fix: removes content-header from AWS IMDS get request (#1934)

chalmerlowe · web-flow · commit 97bfea9e02ed · 2026-01-14T10:43:06.000-05:00
When performing a IMDS request, the code incorrectly adds a content-type header to the request: `content-type: application/json` to AWS metadata (IMDS) GET requests.` Some services at AWS (such as AWS SageMaker Jupyter notebook) have a stricter than normal metadata server (IMDS, both v1 and v2) when it comes to handling incoming http requests. This PR removes the default content-header and replaces it with `None`. NOTE: initializing headers to `None` (instead of an empty `dict`) when no session token is present matches the existing behavior in `_get_metadata_role_name` and allows the transport adapter to handle default headers cleanly. This PR updates existing unit tests (`tests/test_aws.py`) to match the new behavior. NOTE: closing PR #1489 due to inactivity as we make the push to migrate this library to the `google-cloud-python` monorepo For more information about the genesis of this, see the following issue: https://issuetracker.google.com/issues/328089077
diff --git a/google/auth/aws.py b/google/auth/aws.py
@@ -530,9 +530,10 @@ def _get_metadata_security_credentials(
             google.auth.exceptions.RefreshError: If an error occurs while
                 retrieving the AWS security credentials.
         """
-        headers = {"Content-Type": "application/json"}
         if imdsv2_session_token is not None:
-            headers["X-aws-ec2-metadata-token"] = imdsv2_session_token
+            headers = {"X-aws-ec2-metadata-token": imdsv2_session_token}
+        else:
+            headers = None
 
         response = request(
             url="{}/{}".format(self._security_credentials_url, role_name),
diff --git a/tests/test_aws.py b/tests/test_aws.py
@@ -1306,7 +1306,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
         self.assert_aws_metadata_request_kwargs(
             request.call_args_list[2][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
-            {"Content-Type": "application/json"},
+            None,
         )
 
         # Retrieve subject_token again. Region should not be queried again.
@@ -1329,7 +1329,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(
         self.assert_aws_metadata_request_kwargs(
             new_request.call_args_list[1][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
-            {"Content-Type": "application/json"},
+            None,
         )
 
     @mock.patch("google.auth._helpers.utcnow")
@@ -1394,7 +1394,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
             request.call_args_list[4][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )
@@ -1431,7 +1430,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(
             new_request.call_args_list[2][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )
@@ -1488,7 +1486,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secr
             request.call_args_list[2][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )
@@ -1545,7 +1542,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_acce
             request.call_args_list[2][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )
@@ -1596,7 +1592,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_cred
             request.call_args_list[2][1],
             "{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )
@@ -1684,7 +1679,6 @@ def test_retrieve_subject_token_success_ipv6(self, utcnow):
             request.call_args_list[4][1],
             "{}/{}".format(SECURITY_CREDS_URL_IPV6, self.AWS_ROLE),
             {
-                "Content-Type": "application/json",
                 "X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,
             },
         )

Original file line number	Diff line number	Diff line change
`@@ -1306,7 +1306,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(`
`1306`	`1306`	`self.assert_aws_metadata_request_kwargs(`
`1307`	`1307`	`request.call_args_list[2][1],`
`1308`	`1308`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1309`		`- {"Content-Type": "application/json"},`
	`1309`	`+ None,`
`1310`	`1310`	`)`
`1311`	`1311`
`1312`	`1312`	`# Retrieve subject_token again. Region should not be queried again.`
`@@ -1329,7 +1329,7 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars(`
`1329`	`1329`	`self.assert_aws_metadata_request_kwargs(`
`1330`	`1330`	`new_request.call_args_list[1][1],`
`1331`	`1331`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1332`		`- {"Content-Type": "application/json"},`
	`1332`	`+ None,`
`1333`	`1333`	`)`
`1334`	`1334`
`1335`	`1335`	`@mock.patch("google.auth._helpers.utcnow")`
`@@ -1394,7 +1394,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(`
`1394`	`1394`	`request.call_args_list[4][1],`
`1395`	`1395`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1396`	`1396`	`{`
`1397`		`- "Content-Type": "application/json",`
`1398`	`1397`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1399`	`1398`	`},`
`1400`	`1399`	`)`
`@@ -1431,7 +1430,6 @@ def test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2(`
`1431`	`1430`	`new_request.call_args_list[2][1],`
`1432`	`1431`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1433`	`1432`	`{`
`1434`		`- "Content-Type": "application/json",`
`1435`	`1433`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1436`	`1434`	`},`
`1437`	`1435`	`)`
`@@ -1488,7 +1486,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secr`
`1488`	`1486`	`request.call_args_list[2][1],`
`1489`	`1487`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1490`	`1488`	`{`
`1491`		`- "Content-Type": "application/json",`
`1492`	`1489`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1493`	`1490`	`},`
`1494`	`1491`	`)`
`@@ -1545,7 +1542,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_acce`
`1545`	`1542`	`request.call_args_list[2][1],`
`1546`	`1543`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1547`	`1544`	`{`
`1548`		`- "Content-Type": "application/json",`
`1549`	`1545`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1550`	`1546`	`},`
`1551`	`1547`	`)`
`@@ -1596,7 +1592,6 @@ def test_retrieve_subject_token_success_temp_creds_environment_vars_missing_cred`
`1596`	`1592`	`request.call_args_list[2][1],`
`1597`	`1593`	`"{}/{}".format(SECURITY_CREDS_URL, self.AWS_ROLE),`
`1598`	`1594`	`{`
`1599`		`- "Content-Type": "application/json",`
`1600`	`1595`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1601`	`1596`	`},`
`1602`	`1597`	`)`
`@@ -1684,7 +1679,6 @@ def test_retrieve_subject_token_success_ipv6(self, utcnow):`
`1684`	`1679`	`request.call_args_list[4][1],`
`1685`	`1680`	`"{}/{}".format(SECURITY_CREDS_URL_IPV6, self.AWS_ROLE),`
`1686`	`1681`	`{`
`1687`		`- "Content-Type": "application/json",`
`1688`	`1682`	`"X-aws-ec2-metadata-token": self.AWS_IMDSV2_SESSION_TOKEN,`
`1689`	`1683`	`},`
`1690`	`1684`	`)`