Upgrade fog-aws to at least v3.6.4 to support IMDSv2
Summary
Installing Gitlab on EC2 and disabling IMDSv1 will cause fog-aws to not return the proper credentials.
Steps to reproduce
- Install gitlab as normal on an EC2 instance with IMDSv1 and IMDSv2 enabled.
- Link object storage to an S3 bucket
gitlab_rails['backup_upload_connection'] = {
'provider' => 'AWS',
'region' => 'us-east-1',
'use_iam_profile' => true
}
- Disable IMDSv1 by requiring IMDSv2
- uploads/backups and any other AWS backed feature that uses
use_iam_profile
will fail with 401 errors
What is the current bug behavior?
Gitlab (or fog-aws) is unable to utilize the IMDSv2 API
What is the expected correct behavior?
Gitlab (and fog-aws) should retrieve the proper iam profile using the v2 API and fall back to the v1 if v2 is not found or is unavailable
Possible fixes
fog-aws v3.5.2 (The version gitlab currently seems to be using) does not support IMDSv2. Support for IMDSv2 was added in fog-aws v3.6.4. The recommendation is upgrading fog-aws to at least v3.6.4 in order to leverage the new IMDSv2 service.
Edited by James Pinckney