From 122dfa12acea1e6f378a407c4a61da3ece186023 Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Tue, 30 Jan 2024 15:51:55 -0800
Subject: [PATCH 1/7] add imdsv2 support to dns_aws

---
 dnsapi/dns_aws.sh | 63 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 61 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index bb0682a73a..e3b8e28bd6 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -207,6 +207,65 @@ _use_container_role() {
 }
 
 _use_instance_role() {
+  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
+  # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
+  _url="http://169.254.169.254/latest/meta-data/"
+  _response=$(curl --write-out "%{http_code}\n" -s -HEAD $_url)
+  _debug "_response" "$_response"
+  if [ "$_response" -eq "401" ]; then
+    _use_imdsv2_instance_role
+  else
+    _use_imdsv1_instance_role
+  fi
+}
+
+_use_imdsv2_instance_role() {
+  _request_token_url="http://169.254.169.254/latest/api/token"
+  _instance_role_url="http://169.254.169.254/latest/meta-data/iam"
+  _request_token="$(curl -s -X PUT "$_request_token_url" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")"
+  _debug "_request_token" "$_request_token"
+  if [ -z "$_request_token" ]; then
+    _debug "Unable to fetch IMDSv2 token from instance metadata"
+    return 1
+  fi
+  _instance_role_name="$(curl -s -H "X-aws-ec2-metadata-token: $_request_token" http://169.254.169.254/latest/meta-data/iam/security-credentials/)"
+  _debug "_instance_role_name" "$_instance_role_name"
+  if [ -z "$_instance_role_name" ]; then
+    _debug "Unable to fetch instance role name from instance metadata"
+    return 1
+  fi
+  _use_metadata_imdsv2 "http://169.254.169.254/latest/meta-data/iam/security-credentials/$_instance_role_name" "$_request_token"
+}
+
+_use_metadata_imdsv2() {
+  _aws_creds="$(
+    curl -s -H "X-aws-ec2-metadata-token: $2" "$1" |
+      _normalizeJson |
+      tr '{,}' '\n' |
+      while read -r _line; do
+        _key="$(echo "${_line%%:*}" | tr -d '"')"
+        _value="${_line#*:}"
+        _debug3 "_key" "$_key"
+        _secure_debug3 "_value" "$_value"
+        case "$_key" in
+        AccessKeyId) echo "AWS_ACCESS_KEY_ID=$_value" ;;
+        SecretAccessKey) echo "AWS_SECRET_ACCESS_KEY=$_value" ;;
+        Token) echo "AWS_SESSION_TOKEN=$_value" ;;
+        esac
+      done |
+      paste -sd' ' -
+  )"
+  _secure_debug "_aws_creds" "$_aws_creds"
+
+  if [ -z "$_aws_creds" ]; then
+    return 1
+  fi
+
+  eval "$_aws_creds"
+  _using_role=true
+}
+
+_use_imdsv1_instance_role() {
   _url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
   _debug "_url" "$_url"
   if ! _get "$_url" true 1 | _head_n 1 | grep -Fq 200; then
@@ -215,10 +274,10 @@ _use_instance_role() {
   fi
   _aws_role=$(_get "$_url" "" 1)
   _debug "_aws_role" "$_aws_role"
-  _use_metadata "$_url$_aws_role"
+  _use_metadata_imdsv1 "$_url$_aws_role"
 }
 
-_use_metadata() {
+_use_metadata_imdsv1() {
   _aws_creds="$(
     _get "$1" "" 1 |
       _normalizeJson |

From 7da9a45c6151150b16e34d4fabdfc5d8c181d294 Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Wed, 31 Jan 2024 15:39:08 -0800
Subject: [PATCH 2/7] combined functions for cleaner code

