aws / aws/amazon-ssm-agent

Make disable Message configurable

Open
#419 4 comments 4 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

## Backgroud
In our team, we adopt SSM session manager as the only way to SSH to our production instances and installed amazon ssm agent. As a security concern, we disabled other SSM features by locking down the SSM permissions to
```
"ssm:UpdateInstanceInformation",
"ssmmessages:CreateControlChannel",
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenControlChannel",
"ssmmessages:OpenDataChannel"
```

## What's the problem
We saw lots of AccessDeniedException message from `ec2messages:GetMessages`, `ssm:ListAssociations`, `ssm:ListInstanceAssociations` and so on. Every minute, there are a bunch of these kinds of error messages, and users are complaining about it a little bit. So we want to avoid them.
```
ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessagingDeliveryService] [Association] error when calling AWS APIs. error details - AccessDeniedException: User: xxx is not authorized to perform: ssm:ListInstanceAssociations on resource: arn:xxx because no identity-based policy allows the ssm:ListInstanceAssociations action
ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessagingDeliveryService] [messageID=aws.ssm.e0808a75-a37d-495a-bdb7-9cdce719b16f.i-0349e0c2394f469cf] error when calling AWS APIs. error details - AcknowledgeMessage Error: AccessDeniedException: User: xxx is not authorized to perform: ec2messages:AcknowledgeMessage on resource: arn:xxx because no identity-based policy allows the ec2messages:AcknowledgeMessage action
status code: 400, request id: abfe2526-618b-4cdb-84a7-c46c2c10fa59
ERROR [checkStopPolicy @ scheduler.go.108] [ssm-agent-worker] [MessagingDeliveryService] MessagingDeliveryService stopped temporarily due to internal failure. We will retry automatically after 15 minutes
```

## What we want

As we don't want to open these permissions to our production instance, we hope to have a toggle `enabled` under `MessagingDeliveryService` configurations and let us config `disable`, then MessagingDeliveryService will not make these API calls.
Configuration in `amazon-ssm-agent.json` looks like this:
```
"Mds": {
"Enabled": false
}

Contributor guide

Open the contributing guide

Research direction

Start with the MessagingDeliveryService implementation and the amazon-ssm-agent.json configuration, then trace the paths that call ec2messages and SSM association APIs. Done means an Mds.Enabled setting can disable those calls without the reported AccessDeniedException messages, while the existing behavior remains available when enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
backend, cloud
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.