aws-sdk-core 2.0.0 → 2.11.632

data/lib/aws-sdk-core/errors.rb

@@ -14,10 +14,14 @@ module Aws
       # @param [Seahorse::Client::RequestContext] context
       # @param [String] message
       def initialize(context, message)
+        @code = self.class.code
         @context = context
         super(message)
       end
 
+      # @return [String]
+      attr_reader :code
+
       # @return [Seahorse::Client::RequestContext] The context of the request
       #   that triggered the remote service to return this error.
       attr_reader :context
@@ -30,6 +34,15 @@ module Aws
       end
     end
 
+    # Raised when InstanceProfileCredentialsProvider or
+    # EcsCredentialsProvider fails to parse the metadata response after retries
+    class MetadataParserError < RuntimeError
+      def initialize(*args)
+        msg = "Failed to parse metadata service response."
+        super(msg)
+      end
+    end
+
     # Various plugins perform client-side checksums of responses.
     # This error indicates a checksum failed.
     class ChecksumError < RuntimeError; end
@@ -38,12 +51,91 @@ module Aws
     # credentials profile does not exist.
     class NoSuchProfileError < RuntimeError; end
 
+    # Raised when a {Service} is constructed, where Assume Role credentials are
+    # expected, and there is no source profile specified.
+    class NoSourceProfileError < RuntimeError; end
+
     # Raised when a {Service} is constructed and credentials are not
     # set, or the set credentials are empty.
     class MissingCredentialsError < RuntimeError; end
 
     # Raised when a {Service} is constructed and region is not specified.
-    class MissingRegionError < RuntimeError; end
+    class MissingRegionError < ArgumentError; end
+
+    # Rasied when endpoint discovery failed for operations
+    # that requires endpoints from endpoint discovery
+    class EndpointDiscoveryError < RuntimeError
+      def initialize(*args)
+        msg = 'Endpoint discovery failed for the operation or discovered endpoint is not working, '\
+          'request will keep failing until endpoint discovery succeeds or :endpoint option is provided.'
+        super(msg)
+      end
+    end
+
+    # raised when hostLabel member is not provided
+    # at operation input when endpoint trait is available
+    # with 'hostPrefix' requirement
+    class MissingEndpointHostLabelValue < RuntimeError
+
+      def initialize(name)
+        msg = "Missing required parameter #{name} to construct"\
+          " endpoint host prefix. You can disable host prefix by"\
+          " setting :disable_host_prefix_injection to `true`."
+        super(msg)
+      end
+
+    end
+
+    # Raised when attempting to connect to an endpoint and a `SocketError`
+    # is received from the HTTP client. This error is typically the result
+    # of configuring an invalid `:region`.
+    class NoSuchEndpointError < RuntimeError
+
+      def initialize(options = {})
+        @context = options[:context]
+        @endpoint = @context.http_request.endpoint
+        @original_error = options[:original_error]
+        super(<<-MSG)
+Encountered a `SocketError` while attempting to connect to:
+
+  #{endpoint.to_s}
+
+This is typically the result of an invalid `:region` option or a
+poorly formatted `:endpoint` option.
+
+* Avoid configuring the `:endpoint` option directly. Endpoints are constructed
+  from the `:region`. The `:endpoint` option is reserved for connecting to
+  non-standard test endpoints.
+
+* Not every service is available in every region.
+
+* Never suffix region names with availability zones.
+  Use "us-east-1", not "us-east-1a"
+
+Known AWS regions include (not specific to this service):
+
+#{possible_regions}
+        MSG
+      end
+
+      attr_reader :context
+
+      attr_reader :endpoint
+
+      attr_reader :original_error
+
+      private
+
+      def possible_regions
+        Aws.partitions.inject([]) do |region_names, partition|
+          partition.regions.each do |region|
+            region_names << region.name
+          end
+          region_names
+        end.join("\n")
+      end
+
+    end
 
     # This module is mixed into another module, providing dynamic
     # error classes.  Error classes all inherit from {ServiceError}.

