fix(autoscaling): AutoScalingGroup.requireImdsv2 throws error with LaunchTemplates

packages/aws-cdk-lib/aws-autoscaling/lib/aspects/require-imdsv2-aspect.ts

@@ -1,5 +1,7 @@
 import { IConstruct } from 'constructs';
+import { CfnLaunchTemplate, LaunchTemplate } from '../../../aws-ec2';
 import * as cdk from '../../../core';
+import { AUTOSCALING_GENERATE_LAUNCH_TEMPLATE } from '../../../cx-api';
 import { AutoScalingGroup } from '../auto-scaling-group';
 import { CfnLaunchConfiguration } from '../autoscaling.generated';
 
@@ -15,16 +17,41 @@ export class AutoScalingGroupRequireImdsv2Aspect implements cdk.IAspect {
  return;
  }
 
- const launchConfig = node.node.tryFindChild('LaunchConfig') as CfnLaunchConfiguration;
- if (cdk.isResolvableObject(launchConfig.metadataOptions)) {
- this.warn(node, 'CfnLaunchConfiguration.MetadataOptions field is a CDK token.');
- return;
- }
+ if (!cdk.FeatureFlags.of(node).isEnabled(AUTOSCALING_GENERATE_LAUNCH_TEMPLATE)) {
+ const launchConfig = node.node.tryFindChild('LaunchConfig') as CfnLaunchConfiguration;
+ if (cdk.isResolvableObject(launchConfig.metadataOptions)) {
+ this.warn(node, 'CfnLaunchConfiguration.MetadataOptions field is a CDK token.');
+ return;
+ }
+
+ launchConfig.metadataOptions = {
+ ...launchConfig.metadataOptions,
+ httpTokens: 'required',
+ };
+ } else {
+ const launchTemplate = node.node.tryFindChild('LaunchTemplate') as LaunchTemplate;
+ const cfnLaunchTemplate = launchTemplate.node.tryFindChild('Resource') as CfnLaunchTemplate;
+ const data = cfnLaunchTemplate.launchTemplateData;
+ if (cdk.isResolvableObject(data)) {
+ this.warn(node, 'CfnLaunchTemplate.LaunchTemplateData field is a CDK token.');
+ return;
+ }
 
- launchConfig.metadataOptions = {
- ...launchConfig.metadataOptions,
- httpTokens: 'required',
- };
+ const metadataOptions = (data as CfnLaunchTemplate.LaunchTemplateDataProperty).metadataOptions;
+ if (cdk.isResolvableObject(metadataOptions)) {
+ this.warn(node, 'CfnLaunchTemplate.LaunchTemplateData.MetadataOptions field is a CDK token.');
+ return;
+ }
+
+ const newData: CfnLaunchTemplate.LaunchTemplateDataProperty = {
+ ...data,
+ metadataOptions: {
+ ...metadataOptions,
+ httpTokens: 'required',
+ },
+ };
+ cfnLaunchTemplate.launchTemplateData = newData;
+ }
  }
 
