Skip to content

fix: removes content-header from AWS IMDS get request #1934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chalmerlowe merged 5 commits into from
Jan 14, 2026
Merged

fix: removes content-header from AWS IMDS get request #1934

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7e1049e
fix: removes content-header-from-aws-get
chalmerlowe Jan 13, 2026
008685c
updates assertions to removed expectation of content-header
chalmerlowe Jan 13, 2026
077fd25
fix: correct header initialization to avoid TypeError
chalmerlowe Jan 13, 2026
2139fd3
fix: update test expectations after removing Content-Type header
chalmerlowe Jan 13, 2026
7a9cdd0
updates linting
chalmerlowe Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions google/auth/aws.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,9 +530,10 @@ def _get_metadata_security_credentials(
google.auth.exceptions.RefreshError: If an error occurs while
retrieving the AWS security credentials.
"""
headers = {"Content-Type": "application/json"}
if imdsv2_session_token is not None:
headers["X-aws-ec2-metadata-token"] = imdsv2_session_token
headers = {"X-aws-ec2-metadata-token": imdsv2_session_token}
else:
headers = None

response = request(
url="{}/{}".format(self._security_credentials_url, role_name),
Expand Down
10 changes: 2 additions & 8 deletions tests/test_aws.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1306,7 +1306,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
self.assert_aws_metadata_request_kwargs(
request.call_args_list[2][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{"Content-Type": "application/json"},
None,
)

# Retrieve subject_token again. Region should not be queried again.
Expand All @@ -1329,7 +1329,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
self.assert_aws_metadata_request_kwargs(
new_request.call_args_list[1][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{"Content-Type": "application/json"},
None,
)

@mock.patch("google.auth._helpers.utcnow")
Expand Down Expand Up @@ -1394,7 +1394,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
request.call_args_list[4][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down Expand Up @@ -1431,7 +1430,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
new_request.call_args_list[2][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down Expand Up @@ -1488,7 +1486,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secr
request.call_args_list[2][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down Expand Up @@ -1545,7 +1542,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_acce
request.call_args_list[2][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down Expand Up @@ -1596,7 +1592,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_cred
request.call_args_list[2][1],
"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down Expand Up @@ -1684,7 +1679,6 @@ def test_retrieve_subject_token_success_ipv6(self, utcnow):
request.call_args_list[4][1],
"{}/{}".format(SECURITY_CREDS_URL_IPV6, self.AWS_ROLE),
{
"Content-Type": "application/json",
"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
},
)
Expand Down
Loading