data/lib/aws-sdk-core/eventbridge.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:EventBridge, {
+  api: "#{Aws::API_DIR}/eventbridge/2015-10-07/api-2.json",
+  docs: "#{Aws::API_DIR}/eventbridge/2015-10-07/docs-2.json",
+  examples: "#{Aws::API_DIR}/eventbridge/2015-10-07/examples-1.json",
+  paginators: "#{Aws::API_DIR}/eventbridge/2015-10-07/paginators-1.json",
+})

data/lib/aws-sdk-core/firehose.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Firehose, {
+  api: "#{Aws::API_DIR}/firehose/2015-08-04/api-2.json",
+  docs: "#{Aws::API_DIR}/firehose/2015-08-04/docs-2.json",
+  examples: "#{Aws::API_DIR}/firehose/2015-08-04/examples-1.json",
+  paginators: "#{Aws::API_DIR}/firehose/2015-08-04/paginators-1.json",
+})

data/lib/aws-sdk-core/fms.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:FMS, {
+  api: "#{Aws::API_DIR}/fms/2018-01-01/api-2.json",
+  docs: "#{Aws::API_DIR}/fms/2018-01-01/docs-2.json",
+  examples: "#{Aws::API_DIR}/fms/2018-01-01/examples-1.json",
+  paginators: "#{Aws::API_DIR}/fms/2018-01-01/paginators-1.json",
+})

data/lib/aws-sdk-core/forecastqueryservice.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:ForecastQueryService, {
+  api: "#{Aws::API_DIR}/forecastquery/2018-06-26/api-2.json",
+  docs: "#{Aws::API_DIR}/forecastquery/2018-06-26/docs-2.json",
+  examples: "#{Aws::API_DIR}/forecastquery/2018-06-26/examples-1.json",
+  paginators: "#{Aws::API_DIR}/forecastquery/2018-06-26/paginators-1.json",
+})

data/lib/aws-sdk-core/forecastservice.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:ForecastService, {
+  api: "#{Aws::API_DIR}/forecast/2018-06-26/api-2.json",
+  docs: "#{Aws::API_DIR}/forecast/2018-06-26/docs-2.json",
+  examples: "#{Aws::API_DIR}/forecast/2018-06-26/examples-1.json",
+  paginators: "#{Aws::API_DIR}/forecast/2018-06-26/paginators-1.json",
+})

data/lib/aws-sdk-core/frauddetector.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:FraudDetector, {
+  api: "#{Aws::API_DIR}/frauddetector/2019-11-15/api-2.json",
+  docs: "#{Aws::API_DIR}/frauddetector/2019-11-15/docs-2.json",
+  examples: "#{Aws::API_DIR}/frauddetector/2019-11-15/examples-1.json",
+  paginators: "#{Aws::API_DIR}/frauddetector/2019-11-15/paginators-1.json",
+})

data/lib/aws-sdk-core/fsx.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:FSx, {
+  api: "#{Aws::API_DIR}/fsx/2018-03-01/api-2.json",
+  docs: "#{Aws::API_DIR}/fsx/2018-03-01/docs-2.json",
+  examples: "#{Aws::API_DIR}/fsx/2018-03-01/examples-1.json",
+  paginators: "#{Aws::API_DIR}/fsx/2018-03-01/paginators-1.json",
+})

data/lib/aws-sdk-core/gamelift.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:GameLift, {
+  api: "#{Aws::API_DIR}/gamelift/2015-10-01/api-2.json",
+  docs: "#{Aws::API_DIR}/gamelift/2015-10-01/docs-2.json",
+  examples: "#{Aws::API_DIR}/gamelift/2015-10-01/examples-1.json",
+  paginators: "#{Aws::API_DIR}/gamelift/2015-10-01/paginators-1.json",
+})

data/lib/aws-sdk-core/glacier.rb

@@ -1,7 +1,8 @@
 Aws.add_service(:Glacier, {
-  api: File.join(Aws::APIS_DIR, 'Glacier.api.json'),
-  docs: File.join(Aws::APIS_DIR, 'Glacier.docs.json'),
-  paginators: File.join(Aws::APIS_DIR, 'Glacier.paginators.json'),
-  resources: File.join(Aws::APIS_DIR, 'Glacier.resources.json'),
-  waiters: File.join(Aws::APIS_DIR, 'Glacier.waiters.json'),
+  api: "#{Aws::API_DIR}/glacier/2012-06-01/api-2.json",
+  docs: "#{Aws::API_DIR}/glacier/2012-06-01/docs-2.json",
+  examples: "#{Aws::API_DIR}/glacier/2012-06-01/examples-1.json",
+  paginators: "#{Aws::API_DIR}/glacier/2012-06-01/paginators-1.json",
+  resources: "#{Aws::API_DIR}/glacier/2012-06-01/resources-1.json",
+  waiters: "#{Aws::API_DIR}/glacier/2012-06-01/waiters-2.json",
 })

