Add support for version 2.1 of the IMDS credentials provider (#4109)
**DO NOT MERGE THIS PR UNTIL READY TO RELEASE** ## Description This PR adds support for version 2.1 of the IMDS credentials provider. With this update, if the underlying EC2 instance's IMDS supports it, the provider can now retrieve credentials that include an account ID. This account ID can then be used by [account-based endpoints](https://docs.aws.amazon.com/sdkref/latest/guide/feature-account-endpoints.html). To support this functionality, the credentials provider first attempts to access the extended API endpoint, which ends with `-extended` (e.g., `http://169.254.169.254/latest/meta-data/iam/security-credentials-extended`). If this endpoint returns a 404, the provider falls back to the legacy API endpoint—the same one used in the IMDS credentials provider v2.0. This "try extended API, then fall back to legacy API" pattern is applied to both retrieving the IMDS instance profile name and fetching credentials. Importantly: - Once the provider determines that a specific API version (extended or legacy) is supported, it will stick to that version. - Only the extended API can return credentials that include an account ID. The PR also made the following IMDS credentials providers options configurable: - `Disable IMDS credentials fetching` - `IMDS instance profile name` Both options can be configured via environment variables or a shared config file, with environment variables taking precedence over the config file. **Note:** Feature tracking for this functionality will be handled in a separate PR. ## Testing - Updated connection recordings in `aws-config/test-data/` to reflect changes in the execution flow within `.retrieve_credentials` (Note: This update is not intended to add new test coverage, but to align recordings with the updated flow.) - Added unit tests to verify the behavior of the extended API, including falling back to the legacy API when necessary. - Added unit tests to verify the configuration options for disabling IMDS credentials fetching and specifying the IMDS instance profile name. ## Checklist - [x] For changes to the AWS SDK, generated SDK code, or SDK runtime crates, I have created a changelog entry Markdown file in the `.changelog` directory, specifying "aws-sdk-rust" in the `applies_to` key. ---- _By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice._
Loading
Please register or sign in to comment