fix: removes `content-header` from AWS IMDS get request (#1934) · googleapis/google-auth-library-python@97bfea9 · GitHub

This repository was archived by the owner on Mar 6, 2026. It is now read-only.

googleapis / google-auth-library-python Public archive

• Notifications You must be signed in to change notification settings
• Fork 351
• Star 882

• Code
• Issues
• Pull requests
• Actions
• Security and quality
• Insights

Additional navigation options

Commit 97bfea9

Browse filesBrowse the repository at this point in the historyBrowse files

chalmerlowe

authored

fix: removes content-header from AWS IMDS get request (#1934)

When performing a IMDS request, the code incorrectly adds a content-type header to the request: `content-type: application/json` to AWS metadata (IMDS) GET requests.` Some services at AWS (such as AWS SageMaker Jupyter notebook) have a stricter than normal metadata server (IMDS, both v1 and v2) when it comes to handling incoming http requests. This PR removes the default content-header and replaces it with `None`. NOTE: initializing headers to `None` (instead of an empty `dict`) when no session token is present matches the existing behavior in `_get_metadata_role_name` and allows the transport adapter to handle default headers cleanly. This PR updates existing unit tests (`tests/test_aws.py`) to match the new behavior. NOTE: closing PR #1489 due to inactivity as we make the push to migrate this library to the `google-cloud-python` monorepo For more information about the genesis of this, see the following issue: https://issuetracker.google.com/issues/328089077

1 parent 35670fc commit 97bfea9
Copy full SHA for 97bfea9

2 files changed

+5-10Lines changed: 5 additions & 10 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• google/auth
  • aws.py
• tests
  • test_aws.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎google/auth/aws.py‎

Copy file name to clipboardExpand all lines: google/auth/aws.py

+3-2Lines changed: 3 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -530,9 +530,10 @@ def _get_metadata_security_credentials(
530	530	google.auth.exceptions.RefreshError: If an error occurs while
531	531	retrieving the AWS security credentials.
532	532	"""
533		- headers = {"Content-Type": "application/json"}
534	533	if imdsv2_session_token is not None:
535		- headers["X-aws-ec2-metadata-token"] = imdsv2_session_token
	534	+ headers = {"X-aws-ec2-metadata-token": imdsv2_session_token}
	535	+ else:
	536	+ headers = None
536	537
537	538	response = request(
538	539	url="{}/{}".format(self._security_credentials_url, role_name),

Collapse file

‎tests/test_aws.py‎

Copy file name to clipboardExpand all lines: tests/test_aws.py

+2-8Lines changed: 2 additions & 8 deletions

Original file line number	Diff line number	Diff line change
@@ -1306,7 +1306,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
1306	1306	self.assert_aws_metadata_request_kwargs(
1307	1307	request.call_args_list[2][1],
1308	1308	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1309		- {"Content-Type": "application/json"},
	1309	+ None,
1310	1310	)
1311	1311
1312	1312	# Retrieve subject_token again. Region should not be queried again.
@@ -1329,7 +1329,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
1329	1329	self.assert_aws_metadata_request_kwargs(
1330	1330	new_request.call_args_list[1][1],
1331	1331	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1332		- {"Content-Type": "application/json"},
	1332	+ None,
1333	1333	)
1334	1334
1335	1335	@mock.patch("google.auth._helpers.utcnow")
@@ -1394,7 +1394,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
1394	1394	request.call_args_list[4][1],
1395	1395	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1396	1396	{
1397		- "Content-Type": "application/json",
1398	1397	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1399	1398	},
1400	1399	)
@@ -1431,7 +1430,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
1431	1430	new_request.call_args_list[2][1],
1432	1431	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1433	1432	{
1434		- "Content-Type": "application/json",
1435	1433	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1436	1434	},
1437	1435	)
@@ -1488,7 +1486,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secr
1488	1486	request.call_args_list[2][1],
1489	1487	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1490	1488	{
1491		- "Content-Type": "application/json",
1492	1489	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1493	1490	},
1494	1491	)
@@ -1545,7 +1542,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_acce
1545	1542	request.call_args_list[2][1],
1546	1543	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1547	1544	{
1548		- "Content-Type": "application/json",
1549	1545	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1550	1546	},
1551	1547	)
@@ -1596,7 +1592,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_cred
1596	1592	request.call_args_list[2][1],
1597	1593	"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
1598	1594	{
1599		- "Content-Type": "application/json",
1600	1595	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1601	1596	},
1602	1597	)
@@ -1684,7 +1679,6 @@ def test_retrieve_subject_token_success_ipv6(self, utcnow):
1684	1679	request.call_args_list[4][1],
1685	1680	"{}/{}".format(SECURITY_CREDS_URL_IPV6, self.AWS_ROLE),
1686	1681	{
1687		- "Content-Type": "application/json",
1688	1682	"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
1689	1683	},
1690	1684	)

0 commit comments

Comments

0 (0)