data/lib/aws-sdk-core/globalaccelerator.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:GlobalAccelerator, {
+  api: "#{Aws::API_DIR}/globalaccelerator/2018-08-08/api-2.json",
+  docs: "#{Aws::API_DIR}/globalaccelerator/2018-08-08/docs-2.json",
+  examples: "#{Aws::API_DIR}/globalaccelerator/2018-08-08/examples-1.json",
+  paginators: "#{Aws::API_DIR}/globalaccelerator/2018-08-08/paginators-1.json",
+})

data/lib/aws-sdk-core/glue.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Glue, {
+  api: "#{Aws::API_DIR}/glue/2017-03-31/api-2.json",
+  docs: "#{Aws::API_DIR}/glue/2017-03-31/docs-2.json",
+  examples: "#{Aws::API_DIR}/glue/2017-03-31/examples-1.json",
+  paginators: "#{Aws::API_DIR}/glue/2017-03-31/paginators-1.json",
+})

data/lib/aws-sdk-core/gluedatabrew.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:GlueDataBrew, {
+  api: "#{Aws::API_DIR}/databrew/2017-07-25/api-2.json",
+  docs: "#{Aws::API_DIR}/databrew/2017-07-25/docs-2.json",
+  examples: "#{Aws::API_DIR}/databrew/2017-07-25/examples-1.json",
+  paginators: "#{Aws::API_DIR}/databrew/2017-07-25/paginators-1.json",
+})

data/lib/aws-sdk-core/greengrass.rb

@@ -0,0 +1,4 @@
+Aws.add_service(:Greengrass, {
+  api: "#{Aws::API_DIR}/greengrass/2017-06-07/api-2.json",
+  docs: "#{Aws::API_DIR}/greengrass/2017-06-07/docs-2.json",
+})

data/lib/aws-sdk-core/groundstation.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:GroundStation, {
+  api: "#{Aws::API_DIR}/groundstation/2019-05-23/api-2.json",
+  docs: "#{Aws::API_DIR}/groundstation/2019-05-23/docs-2.json",
+  examples: "#{Aws::API_DIR}/groundstation/2019-05-23/examples-1.json",
+  paginators: "#{Aws::API_DIR}/groundstation/2019-05-23/paginators-1.json",
+})

data/lib/aws-sdk-core/guardduty.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:GuardDuty, {
+  api: "#{Aws::API_DIR}/guardduty/2017-11-28/api-2.json",
+  docs: "#{Aws::API_DIR}/guardduty/2017-11-28/docs-2.json",
+  examples: "#{Aws::API_DIR}/guardduty/2017-11-28/examples-1.json",
+  paginators: "#{Aws::API_DIR}/guardduty/2017-11-28/paginators-1.json",
+})

data/lib/aws-sdk-core/health.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Health, {
+  api: "#{Aws::API_DIR}/health/2016-08-04/api-2.json",
+  docs: "#{Aws::API_DIR}/health/2016-08-04/docs-2.json",
+  examples: "#{Aws::API_DIR}/health/2016-08-04/examples-1.json",
+  paginators: "#{Aws::API_DIR}/health/2016-08-04/paginators-1.json",
+})

data/lib/aws-sdk-core/honeycode.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Honeycode, {
+  api: "#{Aws::API_DIR}/honeycode/2020-03-01/api-2.json",
+  docs: "#{Aws::API_DIR}/honeycode/2020-03-01/docs-2.json",
+  examples: "#{Aws::API_DIR}/honeycode/2020-03-01/examples-1.json",
+  paginators: "#{Aws::API_DIR}/honeycode/2020-03-01/paginators-1.json",
+})

data/lib/aws-sdk-core/iam.rb

@@ -1,6 +1,8 @@
 Aws.add_service(:IAM, {
-  api: File.join(Aws::APIS_DIR, 'IAM.api.json'),
-  docs: File.join(Aws::APIS_DIR, 'IAM.docs.json'),
-  paginators: File.join(Aws::APIS_DIR, 'IAM.paginators.json'),
-  resources: File.join(Aws::APIS_DIR, 'IAM.resources.json'),
+  api: "#{Aws::API_DIR}/iam/2010-05-08/api-2.json",
+  docs: "#{Aws::API_DIR}/iam/2010-05-08/docs-2.json",
+  examples: "#{Aws::API_DIR}/iam/2010-05-08/examples-1.json",
+  paginators: "#{Aws::API_DIR}/iam/2010-05-08/paginators-1.json",
+  resources: "#{Aws::API_DIR}/iam/2010-05-08/resources-1.json",
+  waiters: "#{Aws::API_DIR}/iam/2010-05-08/waiters-2.json",
 })

