Update EC2 and EMR system tests to use IMDSv2 (apache#29003)

The IMDSv2 metadata protocol is more secure than v1
Jorricks · Jan 18, 2023 · 5d84b59 · 5d84b59
1 parent eaf5675
commit 5d84b59
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/tests/system/providers/amazon/aws/example_ec2.py b/tests/system/providers/amazon/aws/example_ec2.py
@@ -74,6 +74,9 @@ def create_instance(instance_name: str, key_pair_id: str):
         InstanceType="t2.micro",
         KeyName=key_pair_id,
         TagSpecifications=[{"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": instance_name}]}],
+        # Use IMDSv2 for greater security, see the following doc for more details:
+        # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
+        MetadataOptions={"HttpEndpoint": "enabled", "HttpTokens": "required"},
     )["Instances"][0]["InstanceId"]
 
     # Wait for it to exist

diff --git a/tests/system/providers/amazon/aws/example_emr.py b/tests/system/providers/amazon/aws/example_emr.py
@@ -46,6 +46,12 @@
             "EnableApplicationScopedIAMRole": True,
         },
     },
+    # Use IMDSv2 for greater security, see the following doc for more details:
+    # https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-create-security-configuration.html
+    "InstanceMetadataServiceConfiguration": {
+        "MinimumInstanceMetadataServiceVersion": 2,
+        "HttpPutResponseHopLimit": 2,
+    },
 }
 
 # [START howto_operator_emr_steps_config]