---
 dnsapi/dns_aws.sh | 80 +++++++++++------------------------------------
 1 file changed, 19 insertions(+), 61 deletions(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index e3b8e28bd6..7a5ad4b188 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -209,75 +209,33 @@ _use_container_role() {
 _use_instance_role() {
   # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
   # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
-  _url="http://169.254.169.254/latest/meta-data/"
-  _response=$(curl --write-out "%{http_code}\n" -s -HEAD $_url)
-  _debug "_response" "$_response"
-  if [ "$_response" -eq "401" ]; then
-    _use_imdsv2_instance_role
-  else
-    _use_imdsv1_instance_role
+  _instance_role_name_url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
+  #_response=$(curl --write-out "%{http_code}\n" -s -HEAD $_url)
+  if _get "$_instance_role_name_url" true 1 | _head_n 1 | grep -Fq 401; then
+    _debug "Using IMDSv2"
+    _token_url="http://169.254.169.254/latest/api/token"
+    export _H1="X-aws-ec2-metadata-token-ttl-seconds: 21600"
+    _token="$(_post "" "$_token_url" "" "PUT")"
+    _debug "_token" "$_token"
+    if [ -z "$_token" ]; then
+      _debug "Unable to fetch IMDSv2 token from instance metadata"
+      return 1
+    fi
+    export _H1="X-aws-ec2-metadata-token: $_token"
   fi
-}
 
-_use_imdsv2_instance_role() {
-  _request_token_url="http://169.254.169.254/latest/api/token"
-  _instance_role_url="http://169.254.169.254/latest/meta-data/iam"
-  _request_token="$(curl -s -X PUT "$_request_token_url" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")"
-  _debug "_request_token" "$_request_token"
-  if [ -z "$_request_token" ]; then
-    _debug "Unable to fetch IMDSv2 token from instance metadata"
+  if ! _get "$_instance_role_name_url" true 1 | _head_n 1 | grep -Fq 200; then
+    _debug "Unable to fetch IAM role from instance metadata"
     return 1
   fi
-  _instance_role_name="$(curl -s -H "X-aws-ec2-metadata-token: $_request_token" http://169.254.169.254/latest/meta-data/iam/security-credentials/)"
+  _instance_role_name=$(_get "$_instance_role_name_url" "" 1)
   _debug "_instance_role_name" "$_instance_role_name"
-  if [ -z "$_instance_role_name" ]; then
-    _debug "Unable to fetch instance role name from instance metadata"
-    return 1
-  fi
-  _use_metadata_imdsv2 "http://169.254.169.254/latest/meta-data/iam/security-credentials/$_instance_role_name" "$_request_token"
-}
 
-_use_metadata_imdsv2() {
-  _aws_creds="$(
-    curl -s -H "X-aws-ec2-metadata-token: $2" "$1" |
-      _normalizeJson |
-      tr '{,}' '\n' |
-      while read -r _line; do
-        _key="$(echo "${_line%%:*}" | tr -d '"')"
-        _value="${_line#*:}"
-        _debug3 "_key" "$_key"
-        _secure_debug3 "_value" "$_value"
-        case "$_key" in
-        AccessKeyId) echo "AWS_ACCESS_KEY_ID=$_value" ;;
-        SecretAccessKey) echo "AWS_SECRET_ACCESS_KEY=$_value" ;;
-        Token) echo "AWS_SESSION_TOKEN=$_value" ;;
-        esac
-      done |
-      paste -sd' ' -
-  )"
-  _secure_debug "_aws_creds" "$_aws_creds"
-
-  if [ -z "$_aws_creds" ]; then
-    return 1
-  fi
-
-  eval "$_aws_creds"
-  _using_role=true
-}
-
-_use_imdsv1_instance_role() {
-  _url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
-  _debug "_url" "$_url"
-  if ! _get "$_url" true 1 | _head_n 1 | grep -Fq 200; then
-    _debug "Unable to fetch IAM role from instance metadata"
-    return 1
-  fi
-  _aws_role=$(_get "$_url" "" 1)
-  _debug "_aws_role" "$_aws_role"
-  _use_metadata_imdsv1 "$_url$_aws_role"
+  _use_metadata "$_instance_role_name_url$_instance_role_name" "$_token"
 }
 
-_use_metadata_imdsv1() {
+_use_metadata() {
+  export _H1="X-aws-ec2-metadata-token: $2"
   _aws_creds="$(
     _get "$1" "" 1 |
       _normalizeJson |

