Peter
05/03/2023, 8:54 PMload
decorators for collecting metadata from the cloudy clouds (AWS IMDS, and Azure friends), but these services are not accessible due to running on a local virtual machine during development, I have all sorts of trouble with I/O timeouts between osquery and my extension. However, If I remove the ec2_instance_metadata
decorator and re-run, the extension loads and works reliably.
I’m a little at a loss as to why this may be, but I have a feeling it may be something to do with the IMDSv2 implementation based on the error messages 🧵--verbose
logs when loading osquery via osqueryi
and with the relevant load
decorators enabled, and then disable (there are two log entries in this paste, with the load
directives listed just prior to each):
https://pastebin.com/LvsUe7bSseph
05/04/2023, 8:21 PMPeter
05/05/2023, 2:42 PM