  /**

packages/aws-cdk-lib/aws-autoscaling/test/aspects/require-imdsv2-aspect.test.ts

@@ -1,6 +1,7 @@
 import { Annotations, Match, Template } from '../../../assertions';
 import * as ec2 from '../../../aws-ec2';
 import * as cdk from '../../../core';
+import { AUTOSCALING_GENERATE_LAUNCH_TEMPLATE } from '../../../cx-api';
 import {
  AutoScalingGroup,
  AutoScalingGroupRequireImdsv2Aspect,
@@ -63,4 +64,101 @@ describe('AutoScalingGroupRequireImdsv2Aspect', () => {
  },
  });
  });
+});
+
+describe('AutoScalingGroupRequireImdsv2Aspect with AUTOSCALING_GENERATE_LAUNCH_TEMPLATE feature flag', () => {
+ let app: cdk.App;
+ let stack: cdk.Stack;
+ let vpc: ec2.Vpc;
+
+ beforeEach(() => {
+ app = new cdk.App();
+ stack = new cdk.Stack(app, 'Stack');
+ stack.node.setContext(AUTOSCALING_GENERATE_LAUNCH_TEMPLATE, true);
+ vpc = new ec2.Vpc(stack, 'Vpc');
+ });
+
+ test('warns when launchTemplateData for LaunchTemplate is a token', () => {
+ // GIVEN
+ const asg = new AutoScalingGroup(stack, 'AutoScalingGroup', {
+ vpc,
+ instanceType: new ec2.InstanceType('t2.micro'),
+ machineImage: ec2.MachineImage.latestAmazonLinux2(),
+ });
+ const launchTemplate = asg.node.tryFindChild('LaunchTemplate') as ec2.LaunchTemplate;
+ const cfnLaunchTemplate = launchTemplate.node.tryFindChild('Resource') as ec2.CfnLaunchTemplate;
+ cfnLaunchTemplate.launchTemplateData = cdk.Token.asAny({
+ kernelId: 'asfd',
+ } as ec2.CfnLaunchTemplate.LaunchTemplateDataProperty);
+ const aspect = new AutoScalingGroupRequireImdsv2Aspect();
+
+ // WHEN
+ cdk.Aspects.of(stack).add(aspect);
+
+ // THEN
+ Template.fromStack(stack).hasResourceProperties('AWS::EC2::LaunchTemplate', Match.not({
+ LaunchTemplateData: {
+ KernelId: 'asfd',
+ MetadataOptions: {
+ HttpTokens: 'required',
+ },
+ },
+ }));
+
+ Annotations.fromStack(stack).hasWarning('/Stack/AutoScalingGroup', Match.stringLikeRegexp('.*CfnLaunchTemplate.LaunchTemplateData field is a CDK token.'));
+ });
+
+ test('warns when metadataOptions for LaunchTemplate is a token', () => {
+ // GIVEN
+ const asg = new AutoScalingGroup(stack, 'AutoScalingGroup', {
+ vpc,
+ instanceType: new ec2.InstanceType('t2.micro'),
+ machineImage: ec2.MachineImage.latestAmazonLinux2(),
+ });
+ const launchTemplate = asg.node.tryFindChild('LaunchTemplate') as ec2.LaunchTemplate;
+ const cfnLaunchTemplate = launchTemplate.node.tryFindChild('Resource') as ec2.CfnLaunchTemplate;
+ cfnLaunchTemplate.launchTemplateData = {
+ metadataOptions: cdk.Token.asAny({
+ httpEndpoint: 'https://bla.com',
+ } as ec2.CfnLaunchTemplate.MetadataOptionsProperty),
+ } as ec2.CfnLaunchTemplate.LaunchTemplateDataProperty;
+
+ const aspect = new AutoScalingGroupRequireImdsv2Aspect();
+
+ // WHEN
+ cdk.Aspects.of(stack).add(aspect);
+
+ // THEN
+ Template.fromStack(stack).hasResourceProperties('AWS::EC2::LaunchTemplate', Match.not({
+ LaunchTemplateData: {
+ MetadataOptions: {
+ HttpTokens: 'required',
+ },
+ },
+ }));
+
+ Annotations.fromStack(stack).hasWarning('/Stack/AutoScalingGroup', Match.stringLikeRegexp('.*CfnLaunchTemplate.LaunchTemplateData.MetadataOptions field is a CDK token.'));
+ });
+
+ test('requires IMDSv2 for LaunchTemplate', () => {
+ // GIVEN
+ new AutoScalingGroup(stack, 'AutoScalingGroup', {
+ vpc,
+ instanceType: new ec2.InstanceType('t2.micro'),
+ machineImage: ec2.MachineImage.latestAmazonLinux2(),
+ });
+ const aspect = new AutoScalingGroupRequireImdsv2Aspect();
+
+ // WHEN
+ cdk.Aspects.of(stack).add(aspect);
+
+ // THEN
+ Template.fromStack(stack).hasResourceProperties('AWS::EC2::LaunchTemplate', {
+ LaunchTemplateData: {
+ MetadataOptions: {
+ HttpTokens: 'required',
+ },
+ },
+ });
+ });
 });