[GH-ISSUE #1445] Support AWS IMDSv2 for role credentials #757

New issue

Closed

opened 2026-03-04 01:48:31 +03:00 by kerem · 5 comments

kerem commented

2026-03-04 01:48:31 +03:00

Owner

Originally created by @nmeyerhans on GitHub (Oct 9, 2020).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/1445

As described in AWS blog posts and documentation, the IMDSv2 is a revision of the EC2 instance metadata service that provides security benefits over the original metadata service.

The addition of IMDSv2 support to the ec2metadata command might serve as a useful example to illustrate the API changes. In the case of s3fs, if support for IMDS-compatible services outside of Amazon EC2 is desired, it may be necessary to fall back to IMDSv1 support in the event that the token API returns a 404. Alternatively, it might be reasonable to ask the user to explicitly choose to enable IMDSv2 support if it's desired.

Originally created by @nmeyerhans on GitHub (Oct 9, 2020). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/1445 As described in AWS [blog posts](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/) and [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html), the IMDSv2 is a revision of the EC2 instance metadata service that provides security benefits over the original metadata service. The [addition of IMDSv2 support to the ec2metadata command](https://github.com/canonical/cloud-utils/pull/1/commits/991719ef079222ce844b27e7ceecee176308aecf) might serve as a useful example to illustrate the API changes. In the case of s3fs, if support for IMDS-compatible services outside of Amazon EC2 is desired, it may be necessary to fall back to IMDSv1 support in the event that the token API returns a 404. Alternatively, it might be reasonable to ask the user to explicitly choose to enable IMDSv2 support if it's desired.

kerem

2026-03-04 01:48:31 +03:00

closed this issue
added the
enhancement

help wanted
labels

kerem commented

2026-03-04 01:48:32 +03:00

Author

Owner

@gaul commented on GitHub (Oct 10, 2020):

@nmeyerhans This seems straightforward to implement; would you like to submit a pull request?

@gaul commented on GitHub (Oct 10, 2020): @nmeyerhans This seems straightforward to implement; would you like to submit a pull request?

kerem commented

2026-03-04 01:48:32 +03:00

Author

Owner

@nmeyerhans commented on GitHub (Oct 10, 2020):

I have not started on the implementation, but I don't mind doing so. I'll try to get a PR to you in the next few days.

@nmeyerhans commented on GitHub (Oct 10, 2020): I have not started on the implementation, but I don't mind doing so. I'll try to get a PR to you in the next few days.

kerem commented

2026-03-04 01:48:33 +03:00

Author

Owner

@gaul commented on GitHub (Sep 2, 2021):

@nmeyerhans Could you look at https://stackoverflow.com/questions/69031023/how-to-make-s3fs-use-imds-v2-when-mounting-s3-buckets-from-ec2-instance ?

@gaul commented on GitHub (Sep 2, 2021): @nmeyerhans Could you look at https://stackoverflow.com/questions/69031023/how-to-make-s3fs-use-imds-v2-when-mounting-s3-buckets-from-ec2-instance ?

kerem commented

2026-03-04 01:48:33 +03:00

Author

Owner

@erka commented on GitHub (Sep 2, 2021):

@gaul it isn't fully supported. There is an issue with getting the ec2 role from metadata automatic. It is called without token and failed.

@erka commented on GitHub (Sep 2, 2021): @gaul it isn't fully supported. There is an issue with getting the ec2 role from metadata automatic. It is called without token and failed.

kerem commented

2026-03-04 01:48:33 +03:00

Author

Owner

@nmeyerhans commented on GitHub (Sep 2, 2021):

@gaul I've posted an update on that stackoverflow post. It appears that S3fsCurl::LoadIAMRoleFromMetaData() was never updated to include tokens, so iam_role=auto doesn't work if tokens are required. Explicitly specifying a role name should work.

I can prepare a PR to fix S3fsCurl::LoadIAMRoleFromMetaData()

@nmeyerhans commented on GitHub (Sep 2, 2021): @gaul I've posted an update on that stackoverflow post. It appears that `S3fsCurl::LoadIAMRoleFromMetaData()` was never updated to include tokens, so `iam_role=auto` doesn't work if tokens are required. Explicitly specifying a role name should work. I can prepare a PR to fix `S3fsCurl::LoadIAMRoleFromMetaData()`