Config.SkipMetadataApiCheck No Longer Working When Only EC2 Metadata Credentials

[bflad]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Environment and Versions

• Terraform Executor: EC2 Instance
  • If outside Terraform Cloud/Enterprise, which operating system and version: All
• Terraform CLI version: Unreleased
• Terraform AWS Provider version: Unreleased
• Terraform Backend/Provider Configuration:

terraform {
  backend "s3" {
    # ... other configuration ...
    skip_metadata_api_check = true
  }
}

provider "aws" {
  # ... other configuration ...
  skip_metadata_api_check = true
}

• AWS environment variables (if any): None

• AWS configuration files (if any): None

Expected Behavior

EC2 Metadata API never called and those credentials never returned when Config.SkipMetadataApiCheck is enabled. Should return no valid credentials error.

Actual Behavior

EC2 Metadata API is called and those credentials are returned.

Steps to Reproduce

// Additional test case in TestGetSession()
		{
			Config: &Config{
				Region:               "us-east-1",
				SkipMetadataApiCheck: true,
			},
			Description:             "skip EC2 metadata API check",
			EnableEc2MetadataServer: true,
			ExpectedError: func(err error) bool {
				// TODO: https://github.com/hashicorp/aws-sdk-go-base/pull/42
				return err.Error() == errMsgNoValidCredentialSources
			},
			ExpectedRegion: "us-east-1",
		},

Debug Output

2020/06/03 10:37:16 [INFO] Attempting to use session-derived credentials
2020/06/03 10:37:16 [INFO] Setting custom EC2 metadata endpoint: http://127.0.0.1:65336/latest
2020/06/03 10:37:16 [DEBUG] Mock EC2 metadata server received request: /latest/meta-data/iam/security-credentials/
2020/06/03 10:37:16 [DEBUG] Mock EC2 metadata server received request: /latest/meta-data/iam/security-credentials/test_role
2020/06/03 10:37:16 [INFO] Successfully derived credentials from session
2020/06/03 10:37:16 [INFO] AWS Auth provider used: "EC2RoleProvider"
2020/06/03 10:37:16 [INFO] Setting custom STS endpoint: http://127.0.0.1:65337
2020/06/03 10:37:16 [DEBUG] Trying to get account information via sts:GetCallerIdentity
2020/06/03 10:37:16 [DEBUG] Mock EC2 metadata server received request: /latest/meta-data/iam/security-credentials/
2020/06/03 10:37:16 [DEBUG] Mock EC2 metadata server received request: /latest/meta-data/iam/security-credentials/test_role
2020/06/03 10:37:16 [DEBUG] Received STS API "POST" request to "/": Action=GetCallerIdentity&Version=2011-06-15
--- FAIL: TestGetSession (0.00s)
    --- FAIL: TestGetSession/skip_EC2_metadata_API_check (0.00s)
        session_test.go:1030: unexpected GetSession() error: error validating provider credentials: error calling sts:GetCallerIdentity: :
            	status code: 400, request id:

Fix Proposal

• Set AWS_EC2_METADATA_DISABLED=true environment variable if Config.SkipMetadataApiCheck at beginning of GetSession()

	if c.SkipMetadataApiCheck {
		os.Setenv("AWS_EC2_METADATA_DISABLED", "true")
	}

• Remove GetCredentialsFromMetadata() entirely -- its now superseded by the default AWS Go SDK credential handling. Its endpoint customization was already migrated to endpoints.Resolver and the AWS_METADATA_TIMEOUT customization is extraneous.

References

• Caused by: Feature/fix cred chain #20