Summary

Add IMDSv2 support to aws_assign_instance_profile.py in drivers-evergreen-tools. The script's instance metadata requests are unauthenticated (IMDSv1), which hosts that require IMDSv2 reject with a 401. Supporting IMDSv2 would let the EC2 auth test run on those hosts, including Ubuntu 24.04 where the ECS auth test already runs.

Motivation

Who is the affected end user?

Driver teams running the MONGODB-AWS EC2 auth test on Evergreen.

How does this affect the end user?

Annoyed, not blocked. Drivers currently skip the EC2 test on hosts that reject IMDSv1 (observed on Ubuntu 24.04 and macOS) or run it on a separate distro from the ECS test. Running EC2 and ECS on the same Ubuntu 24.04 host would simplify the test matrix, and macOS EC2 coverage would become possible.

How likely is it that this problem or use case will occur?

Main path for any driver running the EC2 auth test on a host that requires IMDSv2.

If the problem does occur, what are the consequences and how severe are they?

The script's metadata calls fail with a 401, the instance profile is never assigned, and the EC2 auth test fails, so it has to be skipped or moved to another host. Minor.

Is this issue urgent?

No.

Is this ticket required by a downstream team?

No.

Is this ticket only for tests?

Yes. It only affects the test setup script.

Acceptance Criteria

• aws_assign_instance_profile.py obtains and uses an IMDSv2 session token for its instance metadata requests.
• The EC2 AWS auth test passes on an Ubuntu 24.04 Evergreen host.