Download this file
| 1 | # Plan-time tests for the host instance's metadata service settings. |
| 2 | # mock_provider means no AWS account and no credentials. |
| 3 | mock_provider "aws" {} |
| 4 | |
| 5 | override_data { |
| 6 | target = data.aws_vpcs.default |
| 7 | values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] } |
| 8 | } |
| 9 | |
| 10 | override_data { |
| 11 | target = data.aws_caller_identity.current |
| 12 | values = { account_id = "123456789012" } |
| 13 | } |
| 14 | |
| 15 | # The termination queue's ARN feeds an EventBridge target, which the provider |
| 16 | # validates as an ARN; the mock's random string is not one. |
| 17 | override_resource { |
| 18 | target = aws_sqs_queue.terminations |
| 19 | values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" } |
| 20 | } |
| 21 | |
| 22 | variables { |
| 23 | name = "carlos-test-ie" |
| 24 | sg_description = "carlos test host" |
| 25 | iam_name = "carlos-test-host" |
| 26 | instance_type = "t4g.small" |
| 27 | root_volume_size = 20 |
| 28 | user_data = "#!/bin/sh\n" |
| 29 | deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform" |
| 30 | data_bucket_arn = "arn:aws:s3:::carlos-test-ie" |
| 31 | ssm_parameter_arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*" |
| 32 | } |
| 33 | |
| 34 | |
| 35 | run "imdsv2_only" { |
| 36 | command = plan |
| 37 | assert { |
| 38 | condition = aws_instance.host.metadata_options[0].http_tokens == "required" |
| 39 | error_message = "the host requires IMDSv2 tokens" |
| 40 | } |
| 41 | assert { |
| 42 | condition = aws_instance.host.metadata_options[0].http_put_response_hop_limit == 1 |
| 43 | error_message = "the IMDS token must not leave the box (hop limit 1)" |
| 44 | } |
| 45 | assert { |
| 46 | condition = aws_instance.host.metadata_options[0].http_endpoint == "enabled" |
| 47 | error_message = "the endpoint stays on: the box role is how the host reaches AWS" |
| 48 | } |
| 49 | } |
| 50 | |
amadan