aws / aws/amazon-ssm-agent

openning 2 ssm sessions in parallel for the first time attempts to create duplicate ssm-user

Open
#573 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

We have a script that opens 2 ssm sessions in parallel, and on a brand new ec2 instance, when we run this script, it messed up the ssm-user's home directory permissions:

```
id
uid=30034(ssm-user) gid=30034(ssm-user) groups=30034(ssm-user)
ssm-user@ip:/var/snap/amazon-ssm-agent/7993$ echo $HOME
/home/ssm-user
ssm-user@ip:/var/snap/amazon-ssm-agent/7993$ sudo ls -ld $HOME
drwxr-x--- 2 30033 30033 4096 Jun 10 13:58 /home/ssm-user
```

```
2024-06-10 13:57:10 INFO [ssm-session-worker] [REDACTED-1] [DataBackend] [pluginName=InteractiveCommands] Successfully created ssm-user
2024-06-10 13:57:10 INFO [ssm-session-worker] [REDACTED-2] [DataBackend] [pluginName=InteractiveCommands] Successfully created ssm-user
```

There should be some kind of safety / lock in place to prevent the ssm-agent from attempting to create multiple users with the same login at the same time on initial login.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue by opening two SSM sessions in parallel on a brand-new EC2 instance, then trace the agent path that creates ssm-user and compare the two session-worker log entries. Done means concurrent first-time sessions cannot create duplicate users or leave /home/ssm-user owned by the wrong uid and gid.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
cloud, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.