In November 2019, AWS launched IMDSv2 (Instance Meta-Data Store version 2 - see https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ ) which provides "belt and suspenders" protections for four types of vulnerabilities that could be used to try to access the Instance Meta-Data Store available to EC2 instances. In that announcement, AWS recommended adopting IMDSv2 and restricting access to IMDSv2 only for added security. This can be done at instance launch time, or (more recently in October 2022) by providing a flag when registering an AMI to indicate that the AMI should by default launch with IMDSv1 disabled, and thus require IMDSv2.
By enabling this flag for Fedora, we provide a better security posture for Fedora users running in EC2.
When an AMI is registered for IMDSv2 it is still possible to launch instances with IMDSv1 enabled by providing the right option to the RunInstances EC2 API call. The flag merely switches the default.
Owners, do not implement this work until the FESCo vote has explicitly ended. The Fedora Program Manager will create a tracking bug in Bugzilla for this Change, which is your indication to proceed. See the FESCo ticket policy and the Changes policy for more information.
REMINDER: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the devel list thread linked above.
So here if this requires replacing the current fedimg service with a newer/better one, change should note that work.
Otherwise, +1
+1
cloud-init has had support for this for quite some time, so this should be noticeable by very security-conscious users and unnoticeable by most other people. :wink:
As with https://pagure.io/fesco/issue/2974, thank you for working on this and for writing it up clearly.
After a week, the vote is
APPROVED (+4,0,-0)
Metadata Update from @bcotton: - Issue tagged with: pending announcement
announced.
Metadata Update from @kevin: - Issue close_status updated to: Accepted - Issue status updated to: Closed (was: Open)
Log in to comment on this ticket.