Fetch tags for an EC2 instance

get_instance_tags.pl

#!/usr/bin/perl

use Data::Dumper;
use Digest::SHA;
use JSON;
use URI::Escape;
use XML::Simple;

use constant {
  ENDPOINT => 'ec2.us-west-2.amazonaws.com',
  PATH     => '/',
};

$instance_id = `curl http://169.254.169.254/latest/meta-data/instance-id 2> /dev/null`;

$r = aws_api(Action => 'DescribeTags', 'Filter.1.Name' => 'resource-id', 'Filter.1.Value.1' => $instance_id, Version => '2015-10-01');
%tags = %{$r->{tagSet}{item}};
$tags{$_} = $tags{$_}{value} for keys %tags;

print Dumper \%tags;

sub aws_api {
  my($credentials, $d, %params, $query, $signature, $url);

  $credentials = decode_json scalar `curl http://169.254.169.254/latest/meta-data/iam/security-credentials/CFInstance 2> /dev/null`;
  chomp($d = `date -u '+%FT%TZ'`);

  %params = (
    @_,
    'AWSAccessKeyId'   => $credentials->{AccessKeyId},
    'SignatureVersion' => '2',
    'SignatureMethod'  => 'HmacSHA256',
    'SecurityToken'    => $credentials->{Token},
    'Timestamp'        => $d,
  );
  $query = join '&', map {"$_=" . uri_escape $params{$_}} sort keys %params;

  $signature = uri_escape substr(Digest::SHA::hmac_sha256_base64(join("\n", 'GET', ENDPOINT, PATH, $query), $credentials->{SecretAccessKey}) . '=' x 44, 0, 44);
  $url = 'https://' . ENDPOINT . PATH . '?' . $query . '&Signature=' . $signature;

  return XMLin(scalar `curl '$url' 2> /dev/null`);
}