From bd247c35f2303a6ff8635dc378be52cdd9a09d04 Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Wed, 31 Jan 2024 15:48:44 -0800
Subject: [PATCH 3/7] remove comments

---
 dnsapi/dns_aws.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 7a5ad4b188..c87a701236 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -210,7 +210,6 @@ _use_instance_role() {
   # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
   # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
   _instance_role_name_url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
-  #_response=$(curl --write-out "%{http_code}\n" -s -HEAD $_url)
   if _get "$_instance_role_name_url" true 1 | _head_n 1 | grep -Fq 401; then
     _debug "Using IMDSv2"
     _token_url="http://169.254.169.254/latest/api/token"

From b9157e29cb803e39448cf0ecd68f56e81076be5b Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Wed, 31 Jan 2024 15:52:59 -0800
Subject: [PATCH 4/7] spacing cleanup

---
 dnsapi/dns_aws.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index c87a701236..855100aa09 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -207,15 +207,14 @@ _use_container_role() {
 }
 
 _use_instance_role() {
-  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
-  # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/
   _instance_role_name_url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
+
   if _get "$_instance_role_name_url" true 1 | _head_n 1 | grep -Fq 401; then
     _debug "Using IMDSv2"
     _token_url="http://169.254.169.254/latest/api/token"
     export _H1="X-aws-ec2-metadata-token-ttl-seconds: 21600"
     _token="$(_post "" "$_token_url" "" "PUT")"
-    _debug "_token" "$_token"
+    _secure_debug3 "_token" "$_token"
     if [ -z "$_token" ]; then
       _debug "Unable to fetch IMDSv2 token from instance metadata"
       return 1
@@ -227,9 +226,9 @@ _use_instance_role() {
     _debug "Unable to fetch IAM role from instance metadata"
     return 1
   fi
+
   _instance_role_name=$(_get "$_instance_role_name_url" "" 1)
   _debug "_instance_role_name" "$_instance_role_name"
-
   _use_metadata "$_instance_role_name_url$_instance_role_name" "$_token"
 }
 

From 22374b81de4ccd73abb89af5ba01a8f8d7bb4a49 Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Wed, 31 Jan 2024 16:02:45 -0800
Subject: [PATCH 5/7] delete a cr to force a workflow run

---
 dnsapi/dns_aws.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 855100aa09..a29cbd1ea8 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -145,7 +145,6 @@ dns_aws_rm() {
   fi
   _sleep 1
   return 1
-
 }
 
 ####################  Private functions below ##################################

From 48e4e41e05353fc470204b86b0135186311ba581 Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Wed, 31 Jan 2024 17:32:56 -0800
Subject: [PATCH 6/7] add cr to force a new gh actions run

---
 dnsapi/dns_aws.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index a29cbd1ea8..1df5b21b7e 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -229,6 +229,7 @@ _use_instance_role() {
   _instance_role_name=$(_get "$_instance_role_name_url" "" 1)
   _debug "_instance_role_name" "$_instance_role_name"
   _use_metadata "$_instance_role_name_url$_instance_role_name" "$_token"
+
 }
 
 _use_metadata() {

From b2c6b9a320a1c729bc35091a43ee5414f822da5a Mon Sep 17 00:00:00 2001
From: Tim Dery <tim.dery@bkjdigital.com>
Date: Mon, 11 Mar 2024 10:33:14 -0700
Subject: [PATCH 7/7] attempt _use_metadata fix from j-c-m

---
 dnsapi/dns_aws.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 1df5b21b7e..27923b64fb 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -239,7 +239,7 @@ _use_metadata() {
       _normalizeJson |
       tr '{,}' '\n' |
       while read -r _line; do
-        _key="$(echo "${_line%%:*}" | tr -d '"')"
+        _key="$(echo "${_line%%:*}" | tr -d '\"')"
         _value="${_line#*:}"
         _debug3 "_key" "$_key"
         _secure_debug3 "_value" "$_value"