func (mds *metadataService) getCredentials(w http.ResponseWriter, r *http.Request) {
	creds, err := mds.creds.GetCredentials()
	if err != nil {
		w.WriteHeader(500)
		fmt.Fprint(w, err.Error())
		return
	}
	resp := &securityCredentialsResponse{
		Code:            "Success",
		LastUpdated:     time.Now().UTC().Format(time.RFC3339),
		Type:            "AWS-HMAC",
		AccessKeyId:     *creds.AccessKeyId,
		SecretAccessKey: *creds.SecretAccessKey,
		Token:           *creds.SessionToken,
		Expiration:      creds.Expiration.UTC().Format(time.RFC3339),
	}
	respBody, err := json.Marshal(resp)
	if err != nil {
		panic(err)
	}
	w.Write(respBody)
}
/*
Returns credentials for interested clients.
package agent
import (
	"encoding/json"
	"fmt"
	"net"
	"net/http"
	"strings"
	"time"
	"github.com/AdRoll/hologram/log"
	"github.com/aws/aws-sdk-go/service/sts"
)
type MetadataService interface {
	Service
	Port() int
}
type credentialsSource interface {
	GetCredentials() (*sts.Credentials, error)
}
type metadataService struct {
	listener net.Listener
	creds    credentialsSource
	allowIps []*net.IPNet
}
func (mds *metadataService) Start() error {
	go mds.listen()
	return nil
}
func makeSecure(handler func(http.ResponseWriter, *http.Request), mds *metadataService) func(http.ResponseWriter, *http.Request) {
	return func(w http.ResponseWriter, r *http.Request) {
		ip, _, err := net.SplitHostPort(r.RemoteAddr)
		if err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		allowedIP := false
		parsedIP := net.ParseIP(ip)
		for _, ipNet := range mds.allowIps {
			allowedIP = allowedIP || ipNet.Contains(parsedIP)
		}
		if !allowedIP {
			msg := fmt.Sprintf("Access denied from %s, not in the set of allowed IPs", ip)
			log.Info("Rejecting connection from ip %s", ip)
			http.Error(w, msg, http.StatusUnauthorized)
			return
		}
		expectedHost := mds.listener.Addr().String()
		expectedHost = strings.Replace(expectedHost, "[::]", "localhost", 1)
		expectedHost = strings.Split(expectedHost, ":")[0]
		actualHost := strings.Split(r.Host, ":")[0]
		if actualHost != expectedHost {
			msg := fmt.Sprintf("Access denied from bad host: %s", r.Host)
			fmt.Println(msg)
			http.Error(w, msg, http.StatusUnauthorized)
			return
		}
		handler(w, r)
	}
}
func (mds *metadataService) listen() {
	handler := http.NewServeMux()
	handler.HandleFunc("/latest", makeSecure(mds.getServices, mds))
	handler.HandleFunc("/latest/meta-data/iam/security-credentials/", makeSecure(mds.enumerateRoles, mds))
	handler.HandleFunc("/latest/meta-data/iam/security-credentials/hologram-access", makeSecure(mds.getCredentials, mds))
	handler.HandleFunc("/latest/meta-data/instance-id", makeSecure(mds.getInstanceID, mds))
	handler.HandleFunc("/latest/meta-data/placement/availability-zone", makeSecure(mds.getAvailabilityZone, mds))
	handler.HandleFunc("/latest/meta-data/public-hostname", makeSecure(mds.getPublicDNS, mds))
	err := http.Serve(mds.listener, handler)
	if err != nil {
		if strings.HasSuffix(err.Error(), "use of closed network connection") {
			return
		}
		panic(err)
	}
}
func (mds *metadataService) Stop() error {
	return mds.listener.Close()
}
func (mds *metadataService) Port() int {
	return mds.listener.Addr().(*net.TCPAddr).Port
}
func (mds *metadataService) enumerateRoles(w http.ResponseWriter, r *http.Request) {
	fmt.Fprint(w, "hologram-access")
}
func (mds *metadataService) getServices(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Server", "EC2ws")
	fmt.Fprint(w, "meta-data")
}
func (mds *metadataService) getInstanceID(w http.ResponseWriter, r *http.Request) {
	fmt.Fprint(w, "i-deadbeef")
}
func (mds *metadataService) getAvailabilityZone(w http.ResponseWriter, r *http.Request) {
	fmt.Fprint(w, "us-west-2x")
}
func (mds *metadataService) getPublicDNS(w http.ResponseWriter, r *http.Request) {
	fmt.Fprint(w, "ec2-0-0-0-0.us-west-2.compute.amazonaws.com")
}