Make disable Message configurable
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
## Backgroud
In our team, we adopt SSM session manager as the only way to SSH to our production instances and installed amazon ssm agent. As a security concern, we disabled other SSM features by locking down the SSM permissions to
```
"ssm:UpdateInstanceInformation",
"ssmmessages:CreateControlChannel",
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenControlChannel",
"ssmmessages:OpenDataChannel"
```
## What's the problem
We saw lots of AccessDeniedException message from `ec2messages:GetMessages`, `ssm:ListAssociations`, `ssm:ListInstanceAssociations` and so on. Every minute, there are a bunch of these kinds of error messages, and users are complaining about it a little bit. So we want to avoid them.
```
ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessagingDeliveryService] [Association] error when calling AWS APIs. error details - AccessDeniedException: User: xxx is not authorized to perform: ssm:ListInstanceAssociations on resource: arn:xxx because no identity-based policy allows the ssm:ListInstanceAssociations action
ERROR [HandleAwsError @ awserr.go.49] [ssm-agent-worker] [MessagingDeliveryService] [messageID=aws.ssm.e0808a75-a37d-495a-bdb7-9cdce719b16f.i-0349e0c2394f469cf] error when calling AWS APIs. error details - AcknowledgeMessage Error: AccessDeniedException: User: xxx is not authorized to perform: ec2messages:AcknowledgeMessage on resource: arn:xxx because no identity-based policy allows the ec2messages:AcknowledgeMessage action
status code: 400, request id: abfe2526-618b-4cdb-84a7-c46c2c10fa59
ERROR [checkStopPolicy @ scheduler.go.108] [ssm-agent-worker] [MessagingDeliveryService] MessagingDeliveryService stopped temporarily due to internal failure. We will retry automatically after 15 minutes
```
## What we want
As we don't want to open these permissions to our production instance, we hope to have a toggle `enabled` under `MessagingDeliveryService` configurations and let us config `disable`, then MessagingDeliveryService will not make these API calls.
Configuration in `amazon-ssm-agent.json` looks like this:
```
"Mds": {
"Enabled": false
}
Contributor guide
Research direction
Start with the MessagingDeliveryService implementation and the amazon-ssm-agent.json configuration, then trace the paths that call ec2messages and SSM association APIs. Done means an Mds.Enabled setting can disable those calls without the reported AccessDeniedException messages, while the existing behavior remains available when enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- backend, cloud
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100