EC2 IMDS Changes to Support Account ID

[S-Saranya1]

Add support for extracting account ID from Instance Metadata Credentials Provider

Motivation and Context

Add support in IMDS credentials provider to retrieve accountID.

Modifications

• Added support for new /latest/meta-data/iam/security-credentials-extended/ IMDS endpoint
• Added fallback logic to legacy endpoint '/latest/meta-data/iam/security-credentials/{ROLE}'
• Added support for AccountId to extract it from IMDS response.

Testing

Added unit tests using WireMock to verify:

• Successful retrieval of credentials with account ID from extended endpoint
• Proper fallback to legacy endpoint when extended endpoint returns 404

Performed integration testing on EC2:

• Verified successful account ID resolution on allowlisted instances
• Confirmed fallback to legacy endpoint on non-allowlisted instances

Screenshots (if appropriate)

Tested Code:

public class ImdsAccountIdTest {
    public static void main(String[] args) {
        try {
            InstanceProfileCredentialsProvider provider = InstanceProfileCredentialsProvider.create();
            AwsCredentials credentials = provider.resolveCredentials();
            System.out.println("Successfully resolved credentials!");
            System.out.println("Access Key ID: " + credentials.accessKeyId().substring(0, 5) + "...");
            System.out.println("Account ID: " + credentials.accountId().orElse("Not available"));

        } catch (Exception e) {
            System.err.println("Error: " + e.getMessage());
            e.printStackTrace();
            System.exit(1);
        }
    }
}

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have read the CONTRIBUTING document
• Local run of mvn install succeeds
• My code follows the code style of this project
• My change requires a change to the Javadoc documentation
• I have updated the Javadoc documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
• My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

• I confirm that this pull request can be released under the Apache 2 license

[alextwoods]

LGTM!

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud