[vedanth-jadhav]

With RF_S3_IMDS=1, every storage operation waits for the same EC2 credential-refresh promise. Its three metadata fetches have no deadline and ignore HTTP status. A stalled request can hold all waiters indefinitely; an error or malformed credential response can overwrite the previous keys and cache an invalid expiration.

Bound the complete token/role/credentials exchange to one five-second abort signal. Reject HTTP errors at every stage, empty token/role responses, failed credential status, missing fields and invalid/expired timestamps. Assign the new keys and cache timestamps only after validation. The existing shared refresh, successful-credential reuse and retry-after-failure behavior remain in place. Static-key configurations retain their early return.

Validation on Linux x86_64 / Bun 1.4.4:

• 184 full render-farm tests pass, including 21 new cases. The initial 15-case regression set produced 14 failures against unchanged production code; the expanded final set covers HTTP 401/403/500 at all three stages.
• Covers invalid/expired credential payloads, preserved previous keys, successful retry, concurrent refresh coalescing, abort propagation to every waiter, and reuse after success. Abort ordering is controlled without timing assertions or metadata network access.
• Scoped strict TypeScript (noUncheckedIndexedAccess), Biome and git diff --check pass.
• Applied the separate S3 URI-signing fix fix(render-farm): use AWS URI encoding for S3 signatures #3355 locally: it combines cleanly and all 193 combined tests pass, with scoped strict TypeScript passing. The two PRs are independent and keep separate test files.

Reproduce: bun run --cwd apps/render-farm test. Real EC2 metadata and live AWS storage were not exercised. The five-second overall deadline deliberately fails a slow/unreachable metadata service instead of waiting indefinitely; callers can retry after the refresh promise clears. Errors do not include credential response bodies. No dependency, secret configuration or throughput changes.

Confidence Score: 5/5

This PR appears safe to merge.

Summary

Bounds the complete EC2 credential exchange to five seconds and checks responses before replacing cached credentials.

• S3 refreshes EC2 credentials within five seconds and saves them only after checks.

_{Reviews (1) · Last reviewed commit: "fix(render-farm): bound and validate ins..." · Reviewed by Greptile}

[vercel]

Someone is attempting to deploy a commit to the Cap Software Inc Team on Vercel.

A member of the Team first needs to authorize it.