IMDSv2 Requirement Breaks aws_mysql and aws_postgres Authentication

Detailed Information:

We have encountered an issue with aws_mysql and aws_postgres on AWS EC2 instances where IMDSv2 is required. The error message we received is:

time="2025-05-29T17:31:37Z" level=error msg="Server crashed" error="datastore-sql: could not get authentication token: failed to build authentication token: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, canceled, context deadline exceeded"

We managed to temporarily resolve this issue by setting the instances to use IMDSv2 in optional mode, allowing IMDSv1 to function. However, this approach weakens the enhanced security benefits of strictly enforcing IMDSv2.

The HttpTokens setting for AWS EC2 instances can be configured to either required, where only IMDSv2 is allowed, or optional, where both IMDSv1 and IMDSv2 are permitted. When IMDSv2 is required, requests must use the /latest/api/token endpoint to retrieve a session token. Failure to do so, or using IMDSv1 in this scenario, may result in no response or 403 Forbidden errors. More detailed information can be found in the AWS EC2 User Guide.

Amazon Linux 2023 requires IMDSv2 by default, but it can be configured to optional if necessary, as explained in the Amazon Linux 2023 IMDSv2 documentation. Additionally, EKS Auto Mode mandates the use of IMDSv2 without any fallback to IMDSv1, according to the EKS Auto Mode Documentation.