aws / aws/amazon-ssm-agent

SSM-Agent not using FIPS endpoints, on FIPS enabled EKS Worker Node

Open
#558 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

**What happened:**
When FIPS is enabled on an EKS worker node, the SSM-Agent installed from the amazon-eks-ami is not using FIPS endpoints when making requests between the ec2messages and ssmmessages API endpoints.

**What you expected to happen:**
When `sysctl -n crypto.fips_enabled` evaluates to `1` on the EKS worker node, requests between the SSM-Agent and the ec2messages + ssmmessages API endpoints would use the FIPS service endpoints.

**How to reproduce it (as minimally and precisely as possible):**
Within `/etc/amazon/ssm`, editing the `amazon-ssm-agent.json.template` with the following values and not removing any default keys:
```
{ ..
"Mds": { ..
"Region": "us-gov-east-1",
"Endpoint": "ec2messages-fips.us-gov-east-1.amazonaws.com"
},
"Mgs": { ..
"Region": "us-gov-east-1",
"Endpoint": "ssmmessages-fips.us-gov-east-1.amazonaws.com"
}
}
```
On a FIPS enabled machine, monitor traffic between the SSM-Agent and the ec2messages + ssmmessages API endpoints. The current default behavior is to not use FIPS service endpoints.

Observing log output from `journalctl -u amazon-ssm-agent` shows the agent is able to be restarted and is running.
The host is still showing as `Healthy` and is able to be pinged, reporting from the AWS SSM Fleet Manager view.

Contributor guide

Open the contributing guide

Research direction

Start with the SSM-Agent configuration at /etc/amazon/ssm/amazon-ssm-agent.json.template and inspect how the Mds and Mgs Endpoint values are selected when sysctl -n crypto.fips_enabled returns 1. Use journalctl -u amazon-ssm-agent and monitor requests to verify that ec2messages and ssmmessages use their FIPS endpoints on a FIPS-enabled EKS worker node.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
cloud, networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.