Agent does not connect to SSM (version 3.3.1611.0) after boot
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
When booting an OnPremise system, Ubuntu 22.04 + Raspberry Pi4, after having been offline for atleast 30 minutes I get the following error in the Agent log:
Agent version: 3.3.1611.0, (update: installed using the deb package)
```
2025-02-05 08:27:45.6674 INFO [ssm-agent-worker] Entering SSM Agent hibernate - InvalidSignatureException: Signature expired: 20250205T072745Z is now earlier than 20250205T075620Z (20250205T080120Z - 5 min.)
status code: 400, request id: 5f020efe-47da-444d-ac8a-c86f767c7eda
```
Boot time was 20250205T080120Z, and it recognizes that the signature of the credentials have expired, but it does not request new ones.
Observations:
- Manually restarting with `systemctl restart amazon-ssm-agent.service` immediately resolves the problem, as it will collect new credentials.
- Waiting for 5+ minutes sometimes resolves the issue.
- The issue is not present if you directly reboot as the credentials are still valid.
- Rebooting a system where the agent did not connect after boot seems to resolve the issue.
- Issue observed on two devices (one a clean install of Agent, one being upgraded via SSM)
Contributor guide
Research direction
Reproduce the boot after at least 30 minutes offline on Ubuntu 22.04 with a Raspberry Pi 4, then inspect the Agent log and the amazon-ssm-agent.service behavior around the expired signature. Done means the agent obtains fresh credentials and reconnects after boot without a manual service restart or waiting several minutes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, linux, raspberry-pi, ubuntu
- Domain
- cloud, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100