Fix credential rotation issue for ECS-A Windows #3184
Conversation
vsiddharth
force-pushed
the
ecs-a-creds-win
branch
2 times, most recently
from
7b319e4
to
5212e8f
Compare
agent/credentials/providers/credentials_filename_unsupported.go
Outdated
Show resolved
Hide resolved
vsiddharth
force-pushed
the
ecs-a-creds-win
branch
from
5212e8f
to
8ec70ad
Compare
vsiddharth
force-pushed
the
ecs-a-creds-win
branch
from
8ec70ad
to
8c2c733
Compare
Credentials were not being rotated properly on ECS-A Windows instances. This patch addresses the issue by using the correct file-paths for credentials on supported platforms. The credential chain hierarchy is also updated on ECS-A windows to ensure that credential chain is not broken for other launch types. Signed-off-by: Siddharth Vinothkumar <sidvin@amazon.com>
vsiddharth
force-pushed
the
ecs-a-creds-win
branch
from
8c2c733
to
327cc6b
Compare
| // 2. Shared credentials file (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) (file at ~/.aws/credentials containing access key id and secret access key). | ||
| // 3. EC2 role credentials. This is an IAM role that the user specifies when they launch their EC2 container instance (ie ecsInstanceRole (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html)). | ||
| // 4. Rotating shared credentials file located at /rotatingcreds/credentials | ||
| func GetCredentials(isExternal bool) *credentials.Credentials { |
There was a problem hiding this comment.
For Linux mark this as _ since its unused right?
|
@vsiddharth before merging should you also consider bumping the go version to |
The agent is already using go
Can you please provide additional context on this? |
I think windows/arm64 would be a larger feature to support, are you currently custom-building the ecs agent to run on that platform? |
|
No, we do not currently run on I mistakenly looked at https://github.com/aws/amazon-ecs-agent/blob/master/.travis.yml and thought go |
Summary
Fix credential rotation issue for ECS-A Windows
Implementation details
Credentials were not being rotated properly on ECS-A Windows instances.
This patch addresses the issue by using the correct file-paths for
credentials on supported platforms. The credential chain hierarchy is
also updated on ECS-A windows to ensure that credential chain is not
broken for other launch types.
Testing
Manually updated the ECS-Agent on both ECS/EC2 and ECS/ECS-A Windows instances to validate credentials being refreshed.
New tests cover the changes: No
Description for the changelog
Bug - Fixed credential rotation issue with ECS-A WindowsLicensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.