SSM-Agent not using FIPS endpoints, on FIPS enabled EKS Worker Node
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
**What happened:**
When FIPS is enabled on an EKS worker node, the SSM-Agent installed from the amazon-eks-ami is not using FIPS endpoints when making requests between the ec2messages and ssmmessages API endpoints.
**What you expected to happen:**
When `sysctl -n crypto.fips_enabled` evaluates to `1` on the EKS worker node, requests between the SSM-Agent and the ec2messages + ssmmessages API endpoints would use the FIPS service endpoints.
**How to reproduce it (as minimally and precisely as possible):**
Within `/etc/amazon/ssm`, editing the `amazon-ssm-agent.json.template` with the following values and not removing any default keys:
```
{ ..
"Mds": { ..
"Region": "us-gov-east-1",
"Endpoint": "ec2messages-fips.us-gov-east-1.amazonaws.com"
},
"Mgs": { ..
"Region": "us-gov-east-1",
"Endpoint": "ssmmessages-fips.us-gov-east-1.amazonaws.com"
}
}
```
On a FIPS enabled machine, monitor traffic between the SSM-Agent and the ec2messages + ssmmessages API endpoints. The current default behavior is to not use FIPS service endpoints.
Observing log output from `journalctl -u amazon-ssm-agent` shows the agent is able to be restarted and is running.
The host is still showing as `Healthy` and is able to be pinged, reporting from the AWS SSM Fleet Manager view.
Contributor guide
Research direction
Start with the SSM-Agent configuration at /etc/amazon/ssm/amazon-ssm-agent.json.template and inspect how the Mds and Mgs Endpoint values are selected when sysctl -n crypto.fips_enabled returns 1. Use journalctl -u amazon-ssm-agent and monitor requests to verify that ec2messages and ssmmessages use their FIPS endpoints on a FIPS-enabled EKS worker node.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- cloud, networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100