This is an automated email from the ASF dual-hosted git repository.
eladkal pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 5d84b59554 Update EC2 and EMR system tests to use IMDSv2 (#29003)
5d84b59554 is described below
commit 5d84b59554c93fd22e92b46a1061b40b899a8dec
Author: Niko Oliveira <[email protected]>
AuthorDate: Wed Jan 18 00:54:28 2023 -0800
Update EC2 and EMR system tests to use IMDSv2 (#29003)
The IMDSv2 metadata protocol is more secure than v1
---
tests/system/providers/amazon/aws/example_ec2.py | 3 +++
tests/system/providers/amazon/aws/example_emr.py | 6 ++++++
2 files changed, 9 insertions(+)
diff --git a/tests/system/providers/amazon/aws/example_ec2.py
b/tests/system/providers/amazon/aws/example_ec2.py
index c14544806e..e8b7955d1c 100644
--- a/tests/system/providers/amazon/aws/example_ec2.py
+++ b/tests/system/providers/amazon/aws/example_ec2.py
@@ -74,6 +74,9 @@ def create_instance(instance_name: str, key_pair_id: str):
InstanceType="t2.micro",
KeyName=key_pair_id,
TagSpecifications=[{"ResourceType": "instance", "Tags": [{"Key":
"Name", "Value": instance_name}]}],
+ # Use IMDSv2 for greater security, see the following doc for more
details:
+ #
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
+ MetadataOptions={"HttpEndpoint": "enabled", "HttpTokens": "required"},
)["Instances"][0]["InstanceId"]
# Wait for it to exist
diff --git a/tests/system/providers/amazon/aws/example_emr.py
b/tests/system/providers/amazon/aws/example_emr.py
index 40cbd112ce..f1d8665f32 100644
--- a/tests/system/providers/amazon/aws/example_emr.py
+++ b/tests/system/providers/amazon/aws/example_emr.py
@@ -46,6 +46,12 @@ SECURITY_CONFIGURATION = {
"EnableApplicationScopedIAMRole": True,
},
},
+ # Use IMDSv2 for greater security, see the following doc for more details:
+ #
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-create-security-configuration.html
+ "InstanceMetadataServiceConfiguration": {
+ "MinimumInstanceMetadataServiceVersion": 2,
+ "HttpPutResponseHopLimit": 2,
+ },
}
# [START howto_operator_emr_steps_config]