data/lib/aws-sdk-core/identitystore.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:IdentityStore, {
+  api: "#{Aws::API_DIR}/identitystore/2020-06-15/api-2.json",
+  docs: "#{Aws::API_DIR}/identitystore/2020-06-15/docs-2.json",
+  examples: "#{Aws::API_DIR}/identitystore/2020-06-15/examples-1.json",
+  paginators: "#{Aws::API_DIR}/identitystore/2020-06-15/paginators-1.json",
+})

data/lib/aws-sdk-core/imagebuilder.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Imagebuilder, {
+  api: "#{Aws::API_DIR}/imagebuilder/2019-12-02/api-2.json",
+  docs: "#{Aws::API_DIR}/imagebuilder/2019-12-02/docs-2.json",
+  examples: "#{Aws::API_DIR}/imagebuilder/2019-12-02/examples-1.json",
+  paginators: "#{Aws::API_DIR}/imagebuilder/2019-12-02/paginators-1.json",
+})

data/lib/aws-sdk-core/importexport.rb

@@ -1,5 +1,5 @@
 Aws.add_service(:ImportExport, {
-  api: File.join(Aws::APIS_DIR, 'ImportExport.api.json'),
-  docs: File.join(Aws::APIS_DIR, 'ImportExport.docs.json'),
-  paginators: File.join(Aws::APIS_DIR, 'ImportExport.paginators.json'),
+  api: "#{Aws::API_DIR}/importexport/2010-06-01/api-2.json",
+  docs: "#{Aws::API_DIR}/importexport/2010-06-01/docs-2.json",
+  paginators: "#{Aws::API_DIR}/importexport/2010-06-01/paginators-1.json",
 })

data/lib/aws-sdk-core/ini_parser.rb

@@ -0,0 +1,40 @@
+module Aws
+  class IniParser
+    class << self
+
+      def ini_parse(raw)
+        current_profile = nil
+        current_prefix = nil
+        raw.lines.inject({}) do |acc, line|
+          line = line.split(/^|\s;/).first # remove comments
+          profile = line.match(/^\[([^\[\]]+)\]\s*(#.+)?$/) unless line.nil?
+          if profile
+            current_profile = profile[1]
+            named_profile = current_profile.match(/^profile\s+(.+?)$/)
+            current_profile = named_profile[1] if named_profile
+          elsif current_profile
+            unless line.nil?
+              item = line.match(/^(.+?)\s*=\s*(.+?)\s*$/)
+              prefix = line.match(/^(.+?)\s*=\s*$/)
+            end
+            if item && item[1].match(/^\s+/)
+              # Need to add lines to a nested configuration.
+              inner_item = line.match(/^\s*(.+?)\s*=\s*(.+?)\s*$/)
+              acc[current_profile] ||= {}
+              acc[current_profile][current_prefix] ||= {}
+              acc[current_profile][current_prefix][inner_item[1]] = inner_item[2]
+            elsif item
+              current_prefix = nil
+              acc[current_profile] ||= {}
+              acc[current_profile][item[1]] = item[2]
+            elsif prefix
+              current_prefix = prefix[1]
+            end
+          end
+          acc
+        end
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/inspector.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Inspector, {
+  api: "#{Aws::API_DIR}/inspector/2016-02-16/api-2.json",
+  docs: "#{Aws::API_DIR}/inspector/2016-02-16/docs-2.json",
+  examples: "#{Aws::API_DIR}/inspector/2016-02-16/examples-1.json",
+  paginators: "#{Aws::API_DIR}/inspector/2016-02-16/paginators-1.json",
+})

data/lib/aws-sdk-core/instance_profile_credentials.rb

@@ -1,98 +1,157 @@
+require 'json'
 require 'time'
 require 'net/http'
-require 'thread'
 
 module Aws
-  class InstanceProfileCredentials < Credentials
+  class InstanceProfileCredentials
+
+    include CredentialProvider
+    include RefreshingCredentials
 
