aws-ecs: setting ECS_AWSVPC_BLOCK_IMDS to true

[mostafafarzaneh]

Describe the bug

I have the following snippet:

        user_data = ec2.UserData.for_linux()
        launch_template = ec2.LaunchTemplate(
            self, "ModelServer",
            instance_type=ec2.InstanceType("c5.xlarge"),
            security_group=ec2.SecurityGroup(self, "SecurityGroup", vpc=self.vpc),
            launch_template_name="Models",
            machine_image=ecs.EcsOptimizedImage.amazon_linux2(),
            role=template_role,
            disable_api_termination=False,
            user_data = user_data,
        )

        launch_template.user_data.add_commands("echo ECS_AWSVPC_BLOCK_IMDS=false >> /etc/ecs/ecs.config")     

        # Create auto scaling group
        auto_scaling_group = autoscaling.AutoScalingGroup(
            self, "AutoScalingGroup",
            launch_template=launch_template,
            min_capacity=0,
            max_capacity=3,
            #desired_capacity=0, #https://github.com/aws/aws-cdk/issues/5215
            vpc=self.vpc,
            vpc_subnets=ec2.SubnetSelection(
                subnet_type=ec2.SubnetType.PRIVATE_WITH_NAT),
        )
    
        capacity_provider = ecs.AsgCapacityProvider(
                self, "CapacityProvider",
                auto_scaling_group=auto_scaling_group,
                capacity_provider_name="Model",
                enable_managed_scaling=True,
                maximum_scaling_step_size=10,  # default 10000
                minimum_scaling_step_size=1,  # default 1
                target_capacity_percent=100,
                machine_image_type=ecs.MachineImageType.AMAZON_LINUX_2)

        # Create cluster
        self.cluster = ecs.Cluster(
            self, "cluster", vpc=self.vpc, cluster_name=cluster_name,
            container_insights=True)

        self.cluster.add_asg_capacity_provider(capacity_provider)

        launch_template.user_data.add_commands("echo ECS_AWSVPC_BLOCK_IMDS=false >> /etc/ecs/ecs.config")

The generated user data by ec2.UserData.for_linux() generates echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config which I want to change to false. If I use add_command before self.cluster.add_asg_capacity_provider(capacity_provider) the command will add at the top of generated user data. But if I use add_command after it, it will add at the end of generated user data as expected.

Expected Behavior

#!/bin/bash
echo ECS_CLUSTER=${Token[TOKEN.650]} >> /etc/ecs/ecs.config
sudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP
sudo service iptables save
echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config
echo ECS_AWSVPC_BLOCK_IMDS=false >> /etc/ecs/ecs.config

Current Behavior

#!/bin/bash
echo ECS_AWSVPC_BLOCK_IMDS=false >> /etc/ecs/ecs.config
echo ECS_CLUSTER=${Token[TOKEN.646]} >> /etc/ecs/ecs.config
sudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP
sudo service iptables save
echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config

Reproduction Steps

use add_command before self.cluster.add_asg_capacity_provider(capacity_provider)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.64.0 (build fb67c77)

Framework Version

No response

Node.js Version

v18.12.1

OS

Ubuntu 22.04.1 LTS

Language

Python

Language Version

No response

Other information

No response

[pahud]

I believe it's defined here

aws-cdk/packages/@aws-cdk/aws-ecs/lib/cluster.ts

Lines 440 to 441 in ce18037

	// The following is only for AwsVpc networking mode, but doesn't hurt for the other modes.
	autoScalingGroup.addUserData('echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config');

Can you share your use case why you need ECS_AWSVPC_BLOCK_IMDS=false?

[mostafafarzaneh]

I ended up using can_containers_access_instance_role property in AsgCapacityProvider to set ECS_AWSVPC_BLOCK_IMDS to true.

I am using Elastic Inference in ECS. I noticed that if the task cannot access the instance role, the task will fail to get access to EI. I tried to use the task_role for that matter but failed to do so. It would be great if you can provide the best practice.

[pahud]

Unfortunately I don't have recommended practice at this moment. I am moving this to discussion and open for further comments or ideas from the community.