How to build a container image with Image Builder, with IMDSv2 set to required

Question

I'm trying to set up an Image Builder pipeline for a container image. When setting IMDSv2 to required in the infrastructure config, the pipeline fails when trying to get any component (so both Amazon provided components and custom components).

E.g.:

```
failed to download the EC2 Image Builder Component 'arn:aws:imagebuilder:eu-central-1:454249771573:component/update-linux/1.0.2/1'. Error - operation error imagebuilder: GetComponent, get identity: get credentials: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, canceled, context deadline exceeded
```

How can I negate this error, other than setting IMDSv2 to optional?

Sebastiaan Brozius · Accepted Answer

I was able to solve this issue by increasing the HTTP PUT response hop limit. It _is_ mentioned ever so briefly in the Amazon Docs (https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/)
> If you’re using container services (such as ECS or EKS), you might need a bigger hop limit to help avoid falling back to IMDSv1. You can use the modify-instance-metadata-options launch parameter to make the change. We recommend testing with a hop limit of three in container environments.

By increasing the hop limit from 1 to 2, the container successfully builds using IMDSv2.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-imagebuilder-infrastructureconfiguration-instancemetadataoptions.html#cfn-imagebuilder-infrastructureconfiguration-instancemetadataoptions-httpputresponsehoplimit

Giovanni Lauria · Answer

When your Image Builder pipeline runs, it sends HTTP requests to launch EC2 instances for building and testing your image. To configure the version of IMDS (Instance Metadata Service) that your pipeline uses for these launch requests, set the httpTokens parameter in your Image Builder infrastructure configuration instance metadata settings.
Keep in mind that enabling IMDSv2 on output AMIs must be done after-the-fact using a ModifyImageAttribute call.

Look at the docs...
https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html
https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html

Sivaraman Selvam · Answer

Hello,

The error message indicates that the EC2 instance running the EC2 Image Builder component is unable to obtain the necessary IAM credentials from the EC2 Instance Metadata Service (IMDS). This could be due to several reasons, such as the instance not having an IAM role attached, network issues, or misconfiguration.

Did you attach the IAM role to the infrastructure configuration for EC2 builder? https://docs.aws.amazon.com/imagebuilder/latest/userguide/create-infra-config.html

> When your Image Builder pipeline runs, it sends HTTP requests to launch EC2 instances that Image Builder uses to build and test your image. To configure the version of IMDS that your pipeline uses for the launch requests, set the httpTokens parameter in your Image Builder infrastructure configuration instance metadata settings.

https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html

How to build a container image with Image Builder, with IMDSv2 set to required

Relevant content