Unable to SSH into AWS EC2 instance with instance metadata turned off

user_1181919 0
Viewed 237

I am not able to SSH into a EC2 instance if it is launched with the instance metadata service is turned off.

ec2.runInstances({ ... MetadataOptions: {
  HttpEndpoint: 'disabled'..
})

This however is not an issue if I launch with the MetadataOptions enabled and disable it with a modify-instance-metadata-options call after the instance has finished starting up. Is this documented behaviour? I couldn't find it explicitly mentioned in the documentation anywhere.

Note - this is not a security group, Network ACL, etc issue.

amazon-web-services amazon-ec2
1 Answers

I noticed this too. It seems that disabling IMDS breaks all of the following:

  • SSH access is broken; the authorized_keys file for the default user (ie root or ubuntu) is not populated because the EC2 Key Pair is normally provided in instance metadata.
  • Cloud-init/Cloud-config (aka "userdata") do not run. The user data is normally made available at http://instance-data.:8773 but this is unavailable when IMDS is disabled.

Therefore, if your desire is to disable IMDS from the moment of launch, it seems the only viable workaround is to create your own AMI that has your own configuration (ie. SSH authorized_keys) backed into it. Packer is commonly used for building AMIs in this way.

An alternate approach would be to give the EC2 instance profile permission to call ModifyInstanceMetadataOptions conditionally scoped the instance can only affect itself, then call aws ec2 modify-instance-metadata-options --http-endpoint disabled at the end of the setup script. Once an instance locks itself out this way, it cannot unlock itself because it'll no longer have access to STS tokens via the IMDS endpoint.

Nic_Waller_1902980
Related