Update ec2_metadata to use IMDSV2 (Continued from #1457)

[sawanoboly]

Reflected the comments on the pull request in #1457.

I have confirmed that this works with an EC2 instance with IMDSv2 only enabled.

Here's a quote from the original PR by @wilkosz

Agenda

Update all service calls to EC2 metadata to use IMDSV2 spec:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html

EC2 metadata service IMDSV1 introduced quite a few vulnerabilities: https://hackerone.com/reports/508459

Fix

Add v2 token generation for each NET::HTTP::Get request.
Closes issue #1411

Description

Related Issue

• Update ec2_metadata to use IMDSV2 #1457
• Update ohai to work with AWS IMDSv2 #1411

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.

[kchristensen]

I'd love to see this get merged, it's the one remaining thing we have making IMDSv1 requests still.

[TheKPLD]

I'd love to see this get merged, it's the one remaining thing we have making IMDSv1 requests still.

Yes please, +1

[tas50]

@sawanoboly Any chance you can take a look at the test failures. It may also help to rebase this on master.

[sawanoboly]

At the time of 15bfc27 the test was successful, taking over a PR that did not pass. I'll try to sort out the differences from the current master, as the changes are difficult to understand.

[sawanoboly]

@tas50 Thanks for notify, All checks have passed now.

[jaymzh]

@tas50 - this seems sane?

[tas50]

We'll need to validate this against and existing aws setup once it hits chef 17