Add option to disable EC2 metadata (IMDS) calls without token

[cenedhryn]

Motivation and Context

Currently, when the SDK calls the EC2 Instance Metadata Service (IMDS) to fetch regional or credential information, it attempts to fetch a token which is then attached to the credentials call, for security. If token fetching fails due to some errors (403, 404, 405) or timeouts, the provider makes an unsecure call without the token header.

It's recommended to avoid fallback to unsecure, IMDS v1 style calls without a token and this PR adds a configuration option to facilitate that.

Modifications

• Adds setting to disable IMDS v1 fallback through
  • Environment variables (AWS_EC2_METADATA_V1_DISABLED)
  • System property (aws.disableEc2MetadataV1)
  • Config file (ec2_metadata_v1_disabled).
• Adds a resolver to resolve the disable value to
  • InstanceProfileCredentialsProvider
  • InstanceProfileRegionProvider (specifically, EC2MetadataUtils)
• Updates creating an InstanceProfileCredentialsProvider in ProfileCredentialsProvider to forward profile information to the InstanceProfileCredentialsProvider

Note that all changes except for the ones to InstanceProfileRegionProvider are reviewed in #4840.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have read the CONTRIBUTING document
• Local run of mvn install succeeds
• My code follows the code style of this project
• My change requires a change to the Javadoc documentation
• I have updated the Javadoc documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
• My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

• I confirm that this pull request can be released under the Apache 2 license

[sonarqubecloud]

Quality Gate passed

The SonarCloud Quality Gate passed, but some issues were introduced.

36 New issues
0 Security Hotspots
86.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud