From aee49e54684fe9154cb851e89e14ea46126759c1 Mon Sep 17 00:00:00 2001
From: Paul Czarkowski <username.taken@gmail.com>
Date: Wed, 28 Aug 2024 11:27:44 -0400
Subject: [PATCH 1/2] enforce imsdv2

Signed-off-by: Paul Czarkowski <username.taken@gmail.com>
---
 Makefile    |  2 +-
 bastion.tf  |  5 ++++-
 cluster.tf  | 12 ++++++------
 provider.tf |  6 +++---
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/Makefile b/Makefile
index cc47f77a..5fcc815f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 init:
-	@terraform init
+	@terraform init -upgrade
 
 plan:
 	@export TF_VAR_token="$$(bw get password ocm-api-key)" && terraform plan -out main.plan -var-file=main.tfvars
diff --git a/bastion.tf b/bastion.tf
index f7157593..fbf0fc8b 100644
--- a/bastion.tf
+++ b/bastion.tf
@@ -134,7 +134,10 @@ resource "aws_instance" "bastion_host" {
   associate_public_ip_address = var.bastion_public_ip
   key_name               = aws_key_pair.bastion_host[0].key_name
   vpc_security_group_ids = [aws_security_group.bastion_host[0].id]
-
+  metadata_options {
+    http_tokens = "required"
+    http_endpoint = "enabled"
+  }
   tags = local.bastion_tags
 
   user_data = <<EOF
diff --git a/cluster.tf b/cluster.tf
index bce7dc8a..98e84250 100644
--- a/cluster.tf
+++ b/cluster.tf
@@ -50,7 +50,7 @@ resource "rhcs_cluster_rosa_classic" "rosa" {
   cloud_region   = var.region
   aws_account_id = data.aws_caller_identity.current.account_id
   tags           = var.tags
-
+  ec2_metadata_http_tokens = "required"
   # autoscaling and instance settings
   compute_machine_type = var.compute_machine_type
   autoscaling_enabled  = local.autoscaling
@@ -98,11 +98,11 @@ resource "rhcs_cluster_rosa_hcp" "rosa" {
   name = var.cluster_name
 
   # aws
-  cloud_region           = var.region
-  aws_account_id         = data.aws_caller_identity.current.account_id
-  aws_billing_account_id = data.aws_caller_identity.current.account_id
-  tags                   = var.tags
-
+  cloud_region             = var.region
+  aws_account_id           = data.aws_caller_identity.current.account_id
+  aws_billing_account_id   = data.aws_caller_identity.current.account_id
+  tags                     = var.tags
+  ec2_metadata_http_tokens = "required"
   # autoscaling and instance settings
   compute_machine_type = var.compute_machine_type
   replicas             = coalesce(var.replicas, local.replicas)
diff --git a/provider.tf b/provider.tf
index 38750474..6f80c06b 100644
--- a/provider.tf
+++ b/provider.tf
@@ -1,13 +1,13 @@
 terraform {
   required_providers {
     rhcs = {
-      version = ">= 1.6.2"
-      source  = "terraform-redhat/rhcs"
+      source = "terraform-redhat/rhcs"
+      version = "1.6.3-prerelease.2"
     }
 
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.20.0"
+      version = ">= 5.64.0"
     }
     validation = {
       source  = "tlkamp/validation"

From 54e0896252ac215099215a84efe7e287ab9ef819 Mon Sep 17 00:00:00 2001
From: Paul Czarkowski <username.taken@gmail.com>
Date: Wed, 28 Aug 2024 11:41:46 -0400
Subject: [PATCH 2/2] fix indent on providers

Signed-off-by: Paul Czarkowski <username.taken@gmail.com>
---
 provider.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider.tf b/provider.tf
index 6f80c06b..248daef2 100644
--- a/provider.tf
+++ b/provider.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     rhcs = {
-      source = "terraform-redhat/rhcs"
+      source  = "terraform-redhat/rhcs"
       version = "1.6.3-prerelease.2"
     }