Ruling `census-ruling-sec-host-imdsv2-module`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.
4
5
| unit | change | read sites | what changed |
6
|---|---|---|---|
7
| `infra/modules/region-host/main.tf` `external` | body | unchanged (1) | aws_instance.host gains metadata_options (IMDSv2 required, hop limit 1, endpoint enabled), matching scanner-host; tofu configuration only, run on an operator's machine; no read, file or record write is added; applies in place on a running instance with no restart |
Overlay: `internal/provision/testdata/plan14-root-reads-sec-host-imdsv2-module.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.
14
15
## Branch context
16
17
The branch `sec-host-imdsv2-module` adds a `metadata_options` block to
18
`aws_instance.host` in `infra/modules/region-host/main.tf` (IMDSv2 required,
19
hop limit 1, endpoint enabled), matching scanner-host, and a plan-time tofu
20
test under `infra/modules/region-host/tests/`. The record-write census does
21
not change: no record write is added or moved.
22
23
The new `tests/instance_metadata.tftest.hcl` is outside the census: the scan's
24
extension list excludes `.tftest.hcl`, and envelopes group by immediate
25
directory, so the module hash covers only the `.tf` files.
26
27
Executing identity: tofu on an operator's machine with the operator's AWS
28
credentials; no box unit runs the file and no binary embeds it.
amadan