### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [July 25, 2023, 7:32pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/6 "2023-07-25T19:32:29Z")
> [@chocecil](#):
>
> I found one related code.
>
> [discourse/spec/lib/s3\_helper\_spec.rb at v3.1.0.beta5 · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/v3.1.0.beta5/spec/lib/s3_helper_spec.rb#L39)
This is in the testing spec.
Discourse uses a version of the AWS SDK (3.130.2) above the minimum required to support IMDSv2 and from what I can tell looking at the `MetadataNoToken` metric in our AWS deployments, we have no calls to IMDSv1.
From what I can tell we’re already using IMDSv2 everywhere.
---
### Author:  [@Hans\_Homan](https://meta.discourse.org/u/Hans_Homan)
#### Post date: [July 10, 2024, 7:30am UTC](https://meta.discourse.org/t/imdsv2-support/272379/7 "2024-07-10T07:30:27Z")
We started using Discourse on an AWS EC2 instance a year ago. And this week we updated our instance to only use IMDSv2, this broke our AWS S3 uploads with the error message “unable to sign request without credentials set”. We also utilise the “s3 use iam profile” setting.
The local IMDS service is used by Discourse to get credentials for doing other AWS related service API calls. This is done using Ruby aws-sdk-s3
>
---
### Author:  [@nskerl](https://meta.discourse.org/u/nskerl)
#### Post date: [August 8, 2024, 5:36pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/8 "2024-08-08T17:36:31Z")
We are also seeing this backup issue after disabling IMDSv1 due to security reasons.
We can see the use of IMDSv1 (in 3.3.0.beta1-dev) via the MetadataNoToken metric, so we are wondering what version of Discourse switched to using v2 everywhere?
---
### Author:  [@mentalstring](https://meta.discourse.org/u/mentalstring)
#### Post date: [November 23, 2024, 7:25pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/9 "2024-11-23T19:25:21Z")
We too were bitten by this today once we changed our AWS instance to use IMDSv2 only: our users could no longer upload images to S3.
Probably relevant here: we are also using the `s3 use iam profile` option.
For now we [switched](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html) it to “Optional” which basically means IMDSv1 is still enabled which isn’t the best security wise, but that made uploads work again.
---
### Author:  [@marco.palumbo](https://meta.discourse.org/u/marco.palumbo)
#### Post date: [November 5, 2025, 3:05pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/10 "2025-11-05T15:05:01Z")
Does anyone had a solution/workaround to have Discourse work wit IMDSv2?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [November 13, 2025, 11:56pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/11 "2025-11-13T23:56:25Z")
We are making changes to allow/expect more configuration to be possible via the `.aws/config` file which might happen to overlap with this and make it possible.
---
### Author:  [@marco.palumbo](https://meta.discourse.org/u/marco.palumbo)
#### Post date: [November 17, 2025, 4:20pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/15 "2025-11-17T16:20:29Z")
@supermathie the most weird thing that I cannot figure out is that I personally set up 2 discourse instances (dev/prod) that are identically configured (s3 uploads for files and backup using IAM profile) and updated to identical version ([9436f5e3d4](https://github.com/discourse/discourse/commits/9436f5e3d4cd92514844a8f9a44155a3e6ee2d17)) and when I disabled IMDSv1… in dev everything kept working as expected meanwhile in prod it doesn’t and keeps throwing something like “unable to sign request without credentials set” …quite puzzling
If you have any idea about test/check that I could do just let me know
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [November 17, 2025, 4:45pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/16 "2025-11-17T16:45:41Z")
@ducks identified the timeouts in the SDK for acquiring IMDS credentials are very aggressive (1 second, no retries) so it’s possible that it’s hitting that timeout.
But that’s just a guess.
If you console into prod can you do it interactively, e.g.:
```plaintext
discourse(prod)> c = Aws::S3::Client.new(region: ENV['DISCOURSE_S3_REGION'])
=> #
discourse(prod)> c.list_objects_v2(bucket: ENV['DISCOURSE_S3_BUCKET']).contents.count
=> 1000
```
---
### Author:  [@marco.palumbo](https://meta.discourse.org/u/marco.palumbo)
#### Post date: [November 24, 2025, 4:01pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/17 "2025-11-24T16:01:56Z")
I figured out what was wrong and I just have to blame myself but the issue was quite subtle.
The problem was with “HttpPutResponseHopLimit” set to 1 that did not allowed IMDSv2 to be called from inside the container
Issuing this command I got this answer:
```plaintext
> aws ec2 describe-instances --instance-ids i-00000000000000000 --query “Reservations[0].Instances[0].MetadataOptions”`
{
“State”: “applied”,
“HttpTokens”: “optional”,
“HttpPutResponseHopLimit”: 1,
“HttpEndpoint”: “enabled”,
“HttpProtocolIpv6”: “disabled”,
“InstanceMetadataTags”: “disabled”
}
```
Adjusting the setting the correct output is
```plaintext
> aws ec2 describe-instances --instance-ids i-00000000000000000 --query “Reservations[0].Instances[0].MetadataOptions”`
{
“State”: “applied”,
“HttpTokens”: “required”,
“HttpPutResponseHopLimit”: 2,
“HttpEndpoint”: “enabled”,
“HttpProtocolIpv6”: “disabled”,
“InstanceMetadataTags”: “disabled”
}
```
…and finally the mistery is solved 😅
Thanks everyone for your help
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [November 24, 2025, 5:25pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/18 "2025-11-24T17:25:46Z")
This is great to know!
And hopefully this applies to others as well.
But I’m wondering why this isn’t a problem for us. We have this set to 1 and yet it works?
```plaintext
discourse(prod)> ENV['AWS_EC2_METADATA_V1_DISABLED'] = 'true'
=> "true"
discourse(prod)> c = Aws::S3::Client.new(region: ENV['DISCOURSE_S3_REGION'])
=> #
discourse(prod)> c.config.credentials.disable_imds_v1
=> true
discourse(prod)> c.list_objects_v2(bucket: ENV['DISCOURSE_S3_BUCKET']).contents.count
=> 1000
```
and that instance has this metadata as per the same query command:
```plaintext
{
"State": "applied",
"HttpTokens": "optional",
"HttpPutResponseHopLimit": 1,
"HttpEndpoint": "enabled",
"HttpProtocolIpv6": "disabled",
"InstanceMetadataTags": "disabled"
}
```
We’re running Discourse in a docker container on EC2, same as others, so… what’s the difference?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 25, 2025, 2:00pm UTC](https://meta.discourse.org/t/imdsv2-support/272379/19 "2025-11-25T14:00:17Z")
This topic was automatically closed after 21 hours. New replies are no longer allowed.