aws / aws/amazon-cloudwatch-agent
read tags through metadata not iam-rights (describetags)
Open
enhancement
- Dominant language
- Go
- Stars
- 550
- Forks
- 271
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 13
Description
If using auto scaling dimensions the IAM right describetags is needed. It would be better to read tags with the help of metadata when enabled.
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:21600" 2>/dev/null)
$(curl -H "X-aws-ec2-metadata-token:$TOKEN" -s http://169.254.169.254/latest/meta-data/tags/instance/Name)
Contributor guide
Research direction
Search the agent for its DescribeTags usage and the configuration controlling metadata-based tag reads. Compare that path with the supplied IMDSv2 token and instance-tags endpoints, then verify that auto scaling dimensions can obtain tags without the ec2:DescribeTags permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100