Introduce a new aws_iid configuration option 'disable_instance_profile_selectors'

[kgtw]

Pull Request check list

• Commit conforms to CONTRIBUTING.md?
• Proper tests/regressions included?
• Documentation updated?

Affected functionality

Setting disable_instance_profile_selectors = true means that iam instance profile information isn't available in selectors.

Description of change

This is needed when spire-server is running in a secure area with no public internet access.

If an attesting node has an iam instance profile policy attached and there is no public internet access, spire-server fails to attest the nodes because it cannot reach the aws iam endpoint - iam.amazonaws.com - which is used to retrieve the instance iam profile information.

Which issue this PR fixes

[azdagron]

Thanks for opening this @kgtw.

This is needed when spire-server is running in a secure area with no public internet access.

If the goal here is for the AWS IID attestor to function without Internet, I don't think this PR is going to achieve that successfully. Consulting AWS for the instance profile for selectors but one place where we consult the AWS APIs.

I would suggest the following:

• Rename the configurable to something like disable_aws_api_use
• Review the other uses of the AWS API in the plugin. Some of these we call unconditionally; others are only called under specific configurations. All of these will have to be disabled by the new flag.

[JonathanO]

@azdagron I believe this is only a problem for the iam API endpoint specifically, as it's a global endpoint. The EC2 API endpoint is regional, so doesn't require public Internet access to reach it.

[azdagron]

🤦‍♂️ Thanks for that insight, @JonathanO. Re-reviews...

[azdagron]

@kgtw , @JonathanO, what would your thoughts be on rename of the configurable to something like no_public_internet. Then it is at least clear from the configurable name under what circumstance it would be appropriate to set the configurable. Barring that, if we keep the original name, we probably want a small subsection in the documentation discussing why the configurable is necessary and the outcome of setting it. I'm ok with either course.

[evan2645]

a small subsection in the documentation discussing why the configurable is necessary and the outcome of setting it

E.g. "Using this plugin without internet access" section, which then captures the necessary configuration.

[kgtw]

Thanks for the comments @azdagron @evan2645

I think keeping the current naming is more descriptive of what it's used for. I will add some additional documentation describing the use-cases of using it and what it means when it is disabled.

[azdagron]

This is needed as spire-server will fail to start.

I could see it failing agent attestation, but how does it cause the server to not start?

[kgtw]

Ah yes, you're right. Let me fix the wording of that.

[azdagron]

Thanks, @kgtw !