     # @api private
     class Non200Response < RuntimeError; end
 
+    # @api private
+    class TokenRetrivalError < RuntimeError; end
+
+    # @api private
+    class TokenExpiredError < RuntimeError; end
+
+    # @api private
+    class TokenRetrivalUnavailableError < RuntimeError; end
+
     # These are the errors we trap when attempting to talk to the
     # instance metadata service.  Any of these imply the service
     # is not present, no responding or some other non-recoverable
     # error.
     # @api private
-    FAILURES = [
+    NETWORK_ERRORS = [
       Errno::EHOSTUNREACH,
       Errno::ECONNREFUSED,
+      Errno::EHOSTDOWN,
+      Errno::ENETUNREACH,
       SocketError,
       Timeout::Error,
       Non200Response,
     ]
 
+    # Path base for GET request for profile and credentials
+    # @api private
+    METADATA_PATH_BASE = '/latest/meta-data/iam/security-credentials/'
+
+    # Path for PUT request for token
+    # @api private
+    METADATA_TOKEN_PATH = '/latest/api/token'
+
     # @param [Hash] options
+    # @option options [Integer] :retries (5) Number of times to retry
+    #   when retrieving credentials.
     # @option options [String] :ip_address ('169.254.169.254')
     # @option options [Integer] :port (80)
-    # @option options [Float] :http_open_timeout (1)
-    # @option options [Float] :http_read_timeout (1)
+    # @option options [Float] :http_open_timeout (5)
+    # @option options [Float] :http_read_timeout (5)
+    # @option options [Numeric, Proc] :delay By default, failures are retried
+    #   with exponential back-off, i.e. `sleep(1.2 ** num_failures)`. You can
+    #   pass a number of seconds to sleep between failed attempts, or
+    #   a Proc that accepts the number of failures.
     # @option options [IO] :http_debug_output (nil) HTTP wire
     #   traces are sent to this object.  You can specify something
     #   like $stdout.
+    # @option options [Integer] :token_ttl (21600) Time-to-Live in seconds for
+    #   EC2 Metadata Token used for fetching Metadata Profile Credentials.
     def initialize options = {}
+      @retries = options[:retries] || 5
       @ip_address = options[:ip_address] || '169.254.169.254'
       @port = options[:port] || 80
-      @http_open_timeout = options[:http_open_timeout] || 1
-      @http_read_timeout = options[:http_read_timeout] || 1
+      @http_open_timeout = options[:http_open_timeout] || 5
+      @http_read_timeout = options[:http_read_timeout] || 5
       @http_debug_output = options[:http_debug_output]
-      @refresh_mutex = Mutex.new
-      refresh!
+      @backoff = backoff(options[:backoff])
+      @token_ttl = options[:token_ttl] || 21600
+      super
     end
 
-    # @return [String,nil]
-    def access_key_id
-      refresh_if_stale
-      @access_key_id
-    end
+    # @return [Integer] Number of times to retry when retrieving credentials
+    #   from the instance metadata service. Defaults to 0 when resolving from
+    #   the default credential chain ({Aws::CredentialProviderChain}).
+    attr_reader :retries
 
-    # @return [String,nil]
-    def secret_access_key
-      refresh_if_stale
-      @secret_access_key
-    end
+    private
 
-    # @return [String,nil]
-    def session_token
-      refresh_if_stale
-      @session_token
+    def backoff(backoff)
+      case backoff
+      when Proc then backoff
+      when Numeric then lambda { |_| sleep(backoff) }
+      else lambda { |num_failures| Kernel.sleep(1.2 ** num_failures) }
+      end
     end
 
-    # @return [Time,nil]
-    def expiration
-      refresh_if_stale
-      @expiration
+    def refresh
+      # Retry loading credentials up to 3 times is the instance metadata
+      # service is responding but is returning invalid JSON documents
+      # in response to the GET profile credentials call.
+      begin
+        retry_errors([JSON::ParserError, StandardError], max_retries: 3) do
+          c = JSON.parse(get_credentials.to_s)
+          @credentials = Credentials.new(
+            c['AccessKeyId'],
+            c['SecretAccessKey'],
+            c['Token']
+          )
+          @expiration = c['Expiration'] ? Time.iso8601(c['Expiration']) : nil
+        end
+      rescue JSON::ParserError
+        raise Aws::Errors::MetadataParserError.new
+      end
     end
 
