Skip to content

Upgrade fog-aws to at least v3.6.4 to support IMDSv2

Summary

Installing Gitlab on EC2 and disabling IMDSv1 will cause fog-aws to not return the proper credentials.

Steps to reproduce

  • Install gitlab as normal on an EC2 instance with IMDSv1 and IMDSv2 enabled.
  • Link object storage to an S3 bucket
gitlab_rails['backup_upload_connection'] = {
 'provider' => 'AWS',
 'region' => 'us-east-1',
 'use_iam_profile' => true
}
  • Disable IMDSv1 by requiring IMDSv2
  • uploads/backups and any other AWS backed feature that uses use_iam_profile will fail with 401 errors

What is the current bug behavior?

Gitlab (or fog-aws) is unable to utilize the IMDSv2 API

What is the expected correct behavior?

Gitlab (and fog-aws) should retrieve the proper iam profile using the v2 API and fall back to the v1 if v2 is not found or is unavailable

Possible fixes

fog-aws v3.5.2 (The version gitlab currently seems to be using) does not support IMDSv2. Support for IMDSv2 was added in fog-aws v3.6.4. The recommendation is upgrading fog-aws to at least v3.6.4 in order to leverage the new IMDSv2 service.

Edited by James Pinckney