fix(ec2): launch template names in imdsv2 not unique across stacks (under feature flag)

[jericht]

Fixes #17656

Notes

Changes the name for the LaunchTemplate created in the aspect that enforces IMDSv2 on EC2 instances to a unique name.

Introduces a new feature flag (@aws-cdk/aws-ec2:uniqueImdsv2TemplateName) to change the launch template name.

Testing

Added a unit test

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[jericht]

@njlynch This is ready for review now. Could you take a look when you get the chance?

[njlynch]

Thanks for the fix!

However, I'm not sure this approach will work from a backwards-compatibility perspective. It appears from the docs that changing the launchTemplateName on the LaunchTemplate requires replacement, as does altering the launchTemplateName on the Instance.

The above means that accepting this change would cause instance replacements for any user who's using this feature, potentially causing unwanted and/or unexpected data loss.

An alternative approach is required, preferably by adding some mechanism (e.g., new property) for users to explicitly opt into this new naming scheme. Suggestions welcome!

Pull request has been modified.

[jericht]

@njlynch I've updated the PR to have an explicit opt-in property to use the fixed naming scheme, so this is ready for another review.

I decided to make it very clear (in docstrings and the README) that users should almost always have this property set to true to avoid the name collision issues, since this should've been the default behavior in the first place. Let me know what you think.

[njlynch]

Looking at how the implementation turned out, I don't think this is optimal. Deprecating the requireImdsv2 property for the options property isn't great, and the naming of uniqueLaunchTemplateNames is awkward (but I can't think of much better names with this design).

Let's flip this around a bit -- I think this is probably a good place to introduce a feature flag, so we can adjust the default behavior without uglifying the API. :) Maybe something like @aws-cdk/aws-ec2:uniqueImdsv2TemplateName. Take a look at the above contributing guide on flags, and let me know if you have any questions on this approach.

Pull request has been modified.

[jericht]

@njlynch Thanks for pointing me to the feature flag approach, it's much cleaner! I've updated the CR, so it's ready for another review.

[njlynch]

Looks great! I agree - much cleaner.

I made a minor update to use some of our newer best-practice helpers for feature flags. I'll take an action to document them in our contributing guide as well.

Thanks!

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: 56c01ae
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository