Update ec2_metadata to use IMDSV2

[wilkosz]

Agenda

Update all service calls to EC2 metadata to use IMDSV2 spec:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html

EC2 metadata service IMDSV1 introduced quite a few vulnerabilities: https://hackerone.com/reports/508459

Fix

Add v2 token generation for each NET::HTTP::Get request.
Closes issue #1411

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.

[kevinrbabcock]

Thank you for putting together this change. We are looking forward to using it.

It looks like the EC2_SUPPORTED_VERSIONS at line 43 are out of date. I see four more in addition on a recent instance:

2018-03-28
2018-08-17
2018-09-24
2019-10-01

Similarly I don't believe the local_ipv4s endpoint mentioned at line 46 exists any longer. It may have been changed over the years; AWS has an updated list of metadata endpoints.

[kevinrbabcock]

The AWS documentation suggests the PUT request is supposed to go to /latest/api/token with no trailing slash.

The quoting style is inconsistent, with some single quotes and some double quotes. It doesn't really matter for functionality, but is odd to read.

It would be good to have unit tests for this method. What happens when the PUT request fails for some reason, e.g. IMDSv2 isn't running?

[jaymzh]

@sawanoboly - wanna rebase?

[tas50]

#1599 fixed the issue with this failing on non-aws systems that maintain a compatible ec2 metadata endpoint