Skip to content

[v13] AWS OIDC: Only consider Linux/UNIX when listing EC2 instances #33514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcoandredinis merged 2 commits into from
Oct 16, 2023
Merged

[v13] AWS OIDC: Only consider Linux/UNIX when listing EC2 instances #33514

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c7d0efd
AWS OIDC: Only consider Linux/UNIX when listing EC2 instances
marcoandredinis Oct 10, 2023
0d7bfec
use aws.ToString to check nil strings
marcoandredinis Oct 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions lib/integrations/awsoidc/listec2.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,10 @@ const (
// https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
// Used for filtering instances.
awsInstanceStateName = "instance-state-name"

// describeEC2PlatformDetailsFilter is a filter for EC2 DescribeInstances operation that filters per Platform Details.
describeEC2PlatformDetailsFilter = "platform-details"
describeEC2PlatformDetailsFilterLinuxUNIX = "Linux/UNIX"
)

var (
Expand All @@ -43,6 +47,15 @@ var (
Name: aws.String(awsInstanceStateName),
Values: []string{string(ec2Types.InstanceStateNameRunning)},
}

// filterEC2PlatformLinuxUNIX is an EC2 DescribeInstances Filter to filter for Linux/UNIX instances.
// AWS Docs have multiple values for identifying Linux hosts.
// However, from our tests only the values Linux/UNIX and Windows are returned.
// ListEC2 is only meant for accessing EC2 instances using SSH, so our only supported platform is Linux.
filterEC2PlatformLinuxUNIX = ec2Types.Filter{
Name: aws.String(describeEC2PlatformDetailsFilter),
Values: []string{describeEC2PlatformDetailsFilterLinuxUNIX},
}
)

// ListEC2Request contains the required fields to list AWS EC2 Instances.
Expand Down Expand Up @@ -122,6 +135,7 @@ func NewListEC2Client(ctx context.Context, req *AWSClientRequest) (ListEC2Client
// ListEC2 calls the following AWS API:
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
// It returns a list of EC2 Instances and an optional NextToken that can be used to fetch the next page
// Only PlatformDetails=Linux/UNIX and State=Running instances are returned.
func ListEC2(ctx context.Context, clt ListEC2Client, req ListEC2Request) (*ListEC2Response, error) {
if err := req.CheckAndSetDefaults(); err != nil {
return nil, trace.Wrap(err)
Expand All @@ -139,6 +153,7 @@ func ListEC2(ctx context.Context, clt ListEC2Client, req ListEC2Request) (*ListE
describeEC2Instances := &ec2.DescribeInstancesInput{
Filters: []ec2Types.Filter{
filterRunningEC2Instance,
filterEC2PlatformLinuxUNIX,
},
}
if req.NextToken != "" {
Expand All @@ -150,10 +165,8 @@ func ListEC2(ctx context.Context, clt ListEC2Client, req ListEC2Request) (*ListE
return nil, trace.Wrap(err)
}

ret := &ListEC2Response{}

if aws.ToString(ec2Instances.NextToken) != "" {
ret.NextToken = *ec2Instances.NextToken
ret := &ListEC2Response{
NextToken: aws.ToString(ec2Instances.NextToken),
}

ret.Servers = make([]types.Server, 0, len(ec2Instances.Reservations))
Expand Down
14 changes: 14 additions & 0 deletions lib/integrations/awsoidc/listec2_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,20 @@ func (m *mockListEC2Client) GetCallerIdentity(ctx context.Context, params *sts.G
func (m mockListEC2Client) DescribeInstances(ctx context.Context, params *ec2.DescribeInstancesInput, optFns ...func(*ec2.Options)) (*ec2.DescribeInstancesOutput, error) {
requestedPage := 1

stateFilter := false
platformFilter := false
for _, filter := range params.Filters {
if aws.ToString(filter.Name) == "instance-state-name" && len(filter.Values) == 1 && filter.Values[0] == "running" {
stateFilter = true
}
if aws.ToString(filter.Name) == "platform-details" && len(filter.Values) == 1 && filter.Values[0] == "Linux/UNIX" {
platformFilter = true
}
}
if !stateFilter || !platformFilter {
return nil, trace.BadParameter("instance-state-name and platform-details filters were not included")
}

totalInstances := len(m.ec2Instances)

if params.NextToken != nil {
Expand Down