boto3 connects from EC2 instance to secrets manager but unable to connect from inside docker contain-CodePudding

boto3 connects from EC2 instance with the following command returns a result.

session = boto3.session.Session()
client = session.client(service_name = 'secretmanager', region_name = 'us-east-1')
get_secret_value_response = client.get_secret_value(secretId = secret_name)

However, when I run the same set of commands from inside a docker container deployed on the EC2 instance it fails with the No credentials error. EC2 instance has an IAM role attached to be able to fetch passwords from secrets manager.

CodePudding user response：

It sounds like you need to increase the hop limit.

What are hops, and why are they significant?

To ensure IP packets have a limited lifetime on the network, all IP packets have an 8 bit Time to Live (IPv4) or Hop Limit (IPv6) header field and value which specifies the maximum number of layer three hops (typically routers) that can be traversed on the path to their destination.

Each time the packet arrives at a layer three network device (a Hop), the value is reduced by one before it gets routed onward. When the value eventually reaches one, the packet gets discarded by the device that receives it (as the value would get reduced to zero).

So the docker networking layer will just drop the response from IMDSv2 calls!

We now increase the hop count using the following command.

aws ec2 modify-instance-metadata-options  --instance-id i-XXXXXXXXXXXX --http-put-response-hop-limit 3

This AWS documentation says:

By default, the response to PUT requests has a response hop limit (time to live) of 1 at the IP protocol level. You can adjust the hop limit using the modify-instance-metadata-options command if you need to make it larger. For example, you might need a larger hop limit for backward compatibility with container services running on the instance. For more information, see modify-instance-metadata-options in the AWS CLI Command Reference.