We have been using Elasticsearch for storing our application data, and are extensively using the EC2 discovery plugin and S3 plugin. As per AWS best practices, we are making use of the EC2 instance metadata to get the required auth tokens for EC2 discovery and S3 snapshots, and dont make use of any access_keys and secret_access_keys. Following is the elasticsearch.yml file:

**discovery.seed_providers: ec2 
discovery.ec2.tag.cluster_name: elasticsearch
network.host: \_ec2:privateIpv4_\
http.port: 9200
discovery.ec2.endpoint: ec2.ap-south-1.amazonaws.com
cloud.node.auto_attributes: true
cluster.routing.allocation.awareness.attributes: aws_availability_zone
logger.org.elasticsearch.discovery.ec2: "WARN"**
 
Recently during our security audit, we got to know about a new Session oriented way of interacting with the EC2 metadata plugin. More info [here](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). As this was a more secured way, we tried it out in our lower environments, which led to our Elasticsearch clusters go into YELLOW state. The reason for this is that the nodes were not able to get the availability zone by querying the instance metadata service.

Logs for the same:

`{"type": "server", "timestamp": "2021-11-05T07:31:59,234Z", "level": "DEBUG", "component": "o.e.d.e.Ec2DiscoveryPlugin", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-2", "message": "obtaining ec2 [placement/availability-zone] from ec2 meta-data url http://169.254.169.254/latest/meta-data/placement/availability-zone" }
{"type": "server", "timestamp": "2021-11-05T07:31:59,321Z", "level": "ERROR", "component": "o.e.d.e.Ec2DiscoveryPlugin", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-2", "message": "failed to get metadata for [placement/availability-zone]", 
"stacktrace": ["java.io.IOException: Server returned HTTP response code: 401 for URL: http://169.254.169.254/latest/meta-data/placement/availability-zone",
`

I am not really sure if this is already implemented or not, as I could not find any documentation for the same. It would be great if we could support this new way of authorization, if not supported yet :)
plugins/discovery-ec2/src/test/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPluginTests.java
assertThat(((BasicSessionCredentials) credentials).getSessionToken(), is("ec2_session_token_1"));
                    } else {
                        assertThat(credentials, instanceOf(BasicAWSCredentials.class));
                    }
                    assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyUsername(), is("proxy_username_1"));
                    assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyPassword(), is("proxy_password_1"));
                    assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyHost(), is("proxy_host_1"));
                    assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyPort(), is(881));
                    assertThat(((AmazonEC2Mock) clientReference.client()).endpoint, is("ec2_endpoint_1"));
                }
            }
            try (AmazonEc2Reference clientReference = plugin.ec2Service.client()) {
                final AWSCredentials credentials = ((AmazonEC2Mock) clientReference.client()).credentials.getCredentials();
                assertThat(credentials.getAWSAccessKeyId(), is("ec2_access_2"));
                assertThat(credentials.getAWSSecretKey(), is("ec2_secret_key_2"));
                if (mockSecure2HasSessionToken) {
                    assertThat(credentials, instanceOf(BasicSessionCredentials.class));
                    assertThat(((BasicSessionCredentials) credentials).getSessionToken(), is("ec2_session_token_2"));
                } else {
                    assertThat(credentials, instanceOf(BasicAWSCredentials.class));
                }
                assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyUsername(), is("proxy_username_2"));
                assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyPassword(), is("proxy_password_2"));
                assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyHost(), is("proxy_host_2"));
                assertThat(((AmazonEC2Mock) clientReference.client()).configuration.getProxyPort(), is(882));
                assertThat(((AmazonEC2Mock) clientReference.client()).endpoint, is("ec2_endpoint_2"));
            }
        }
    }
    private static class Ec2DiscoveryPluginMock extends Ec2DiscoveryPlugin {