feat: enforce IMDSv2 by default (Phase 6.a) (#24)

Part of #12. Phase 6 split: this PR ships IMDSv2 enforcement only.
EBS encryption (also scoped in #12) becomes a Phase 6.b follow-up
that needs per-AMI root-device lookup to set BlockDeviceMappings
safely (wrong DeviceName creates an unused extra volume or clobbers
the root).

## Change

RunInstances params now include:

  MetadataOptions: {
    HttpTokens: config.input.httpTokens,
    HttpPutResponseHopLimit: 1,
    HttpEndpoint: 'enabled',
  }

- HttpTokens default 'required' — IMDSv2 session token mandatory on
  every metadata request. Mitigates SSRF to IAM-credential theft.
- HttpPutResponseHopLimit: 1 — token can't cross into a nested
  container, cap the blast radius of a containerized workload that
  tries to walk metadata.
- HttpEndpoint: 'enabled' — explicit; default but good to pin.

## New input

'http-tokens' in action.yml, default 'required', accepted values
'required' and 'optional'. Consumers who must keep IMDSv1
compatibility set 'optional' explicitly.

## Tests

tests/config.test.js — 2 new cases: default fallback + override.
Total 34 -> 36.

## Consumer impact

Transparent for code running on the runner that uses IMDS via a
modern SDK (aws-sdk v2/v3, SSM agent, cloud-init) — all support
IMDSv2 without config. Risk: an old tool or hand-rolled script
that hits 169.254.169.254/latest/meta-data without first PUTting
for a token. None expected on the hardened AL2023 AMI.

## Dogfood

Small single-knob change — should pass the provider acctest cleanly
once rotated. Phase 6.b (EBS encryption) will be scoped separately.

Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com>

Author: kurok

action.yml

@@ -70,6 +70,17 @@ inputs:
       IAM Role Name to attach to the created EC2 instance.
       This requires additional permissions on the AWS role used to launch instances.
     required: false
+  http-tokens:
+    description: >-
+      Instance Metadata Service (IMDS) token mode. Accepted values:
+        - 'required' (default): IMDSv2-only. Any request to the IMDS
+          endpoint (169.254.169.254) must present a session token.
+          Mitigates SSRF-style credential theft.
+        - 'optional': IMDSv1 and IMDSv2 both work. Only set this if
+          a consumer workflow explicitly needs IMDSv1 compatibility.
+      Passed through to RunInstances MetadataOptions.HttpTokens.
+    required: false
+    default: 'required'
   debug:
     description: >-
       When 'true', the action emits extra diagnostic output to the

dist/index.js

@@ -87942,6 +87942,15 @@ async function startEc2Instance(label, githubRegistrationToken) {
     SecurityGroupIds: [config.input.securityGroupId],
     IamInstanceProfile: { Name: config.input.iamRoleName },
     TagSpecifications: config.tagSpecifications,
+    // IMDSv2 required by default. Mitigates SSRF-style IAM credential
+    // theft from the runner — any metadata request must present a
+    // session token. HttpPutResponseHopLimit: 1 prevents the token
+    // from reaching containerized workloads one hop deeper.
+    MetadataOptions: {
+      HttpTokens: config.input.httpTokens,
+      HttpPutResponseHopLimit: 1,
+      HttpEndpoint: 'enabled',
+    },
   };
 
   let ec2InstanceId;
@@ -88033,6 +88042,7 @@ class Config {
       label: core.getInput('label'),
       ec2InstanceId: core.getInput('ec2-instance-id'),
       iamRoleName: core.getInput('iam-role-name'),
+      httpTokens: core.getInput('http-tokens') || 'required',
       debug: core.getInput('debug') || 'false',
     };
 

src/aws.js

@@ -96,6 +96,15 @@ async function startEc2Instance(label, githubRegistrationToken) {
     SecurityGroupIds: [config.input.securityGroupId],
     IamInstanceProfile: { Name: config.input.iamRoleName },
     TagSpecifications: config.tagSpecifications,
+    // IMDSv2 required by default. Mitigates SSRF-style IAM credential
+    // theft from the runner — any metadata request must present a
+    // session token. HttpPutResponseHopLimit: 1 prevents the token
+    // from reaching containerized workloads one hop deeper.
+    MetadataOptions: {
+      HttpTokens: config.input.httpTokens,
+      HttpPutResponseHopLimit: 1,
+      HttpEndpoint: 'enabled',
+    },
   };
 
   let ec2InstanceId;

src/config.js

@@ -16,6 +16,7 @@ class Config {
       label: core.getInput('label'),
       ec2InstanceId: core.getInput('ec2-instance-id'),
       iamRoleName: core.getInput('iam-role-name'),
+      httpTokens: core.getInput('http-tokens') || 'required',
       debug: core.getInput('debug') || 'false',
     };
 

tests/config.test.js

@@ -131,6 +131,18 @@ describe('Config — mode validation', () => {
   });
 });
 
+describe('Config — http-tokens input', () => {
+  test('defaults to "required" when unset', () => {
+    const config = loadConfig(startModeInputs);
+    expect(config.input.httpTokens).toBe('required');
+  });
+
+  test('honors an "optional" override', () => {
+    const config = loadConfig({ ...startModeInputs, 'http-tokens': 'optional' });
+    expect(config.input.httpTokens).toBe('optional');
+  });
+});
+
 describe('Config — debug input', () => {
   test('defaults to "false" when unset', () => {
     const config = loadConfig(startModeInputs);