Aws-sdk-js: AWS.MetadataService.request does not support IMDSv2 out of the box

Created on 17 Dec 2020 · 3Comments · Source: aws/aws-sdk-js

Describe the bug
When an EC2 instance is configured to only allow IMDSv2, the AWS.MetadataService.request() doesn't work. The returned error null is not helpful. The workaround is to manually get a IMDS token and pass it to AWS.MetadataService.request(). The Java SDK handles this transparent to the developer which seems the better approach.

Is the issue in the browser/Node.js?
Node.js

If on Node.js, are you running this on AWS Lambda?
no

Details of the browser/Node.js version
v12.20.0

SDK version number
2.792.0 (but master branch has the issues as well)

To Reproduce (observed behavior)

const AWS = require('aws-sdk');
const meta = new AWS.MetadataService();
meta.request('/latest/meta-data/local-ipv4', function (err, data) {
    if (err) {
        throw err;
    }
    else {
        console.log(data);
    }
});

throws

Error: null
    at IncomingMessage.<anonymous> (/etc/home/ec2-user/app/src/node_modules/aws-sdk/lib/util.js:899:34)
    at IncomingMessage.emit (events.js:326:22)
    at IncomingMessage.EventEmitter.emit (domain.js:483:12)
    at endReadableNT (_stream_readable.js:1241:12)
    at processTicksAndRejections (internal/process/task_queues.js:84:21) {
  statusCode: 401,
  retryable: false,
  time: 2020-12-17T13:59:03.709Z
}

Expected behavior
return 10.0.32.49

Work around

const AWS = require('aws-sdk');
const meta = new AWS.MetadataService();
meta.fetchMetadataToken(function(err, token) {
    if (err) {
        throw err;
    } else {
        meta.request('/latest/meta-data/local-ipv4', {
            headers: {'x-aws-ec2-metadata-token': token}
        }, function (err, data) {
            if (err) {
                throw err;
            }
            else {
                console.log(data);
            }
        });
    }
});

bug needs-triage

Source

michaelwittig

All 3 comments

Hey @michaelwittig thanks for opening this, I agree with you, the SDK is configured to try IMDSv2 for first and then fall back to IMDSv1 if it fails, so if EC2 instance is configured to only allow IMDSv2, it will fail, the error here is not helpful at all but I think it should fail.

The version 3 of the SDK, provides with better error and is modular, can you give it a try?

The version 3.x of the AWS SDK for JavaScript is generally available. For more information see the Developer Guide or API Reference.