{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/543","repository_url":"https://api.github.com/repos/aws/aws-sdk-go","labels_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/543/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/543/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/543/events","html_url":"https://github.com/aws/aws-sdk-go/issues/543","id":131959059,"number":543,"title":"Ensure that metadata API is actually listening at given endpoint","user":{"login":"radeksimko","id":287584,"avatar_url":"https://avatars.githubusercontent.com/u/287584?v=3","gravatar_id":"","url":"https://api.github.com/users/radeksimko","html_url":"https://github.com/radeksimko","followers_url":"https://api.github.com/users/radeksimko/followers","following_url":"https://api.github.com/users/radeksimko/following{/other_user}","gists_url":"https://api.github.com/users/radeksimko/gists{/gist_id}","starred_url":"https://api.github.com/users/radeksimko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radeksimko/subscriptions","organizations_url":"https://api.github.com/users/radeksimko/orgs","repos_url":"https://api.github.com/users/radeksimko/repos","events_url":"https://api.github.com/users/radeksimko/events{/privacy}","received_events_url":"https://api.github.com/users/radeksimko/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aws/aws-sdk-go/labels/Feature%20Request","name":"Feature Request","color":"bfe5bf"},{"url":"https://api.github.com/repos/aws/aws-sdk-go/labels/Feedback%20Requested","name":"Feedback Requested","color":"d4c5f9"}],"state":"open","locked":false,"assignee":{"login":"jasdel","id":961963,"avatar_url":"https://avatars.githubusercontent.com/u/961963?v=3","gravatar_id":"","url":"https://api.github.com/users/jasdel","html_url":"https://github.com/jasdel","followers_url":"https://api.github.com/users/jasdel/followers","following_url":"https://api.github.com/users/jasdel/following{/other_user}","gists_url":"https://api.github.com/users/jasdel/gists{/gist_id}","starred_url":"https://api.github.com/users/jasdel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasdel/subscriptions","organizations_url":"https://api.github.com/users/jasdel/orgs","repos_url":"https://api.github.com/users/jasdel/repos","events_url":"https://api.github.com/users/jasdel/events{/privacy}","received_events_url":"https://api.github.com/users/jasdel/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-02-07T11:09:27Z","updated_at":"2016-02-09T22:48:55Z","closed_at":null,"body":"We've been using [custom EC2-env detection](https://github.com/hashicorp/terraform/blob/b7582fa6d9338f2499bb0a6b24a66ae0011d1ab3/builtin/providers/aws/config.go#L367-L375) in Terraform for a while, I think mostly because of the inconveniently long timeout in non-EC2 environments. It is now possible to set the timeout though, so I'm trying to clean up the auth logic and leverage most of the SDK logic where possible.\r\n\r\nIt seems SDK doesn't really check what is listening at `http://169.254.169.254:80` (or any other given endpoint) and just blindly believes that it's always metadata API (or metadata API-compatible endpoint). We had [a simple check in place](https://github.com/hashicorp/terraform/blob/b7582fa6d9338f2499bb0a6b24a66ae0011d1ab3/builtin/providers/aws/config.go#L381-L386) which I [intend to remove](https://github.com/hashicorp/terraform/pull/5030) as I'm making SDK responsible for these things.\r\n\r\n```go\r\nfunc responseContainsEC2Header(resp *http.Response) bool {\r\n\treturn resp.Header[\"Server\"] != nil && strings.Contains(resp.Header[\"Server\"][0], \"EC2\")\r\n}\r\n```\r\nWould there be interest in adding such checks into SDK?\r\n\r\nbtw. It's not intended to be security check as it's trivial to bypass such check (and we want to keep it that way to allow mocking the webserver for tests), it is rather to avoid strange issues where something completely irrelevant happens to be listening on that IP/port."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/comments/182118129","html_url":"https://github.com/aws/aws-sdk-go/issues/543#issuecomment-182118129","issue_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/543","id":182118129,"user":{"login":"radeksimko","id":287584,"avatar_url":"https://avatars.githubusercontent.com/u/287584?v=3","gravatar_id":"","url":"https://api.github.com/users/radeksimko","html_url":"https://github.com/radeksimko","followers_url":"https://api.github.com/users/radeksimko/followers","following_url":"https://api.github.com/users/radeksimko/following{/other_user}","gists_url":"https://api.github.com/users/radeksimko/gists{/gist_id}","starred_url":"https://api.github.com/users/radeksimko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radeksimko/subscriptions","organizations_url":"https://api.github.com/users/radeksimko/orgs","repos_url":"https://api.github.com/users/radeksimko/repos","events_url":"https://api.github.com/users/radeksimko/events{/privacy}","received_events_url":"https://api.github.com/users/radeksimko/received_events","type":"User","site_admin":false},"created_at":"2016-02-09T22:48:55Z","updated_at":"2016-02-09T22:48:55Z","body":"I think this was more of a check for non-EC2 environments. We can (almost 100%?) safely assume that this IP address will always point to the metadata API on running EC2 instances unless I (as the VPC/subnet architect) decide to choose this CIDR or happen to peer with VPC which uses that CIDR or use Direct Connect to connect to a network which happens to use this CIDR. Maybe even then I'd expect the AWS API to warn me and/or still try to route the traffic to the metadata API.\r\n\r\nHowever there's no way we can make _any_ assumptions about networks of users which are connecting to AWS using other methods (env variables, shared creds file, hard-coded creds). For any reason those auth methods may fail and it will eventually fall through to EC2Role provider. `169.254.0.0/16` is APIPA range which means that pretty much any machine may eventually assign such address itself according to [RFC3927](http://tools.ietf.org/html/rfc3927) if it lost connection to the gateway.\r\n\r\nIn our context (Terraform), many ops/devs runs the tool directly from their laptops and they change the network very often, which also increases the chance for being part of `169.254.0.0/16` CIDR.\r\n\r\n> I ask because adding this might prevent users from running local proxy's caches in front of ec2metadata service.\r\n\r\nI may be naive, but shouldn't such proxy also be proxying HTTP headers too?\r\n\r\nI may be also misinterpreting @catsby's intentions (it was originally his idea) - want to add any comments or further explanations here, Clint?"}}