Skip to content

ec2 condition keys #767

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
remotesynth wants to merge 1 commit into
base: aws-docs-release-july
Choose a base branch
from
Open

ec2 condition keys #767

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions src/content/docs/aws/services/ec2.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,6 +408,9 @@ The token can be used in subsequent requests like so:
curl -H "x-aws-ec2-metadata-token: <TOKEN>" -v http://169.254.169.254/latest/meta-data/
```

You can use the [`ModifyInstanceMetadataOptions`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html) API to change the metadata options of a running instance, for example to require IMDSv2.
Parameters that are omitted from the request retain their current value, matching AWS behavior.

:::note
IMDS IPv6 endpoint is currently not supported.
:::
Expand Down Expand Up @@ -688,6 +691,26 @@ Any operation not listed below will use the mock VM manager.
| `TerminateInstances` | Stops and undefines a Libvirt domain |
| `CreateVolume` | Creates a sparse Libvirt volume |

## IAM Condition Keys

When [IAM Policy Enforcement](/aws/developer-tools/security-testing/iam-policy-enforcement/) is enabled, LocalStack supports the following EC2-specific condition keys, matching the behavior described in the [AWS condition keys reference](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-policy-keys):

- `ec2:MetadataHttpTokens` &mdash; the `HttpTokens` value of an instance's [metadata options](#instance-metadata-service), useful for enforcing IMDSv2.
- `ec2:Attribute/<AttributeName>` &mdash; exposes request parameters (e.g. `HttpTokens` on `ModifyInstanceMetadataOptions`) as condition keys.

For example, the following policy statement only allows launching instances when IMDSv2 is required:

```json
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": { "ec2:MetadataHttpTokens": "required" }
}
}
```

## Resource Browser

The LocalStack Web Application provides a Resource Browser for managing EC2 instances.
Expand Down
Loading