[phils]

Description

This PR adds support for AWS EC2's HttpProtocolIpv6 setting (http_protocol_ipv6 = "enabled" | "disabled") to the metadata_options configuration block.

Background & Use Case

AWS EC2 supports accessing instance metadata over IPv6 via http://[fd00:ec2::254], which is essential for instances launched in IPv6-only subnets or IPv6-first architectures where IPv4 link-local addressing is disabled or not routed.

While packer-plugin-amazon already supports http_endpoint, http_tokens, and http_put_response_hop_limit, it lacks support for http_protocol_ipv6. Because AWS defaults HttpProtocolIpv6 to disabled, builder instances in IPv6-only environments cannot reach IMDS. Exposing http_protocol_ipv6 = "enabled" provides full parity with the AWS EC2 metadata options API and allows builds to run seamlessly in IPv6-only networks.

Changes

• Added http_protocol_ipv6 to MetadataOptions struct in common (SDK v2) and builder/common (SDK v1), defaulting to "disabled" with validation for "enabled" / "disabled".
• Propagated HttpProtocolIpv6 to StepRunSourceInstance (RunInstances) and StepRunSpotInstance (CreateLaunchTemplate).
• Wired Metadata.HttpProtocolIpv6 across ebs, ebssurrogate, and ebsvolume builders.
• Updated HCL2 specifications and documentation partials.
• Added unit tests for validation, defaulting, and parameter propagation to EC2.

Resolved Issues

Closes #708

Rollback Plan

If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

None. This parameter exposes existing AWS EC2 instance metadata options to control whether the IMDS endpoint is accessible over IPv6.

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Phil Sweeney seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hariom-hashicorp]

Overall, this PR looks great!

Optional enhancement: Consider adding validation for the edge case where http_endpoint = "disabled" and http_protocol_ipv6 = "enabled" are both set. This combination is semantically invalid (disabling the endpoint prevents IMDS access over both IPv4 and IPv6), and currently causes a nil pointer panic because MetadataOptions is not initialized.

If you'd like to add this safeguard, something like:

if c.Metadata.HttpEndpoint == "disabled" && c.Metadata.HttpProtocolIpv6 == "enabled" {
    errs = append(errs, fmt.Errorf(
        "http_protocol_ipv6 can only be enabled when http_endpoint is enabled",
    ))
}

This is optional—the PR is solid without it. The same pattern also exists for instance_metadata_tags if you want to address that pre-existing case as a follow-up.

[phils]

Thanks @hariom-hashicorp I will take a look this week.

[phils]

Thanks for the review @hariom-hashicorp!

I've rebased on the latest main and added validation for both cases where http_endpoint = "disabled":

Unit tests covering both scenarios have also been added.

[hariom-hashicorp]

Thanks @phils LGTM, ready to merge ✅