Support IMDSv2 for AWS authentication

[nhw76]

The original AWS instance metadata service that is used in OPA (IMDSv1) is vulnerable to SSRF attacks, whereby an attacker uses a misconfigured WAF/upload capability/etc. to disclose the credentials inappropriately. This vulnerability is known to have been involved in significant attacks on AWS-hosted applications.

In many environments, adoption of IMDSv2 (which is session-based vs. request/response for v1) is becoming mandatory as technology risk functions look to minimize the vulnerability surface.

Since OPA depends on a bespoke implementation of IMDSv1 for AWS credential management, that implementation will need to be upgraded for IMDSv2, rather than benefiting automatically through SDK integration.

ref. also #1340 and #1600 for more discussion of the cost/benefit of this integration approach

[tsandall]

@nhw76 thanks for filing this. This is a good issue for someone with relevant experience to contribute to. Since we already implement IMDSv1, supporting IMDSv2 should follow a similar pattern fairly easily.

@nhw76 are you interested/available to implement this?

[nhw76]

@tsandall happy to!

[nhw76]

@tsandall @patrick-east I think the linked PR covers the requirement - let me know what you think.