/json" but AWS SDK for Go expects only the inner JSON object. Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
zulinx86
force-pushed
the
mmds_ttl_header_in_response
branch
from
2a1a47e to
24404fb
Compare
roypat
approved these changes
Jul 25, 2025
Manciukic
reviewed
Jul 25, 2025
resources/overlay/usr/local/bin/go_sdk_cred_provider_with_custom_endpoint.go/main.go
Show resolved
Hide resolved
Manciukic
approved these changes
Jul 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
imds_compatflag is true.Reason
EC2 IMDS sets X-Aws-Ec2-Metadata-Token-Ttl-Seconds header in the
response to PUT /latest/api/token, while MMDS didn't. AWS SDK for Go
tries to parse it as integer (i.e. tries to parse an empty string "" as
integer) 4.
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
tools/devtool checkbuild --allto verify that the PR passesbuild checks on all supported architectures.
tools/devtool checkstyleto verify that the PR passes theautomated style checks.
how they are solving the problem in a clear and encompassing way.
in the PR.
CHANGELOG.md.[ ] If a specific issue led to this PR, this PR closes the issue.Runbook for Firecracker API changes.
integration tests.
[ ] I have linked an issue to every newTODO.rust-vmm.