Cost Estimation Fails When Using an AWS EC2 Instance Profile (Terraform Enterprise)

Introduction

This article addresses a cost estimation failure in Terraform Enterprise when it is configured to use an AWS EC2 instance profile for credentials. The error message typically reports that resources could not be estimated.

Problem

When using an AWS EC2 instance profile, the Terraform Enterprise Cost Estimation feature fails with the following error message in the user interface: “X out of X resources could not be estimated”.

Cause

The AWS SDKs, by default, attempt to use the Instance Metadata Service Version 2 (IMDSv2). If the initial IMDSv2 call does not receive a response, the SDK retries and then falls back to IMDSv1, which can introduce a significant delay.

In a containerized environment like Terraform Enterprise, the network request to the instance metadata endpoint may involve an extra network hop to reach the host from within the container. If the IP hop limit for IMDSv2 responses is set to the default of 1, the response will not be returned to the container, causing the fallback behavior and potential timeouts.

Solutions

To resolve this issue, you must increase the hop limit for the EC2 instance's metadata service to at least 2. This allows the IMDSv2 response to traverse the extra network hop from the host to the container.

Solution 1: Update an Existing EC2 Instance

You can modify the metadata options for a running EC2 instance using the AWS CLI.

Execute the following command, replacing i-XXXXXXXXXXXX with your EC2 instance ID.

$ aws ec2 modify-instance-metadata-options \
    --instance-id i-XXXXXXXXXXXX \
    --http-put-response-hop-limit 2 \
    --http-endpoint enabled

Solution 2: Launch a New EC2 Instance

When launching a new EC2 instance that will host Terraform Enterprise, ensure that the metadata options are configured correctly at launch time. Set the http_put_response_hop_limit parameter to a value of 2 or greater in your launch configuration or template.

Additional Information

For more details on configuring instance metadata options, refer to the official AWS documentation on how to Configure the instance metadata options.