aws / aws/amazon-ssm-agent

Error running ChefInspecChecks

Open
#195 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

I am getting an continuous error when attempting to perform a Systems Manager Association, AWS-RunInspecChecks. I am trying to make a STIG compliant RHEL7 image and when I run the Inspec Checks, it takes a very long time, as much as 25-30 minutes. The Association then fails due to the following message:

/opt/chefdk/embedded/lib/ruby/2.6.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) (Seahorse::Client::NetworkingError)

When I look at the logs in the /var/log/messages directory on the instance, I see errors caused by this:

Post https://ssm.us-gov-west-1.amazonaws.com/: x509: certificate signed by unknown authority

When I run the Inspec Checks on the instance before "stigging it up", the association succeeds and I can see the non-compliant issues that need to be addressed. However once the issues are addressed, the association fails due to what appears to be an SSL cert issue.

ssm is currently installed and running on the instance
permissions are correctly set and associated

Contributor guide

Open the contributing guide

Research direction

Reproduce the AWS-RunInspecChecks association before and after applying the STIG changes, then inspect /var/log/messages and the reported /opt/chefdk/embedded/lib/ruby/2.6.0/net/protocol.rb failure. Compare the certificate chain and trust configuration used for https://ssm.us-gov-west-1.amazonaws.com/. Done means identifying the changed trust condition or documenting the missing information needed to isolate it.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, linux, ruby
Domain
cloud, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.