wip: enforce IMDSv2

Signed-off-by: Damien Duportal <damien.duportal@gmail.com>
jenkins-infra · Dec 19, 2024 · c5a99f1 · c5a99f1
1 parent 8e3ccb4
commit c5a99f1
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/sources.pkr.hcl b/sources.pkr.hcl
@@ -15,7 +15,14 @@ source "amazon-ebs" "base" {
     volume_type           = "gp3"
   }
 
-  imds_support = "v2.0" # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
+  # Enforce IMDS v2 as per https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
+  imds_support = "v2.0"
+  metadata_options {
+    http_endpoint = "enabled"
+    http_tokens = "required"
+    http_put_response_hop_limit = 1 # Do not allow access to IMDS through NAT-ed containers
+    instance_metadata_tags = "disabled"
+  }
 
   # Where to export the AMI
   ami_regions = [