-    def refresh!
-      @refresh_mutex.synchronize do
-        credentials = MultiJson.load(get_credentials)
-        @access_key_id = credentials['AccessKeyId']
-        @secret_access_key = credentials['SecretAccessKey']
-        @session_token = credentials['Token']
-        if expires = credentials['Expiration']
-          @expiration = Time.parse(expires)
-        else
-          @expiration = nil
+    def get_credentials
+      # Retry loading credentials a configurable number of times if
+      # the instance metadata service is not responding.
+      if _metadata_disabled?
+        '{}'
+      else
+        begin
+          retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+            open_connection do |conn|
+              _token_attempt(conn)
+              token_value = @token.value if token_set?
+              profile_name = http_get(conn, METADATA_PATH_BASE, token_value)
+                .lines.first.strip
+              http_get(conn, METADATA_PATH_BASE + profile_name, token_value)
+            end
+          end
+        rescue
+          '{}'
         end
       end
     end
 
-    private
-
-    # Refreshes instance metadata credentials if they are within
-    # 5 minutes of expiration.
-    def refresh_if_stale
-      refresh! if @expiration && @expiration.utc <= Time.now.utc + 5 * 60
+    def token_set?
+      @token && !@token.expired?
     end
 
-    def get_credentials
-      open_connection do |conn|
-        path = '/latest/meta-data/iam/security-credentials/'
-        profile_name = http_get(conn, path).lines.first.strip
-        http_get(conn, path + profile_name)
+    # attempt to fetch token with retries baked in
+    # would be skipped if token already set
+    def _token_attempt(conn)
+      begin
+        retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+          unless token_set?
+            token_value, ttl = http_put(conn, METADATA_TOKEN_PATH, @token_ttl)
+            @token = Token.new(token_value, ttl) if token_value && ttl
+          end
+        end
+      rescue *NETWORK_ERRORS, TokenRetrivalUnavailableError
+        # token attempt failed with allowable errors (those indicating
+        # token retrieval not available on the instance), reset token to
+        # allow safe failover to non-token mode
+        @token = nil
       end
-    rescue *FAILURES => e
-      '{}'
+    end
+
+    def _metadata_disabled?
+      flag = ENV["AWS_EC2_METADATA_DISABLED"]
+      !flag.nil? && flag.downcase == "true"
     end
 
     def open_connection
@@ -104,14 +163,79 @@ module Aws
       yield(http).tap { http.finish }
     end
 
-    def http_get(connection, path)
-      response = connection.request(Net::HTTP::Get.new(path))
-      if response.code.to_i == 200
+    # GET request fetch profile and credentials
+    def http_get(connection, path, token=nil)
+      headers = {"User-Agent" => "aws-sdk-ruby2/#{VERSION}"}
+      headers["x-aws-ec2-metadata-token"] = token if token
+      response = connection.request(Net::HTTP::Get.new(path, headers))
+      case response.code.to_i
+      when 200
         response.body
+      when 401
+        raise TokenExpiredError
       else
         raise Non200Response
       end
     end
 
+    # PUT request fetch token with ttl
+    def http_put(connection, path, ttl)
+      headers = {
+        "User-Agent" => "aws-sdk-ruby2/#{VERSION}",
+        "x-aws-ec2-metadata-token-ttl-seconds" => ttl.to_s
+      }
+      response = connection.request(Net::HTTP::Put.new(path, headers))
+      case response.code.to_i
+      when 200
+        [
+          response.body,
+          response.header["x-aws-ec2-metadata-token-ttl-seconds"].to_i
+        ]
+      when 400
+        raise TokenRetrivalError
+      when 403
+      when 404
+      when 405
+        raise TokenRetrivalUnavailableError
+      else
+        raise Non200Response
+      end
+    end
+
+    def retry_errors(error_classes, options = {}, &block)
+      max_retries = options[:max_retries]
+      retries = 0
+      begin
+        yield
+      rescue *error_classes
+        if retries < max_retries
+          @backoff.call(retries)
+          retries += 1
+          retry
+        else
+          raise
+        end
+      end
+    end
+
+    # @api private
+    # Token used to fetch IMDS profile and credentials
+    class Token
+
+      def initialize(value, ttl)
+        @ttl = ttl
+        @value = value
+        @created_time = Time.now
+      end
+
+      # [String] token value
+      attr_reader :value
+
+      def expired?
+        Time.now - @created_time > @ttl
+      end
+
+    end
+
   end
 end