fix: removes content-header from AWS IMDS get request

[chalmerlowe]

When performing a IMDS request, the code incorrectly adds a content-type header to the request:

content-type: application/json to AWS metadata (IMDS) GET requests.`

Some services at AWS (such as AWS SageMaker Jupyter notebook) have a stricter than normal metadata server (IMDS, both v1 and v2) when it comes to handling incoming http requests.

This PR removes the default content-header and replaces it with None.

NOTE: initializing headers to None (instead of an empty dict) when no session token is present matches the existing behavior in _get_metadata_role_name and allows the transport adapter to handle default headers cleanly.

This PR updates existing unit tests (tests/test_aws.py) to match the new behavior.

NOTE: closing PR #1489 due to inactivity as we make the push to migrate this library to the google-cloud-python monorepo

For more information about the genesis of this, see the following issue: https://issuetracker.google.com/issues/328089077

[gemini-code-assist]

Summary of Changes

Hello @chalmerlowe, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves an issue where AWS IMDS GET requests were incorrectly including a Content-Type: application/json header, causing failures with stricter AWS metadata servers, particularly in environments like AWS SageMaker. The fix involves removing this default header, ensuring that requests are properly handled by the metadata service.

Highlights

• AWS IMDS Request Headers: Modified the _get_metadata_security_credentials function in google/auth/aws.py to no longer include a default Content-Type: application/json header in AWS IMDS GET requests. The headers variable is now initialized to None.
• AWS IMDS Compatibility: This change addresses compatibility issues with stricter AWS metadata servers (such as those found in AWS SageMaker Jupyter notebooks) that reject requests containing unnecessary Content-Type headers.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

The pull request correctly removes an unnecessary Content-Type header from AWS IMDS GET requests, which resolves compatibility issues with certain AWS services. However, the current implementation introduces a critical runtime error when an IMDSv2 session token is present, as it attempts to modify a None object.

[gemini-code-assist]

The change on this line initializes headers to None. However, if imdsv2_session_token is not None, the subsequent line (line 535) attempts to add an item to headers using headers["X-aws-ec2-metadata-token"] = imdsv2_session_token. This will result in a TypeError because NoneType objects do not support item assignment. To prevent this critical runtime error, headers should be initialized to an empty dictionary ({}) if it is intended to be mutable and potentially hold headers. While the PR description mentions initializing to None to match _get_metadata_role_name, the implementation pattern in _get_metadata_role_name involves reassigning headers to a dictionary, not modifying a None object.

headers = {}