How to build a container image with Image Builder, with IMDSv2 set to required

0

I'm trying to set up an Image Builder pipeline for a container image. When setting IMDSv2 to required in the infrastructure config, the pipeline fails when trying to get any component (so both Amazon provided components and custom components).

E.g.:

failed to download the EC2 Image Builder Component 'arn:aws:imagebuilder:eu-central-1:454249771573:component/update-linux/1.0.2/1'. Error - operation error imagebuilder: GetComponent, get identity: get credentials: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, canceled, context deadline exceeded

How can I negate this error, other than setting IMDSv2 to optional?

asked 4 days ago31 views
2 Answers
0

When your Image Builder pipeline runs, it sends HTTP requests to launch EC2 instances for building and testing your image. To configure the version of IMDS (Instance Metadata Service) that your pipeline uses for these launch requests, set the httpTokens parameter in your Image Builder infrastructure configuration instance metadata settings. Keep in mind that enabling IMDSv2 on output AMIs must be done after-the-fact using a ModifyImageAttribute call.

Look at the docs... https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html

profile picture
EXPERT
answered 4 days ago
  • When building an AMI with IMDSv2 required, I don't have any issues. But when building a container image, I do run into the mentioned issue when IMDSv2 is required. Since it's best practise, there should be a way to have the Build-instance running with IMDSv2 enabled.

0

Hello,

The error message indicates that the EC2 instance running the EC2 Image Builder component is unable to obtain the necessary IAM credentials from the EC2 Instance Metadata Service (IMDS). This could be due to several reasons, such as the instance not having an IAM role attached, network issues, or misconfiguration.

Did you attach the IAM role to the infrastructure configuration for EC2 builder? https://docs.aws.amazon.com/imagebuilder/latest/userguide/create-infra-config.html

When your Image Builder pipeline runs, it sends HTTP requests to launch EC2 instances that Image Builder uses to build and test your image. To configure the version of IMDS that your pipeline uses for the launch requests, set the httpTokens parameter in your Image Builder infrastructure configuration instance metadata settings.

https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html

profile picture
EXPERT
answered 4 days ago
profile picture
EXPERT
reviewed 4 days ago
  • The IAM role being used in the infrastructure configuration does have the proper permissions. When settings IMDSv2 to optional, the pipeline runs as intended. I know where and how to switch this value, but since the best practise is to have IMDSv2 set to required, there should be a way to have the Build-instance for a container image running with IMDSv2 on. I'm asking for that way.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions