I am writing to inquire about the support of IMDSv2 through instance profiles in Discourse. We are in the process of migrating our service to use IMDSv2, as IMDSv1 is not an secure option. We would like to understand if Discourse currently supports IMDSv2 through instance profiles and if not, what are the plans to support it in the near future. Additionally, are there any workarounds or patches available that would allow us to use IMDSv2 with Discourse? It is important for us to ensure that our security requirements are met, and we believe that using temporary credentials through IMDSv2 is a critical aspect of that. Desired behavior for accessing security credentials provided through the instance profile is An application on the instance retrieves the security credentials provided by the role from the instance metadata item iam/security-credentials/ role-name. The application is granted the permissions for the actions and resources that we have defined for the role through the security credentials associated with the role. These security credentials are temporary and are rotated automatically. We make new credentials available at least five minutes before the expiration of the old credentials. We have noted that there are differences between the IMDSv1 and IMDSv2 calls. IMDSv1 call: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access While the IMDSv2 call requires the use of a metadata token, and can be made using the following commands: TOKEN=`curl -X PUT " " -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \\\\\\\\ && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v We would appreciate any information you can provide on how we can use IMDSv2 with Discourse, or if there are any workarounds or patches available. Reference: IMDSv2 Migration : Transition to using Instance Metadata Service Version 2 - Amazon Elastic Compute Cloud

I’m not aware of any way that Discourse itself uses IMDS. Have you installed Discourse on AWS somehow? Are you somehow using IMDSv1 with Discourse already? What is your use case?

I found one related code. spec/lib/s3_helper_spec.rb v3.1.0.beta5 XML end it "can correctly set the purge policy" do SiteSetting.s3_configure_tombstone_policy = true stub_request( :get, "http://169.254.169.254/latest/meta-data/iam/security-credentials/", ).to_return(status: 404, body: "", headers: {}) stub_request( :get, "https://bob.s3.#{SiteSetting.s3_region}.amazonaws.com/?lifecycle", ).to_return(status: 200, body: @lifecycle, headers: {}) stub_request(:put, "https://bob.s3.#{SiteSetting.s3_region}.amazonaws.com/?lifecycle") .with do |req| hash = Hash.from_xml(req.body.to_s)

[תמונה] chocecil: I found one related code. discourse/spec/lib/s3_helper_spec.rb at v3.1.0.beta5 · discourse/discourse · GitHub This is in the testing spec. Discourse uses a version of the AWS SDK (3.130.2) above the minimum required to support IMDSv2 and from what I can tell looking at the MetadataNoToken metric in our AWS deployments, we have no calls to IMDSv1. From what I can tell we’re already using IMDSv2 everywhere.

We started using Discourse on an AWS EC2 instance a year ago. And this week we updated our instance to only use IMDSv2, this broke our AWS S3 uploads with the error message “unable to sign request without credentials set”. We also utilise the “s3 use iam profile” setting. The local IMDS service is used by Discourse to get credentials for doing other AWS related service API calls. This is done using Ruby aws-sdk-s3 Gemfile.lock c9775d5f7 aws-eventstream (1.3.0) aws-partitions (1.894.0) aws-sdk-core (3.191.3) aws-eventstream (~> 1, >= 1.3.0) aws-partitions (~> 1, >= 1.651.0) aws-sigv4 (~> 1.8) jmespath (~> 1, >= 1.6.1) aws-sdk-kms (1.77.0) aws-sdk-core (~> 3, >= 3.191.0) aws-sigv4 (~> 1.1) aws-sdk-s3 (1.143.0) aws-sdk-core (~> 3, >= 3.191.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.8) aws-sdk-sns (1.72.0) aws-sdk-core (~> 3, >= 3.191.0) aws-sigv4 (~> 1.1) aws-sigv4 (1.8.0) aws-eventstream (~> 1, >= 1.0.2) base64 (0.2.0) better_errors (2.10.1)

We are also seeing this backup issue after disabling IMDSv1 due to security reasons. We can see the use of IMDSv1 (in 3.3.0.beta1-dev) via the MetadataNoToken metric, so we are wondering what version of Discourse switched to using v2 everywhere?

We too were bitten by this today once we changed our AWS instance to use IMDSv2 only: our users could no longer upload images to S3. Probably relevant here: we are also using the s3 use iam profile option. For now we switched it to “Optional” which basically means IMDSv1 is still enabled which isn’t the best security wise, but that made uploads work again.

We are making changes to allow/expect more configuration to be possible via the .aws/config file which might happen to overlap with this and make it possible.

@supermathie the most weird thing that I cannot figure out is that I personally set up 2 discourse instances (dev/prod) that are identically configured (s3 uploads for files and backup using IAM profile) and updated to identical version (9436f5e3d4) and when I disabled IMDSv1… in dev everything kept working as expected meanwhile in prod it doesn’t and keeps throwing something like “unable to sign request without credentials set” …quite puzzling If you have any idea about test/check that I could do just let me know

@ducks identified the timeouts in the SDK for acquiring IMDS credentials are very aggressive (1 second, no retries) so it’s possible that it’s hitting that timeout. But that’s just a guess. If you console into prod can you do it interactively, e.g.: discourse(prod)> c = Aws::S3::Client.new(region: ENV['DISCOURSE_S3_REGION']) => # discourse(prod)> c.list_objects_v2(bucket: ENV['DISCOURSE_S3_BUCKET']).contents.count => 1000

תמיכה ב-IMDSv2

תמיכה התקנה

marco.palumbo (Marco Palumbo) 5 בנובמבר,‏ 2025,‏ 3:05pm 10

Does anyone had a solution/workaround to have Discourse work wit IMDSv2?

נושא		תגובות	צפיות
Backups to S3 fail when IMDSv1 disabled Bug backups , s3	0	136	29 באוגוסט,‏ 2024
How are you authenticating Discourse to AWS? Help us improve the settings! Feature s3	3	277	9 באוקטובר,‏ 2025
Set up file and image uploads to S3 Self-Hosting configuring , how-to	35	122405	25 באוקטובר,‏ 2025
Configure an S3 compatible object storage provider for uploads Self-Hosting cdn , configuring , how-to , reference	267	54920	15 בספטמבר,‏ 2026
Problems with Patreon Login, Force HTTPS, and S3 CDN (three) Issues Self-hosting unsupported-install	12	2359	6 בינואר,‏ 2023

תמיכה ב-IMDSv2

נושאים קשורים