pyrox.dev
1metaDir=/etc/ec2-metadata
2mkdir -m 0755 -p "$metaDir"
3rm -f "$metaDir/*"
4
5get_imds_token() {
6 # retry-delay of 1 selected to give the system a second to get going,
7 # but not add a lot to the bootup time
8 curl \
9 --silent \
10 --show-error \
11 --retry 3 \
12 --retry-delay 1 \
13 --fail \
14 -X PUT \
15 --connect-timeout 1 \
16 -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
17 http://169.254.169.254/latest/api/token
18}
19
20preflight_imds_token() {
21 # retry-delay of 1 selected to give the system a second to get going,
22 # but not add a lot to the bootup time
23 curl \
24 --silent \
25 --show-error \
26 --retry 3 \
27 --retry-delay 1 \
28 --fail \
29 --connect-timeout 1 \
30 -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
31 -o /dev/null \
32 http://169.254.169.254/1.0/meta-data/instance-id
33}
34
35try=1
36while [ $try -le 3 ]; do
37 echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
38 IMDS_TOKEN=$(get_imds_token) && break
39 try=$((try + 1))
40 sleep 1
41done
42
43if [ "x$IMDS_TOKEN" == "x" ]; then
44 echo "failed to fetch an IMDS2v token."
45fi
46
47try=1
48while [ $try -le 10 ]; do
49 echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
50 preflight_imds_token && break
51 try=$((try + 1))
52 sleep 1
53done
54
55echo "getting EC2 instance metadata..."
56
57get_imds() {
58 # --fail to avoid populating missing files with 404 HTML response body
59 # || true to allow the script to continue even when encountering a 404
60 curl --silent --show-error --fail --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@" || true
61}
62
63get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
64(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
65get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
66get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key