Merge pull request #41733 from hashicorp/security-terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional

Fix `terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional` security findings

Author: ewbankkit

examples/count/main.tf

@@ -46,6 +46,11 @@ resource "aws_instance" "web" {
   instance_type = "t2.small"
   ami           = data.aws_ami.ubuntu.id
 
+  # Force IMDSv2.
+  metadata_options {
+    http_tokens = "required"
+  }
+
   # This will create 4 instances
   count = 4
 }

examples/eip/main.tf

@@ -67,7 +67,12 @@ resource "aws_instance" "web" {
   # this should be on port 80
   user_data = file("userdata.sh")
 
-  #Instance tags
+  # Force IMDSv2.
+  metadata_options {
+    http_tokens = "required"
+  }
+
+  # Instance tags.
   tags = {
     Name = "eip-example"
   }

examples/elb/main.tf

@@ -172,7 +172,12 @@ resource "aws_instance" "web" {
   subnet_id              = aws_subnet.tf_test_subnet.id
   user_data              = file("userdata.sh")
 
-  #Instance tags
+  # Force IMDSv2.
+  metadata_options {
+    http_tokens = "required"
+  }
+
+  # Instance tags
 
   tags = {
     Name = "elb-example"

examples/two-tier/main.tf

@@ -136,6 +136,11 @@ resource "aws_instance" "web" {
   # backend instances.
   subnet_id = aws_subnet.default.id
 
+  # Force IMDSv2.
+  metadata_options {
+    http_tokens = "required"
+  }
+
   # We run a remote provisioner on the instance after creating it.
   # In this case, we just install nginx and start it. By default,
   # this should be on port 80

internal/service/ec2/testdata/Instance/data.tags/main_gen.tf

@@ -10,6 +10,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/Instance/data.tags_defaults/main_gen.tf

@@ -16,6 +16,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/Instance/data.tags_ignore/main_gen.tf

@@ -19,6 +19,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/Instance/tags/main_gen.tf

@@ -5,6 +5,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/Instance/tagsComputed1/main_gen.tf

@@ -7,6 +7,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = {
     (var.unknownTagKey) = null_resource.test.id
   }

internal/service/ec2/testdata/Instance/tagsComputed2/main_gen.tf

@@ -7,6 +7,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = {
     (var.unknownTagKey) = null_resource.test.id
     (var.knownTagKey)   = var.knownTagValue

internal/service/ec2/testdata/Instance/tags_defaults/main_gen.tf

@@ -11,6 +11,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/Instance/tags_ignore/main_gen.tf

@@ -14,6 +14,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
   tags = var.resource_tags
 }
 

internal/service/ec2/testdata/tmpl/ec2_instance_tags.gtpl

@@ -2,6 +2,10 @@ resource "aws_instance" "test" {
   ami           = data.aws_ami.amzn2-ami-minimal-hvm-ebs-arm64.id
   instance_type = "t4g.nano"
 
+  metadata_options {
+    http_tokens = "required"
+  }
+
 {{- template "tags" . }}
 }