address review feedback
This commit is contained in:
parent
ff78961206
commit
9634f8205a
|
|
@ -1921,8 +1921,8 @@ end}.
|
||||||
% AWS section
|
% AWS section
|
||||||
% ===============================
|
% ===============================
|
||||||
|
|
||||||
%% @doc Whether or not to prefer IMDSv2 when querying instance metadata service
|
%% @doc Whether or not to prefer EC2 IMDSv2 when querying instance metadata service.
|
||||||
%% If not set or set to true, IMDSv2 will be preferred to use first. If fails, IMDSv1 will be used.
|
%% If not set or set to true, EC2 IMDSv2 will be preferred to use first. If fails, IEC2 MDSv1 will be used.
|
||||||
%% See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html.
|
%% See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html.
|
||||||
|
|
||||||
{mapping, "aws.prefer_imdsv2", "rabbit.aws_prefer_imdsv2",
|
{mapping, "aws.prefer_imdsv2", "rabbit.aws_prefer_imdsv2",
|
||||||
|
|
|
||||||
|
|
@ -54,7 +54,7 @@ configuration or to impact configuration behavior:
|
||||||
``rabbitmq_aws:set_region/1`` | Manually specify the AWS region to make requests to.
|
``rabbitmq_aws:set_region/1`` | Manually specify the AWS region to make requests to.
|
||||||
``rabbitmq_aws:set_credentials/2`` | Manually specify the request credentials to use.
|
``rabbitmq_aws:set_credentials/2`` | Manually specify the request credentials to use.
|
||||||
``rabbitmq_aws:refresh_credentials/0`` | Refresh the credentials from the environment, filesystem, or EC2 Instance Metadata service.
|
``rabbitmq_aws:refresh_credentials/0`` | Refresh the credentials from the environment, filesystem, or EC2 Instance Metadata service.
|
||||||
``rabbitmq_aws:ensure_imdsv2_token_valid/0`` | Make sure IMDSv2 token is acctive and valid.
|
``rabbitmq_aws:ensure_imdsv2_token_valid/0`` | Make sure EC2 IMDSv2 token is active and valid.
|
||||||
``rabbitmq_aws:api_get_request/2`` | Perform an AWS service API request.
|
``rabbitmq_aws:api_get_request/2`` | Perform an AWS service API request.
|
||||||
``rabbitmq_aws:get/2`` | Perform a GET request to the API specifying the service and request path.
|
``rabbitmq_aws:get/2`` | Perform a GET request to the API specifying the service and request path.
|
||||||
``rabbitmq_aws:get/3`` | Perform a GET request specifying the service, path, and headers.
|
``rabbitmq_aws:get/3`` | Perform a GET request specifying the service, path, and headers.
|
||||||
|
|
|
||||||
|
|
@ -35,8 +35,10 @@
|
||||||
|
|
||||||
-define(METADATA_TOKEN_TLL_HEADER, "X-aws-ec2-metadata-token-ttl-seconds").
|
-define(METADATA_TOKEN_TLL_HEADER, "X-aws-ec2-metadata-token-ttl-seconds").
|
||||||
|
|
||||||
% AWS IMDSv2 is session-based and instance metadata service requests which are only needed for loading/refreshing credentials.
|
% EC2 Instance Metadata service version 2 (IMDSv2) uses session-oriented authentication.
|
||||||
% We dont need to have long-live metadata token. In fact, we only need the token is valid for a sufficient period to successfully
|
% Instance metadata service requests are only needed for loading/refreshing credentials.
|
||||||
|
% We dont need to have long-live metadata token.
|
||||||
|
% In fact, we only need the token is valid for a sufficient period to successfully
|
||||||
% load/refresh credentials. 60 seconds is more than enough for that goal.
|
% load/refresh credentials. 60 seconds is more than enough for that goal.
|
||||||
-define(METADATA_TOKEN_TLL_SECONDS, 60).
|
-define(METADATA_TOKEN_TLL_SECONDS, 60).
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -154,14 +154,14 @@ set_region(Region) ->
|
||||||
gen_server:call(rabbitmq_aws, {set_region, Region}).
|
gen_server:call(rabbitmq_aws, {set_region, Region}).
|
||||||
|
|
||||||
-spec set_imdsv2_token(imdsv2token()) -> ok.
|
-spec set_imdsv2_token(imdsv2token()) -> ok.
|
||||||
%% @doc Manually set the Imdsv2Token to perform instance metadata service requests.
|
%% @doc Manually set the Imdsv2Token used to perform instance metadata service requests.
|
||||||
%% @end
|
%% @end
|
||||||
set_imdsv2_token(Imdsv2Token) ->
|
set_imdsv2_token(Imdsv2Token) ->
|
||||||
gen_server:call(rabbitmq_aws, {set_imdsv2_token, Imdsv2Token}).
|
gen_server:call(rabbitmq_aws, {set_imdsv2_token, Imdsv2Token}).
|
||||||
|
|
||||||
|
|
||||||
-spec get_imdsv2_token() -> imdsv2token().
|
-spec get_imdsv2_token() -> imdsv2token().
|
||||||
%% @doc return the current Imdsv2Token to perform instance metadata service requests.
|
%% @doc return the current Imdsv2Token used to perform instance metadata service requests.
|
||||||
%% @end
|
%% @end
|
||||||
get_imdsv2_token() ->
|
get_imdsv2_token() ->
|
||||||
{ok, Imdsv2Token}=gen_server:call(rabbitmq_aws, get_imdsv2_token),
|
{ok, Imdsv2Token}=gen_server:call(rabbitmq_aws, get_imdsv2_token),
|
||||||
|
|
|
||||||
|
|
@ -426,14 +426,13 @@ instance_role_url() ->
|
||||||
instance_metadata_url(string:join([?INSTANCE_METADATA_BASE, ?INSTANCE_CREDENTIALS], "/")).
|
instance_metadata_url(string:join([?INSTANCE_METADATA_BASE, ?INSTANCE_CREDENTIALS], "/")).
|
||||||
|
|
||||||
-spec imdsv2_token_url() -> string().
|
-spec imdsv2_token_url() -> string().
|
||||||
%% @doc Return the URL for obtaining IMDSv2 token from the Instance Metadata service
|
%% @doc Return the URL for obtaining IMDSv2 token from the Instance Metadata service.
|
||||||
%% @end
|
%% @end
|
||||||
imdsv2_token_url() ->
|
imdsv2_token_url() ->
|
||||||
instance_metadata_url(?TOKEN_URL).
|
instance_metadata_url(?TOKEN_URL).
|
||||||
|
|
||||||
-spec instance_id_url() -> string().
|
-spec instance_id_url() -> string().
|
||||||
%% @doc Return the URL for querying the id of the current
|
%% @doc Return the URL for querying the id of the current instance from the Instance Metadata service.
|
||||||
%% instance from the Instance Metadata service.
|
|
||||||
%% @end
|
%% @end
|
||||||
instance_id_url() ->
|
instance_id_url() ->
|
||||||
instance_metadata_url(string:join([?INSTANCE_METADATA_BASE, ?INSTANCE_ID], "/")).
|
instance_metadata_url(string:join([?INSTANCE_METADATA_BASE, ?INSTANCE_ID], "/")).
|
||||||
|
|
@ -735,7 +734,7 @@ region_from_availability_zone(Value) ->
|
||||||
|
|
||||||
|
|
||||||
-spec load_imdsv2_token() -> security_token().
|
-spec load_imdsv2_token() -> security_token().
|
||||||
%% @doc Attempt to obtain IMDSv2 token.
|
%% @doc Attempt to obtain EC2 IMDSv2 token.
|
||||||
%% @end
|
%% @end
|
||||||
load_imdsv2_token() ->
|
load_imdsv2_token() ->
|
||||||
TokenUrl=imdsv2_token_url(),
|
TokenUrl=imdsv2_token_url(),
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue