aws / aws/containers-roadmap

[ECS] [request]: make bind-mounted SSM agent updatable

Open
#1,617 0 comments 3 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Update (or make it possible to update by the user) bind-mounted SSM agent used in ECS agent (used for execute-command feature).

**Which service(s) is this request for?**
ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently, when running ECS container with a non-root user, `execute-command` feature is not working properly.
This issue has been fixed in the [latest release](https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.715.0) of the SSM agent. However, it is impossible for the user, to update the SSM agent used by ECS agent.

**Are you currently working around this issue?**
To verify that it is SSM agent version issue, I manually replaced binary used by the ECS agent with the updated one on the container instance.
Checked the version used within the task (`docker exec ...`).
```
# amazon-ssm-agent -version
SSM Agent version: 3.1.715.0
```
Now accessing container via SSM is possible with a non-root user.

I would like to force ECS agent to use at least `3.1.715.0` version of SSM agent., but there is no way in doing so.

The workaround was to prove that it was SSM agent version issue, it is not possible (nor sane) to run this way on production.

Contributor guide

Open the contributing guide

Research direction

The request names the ECS agent’s bind-mounted SSM agent and references SSM Agent 3.1.715.0; start by locating that integration and reviewing the linked release behavior. No repository files or tests are mentioned. Done means users can update or select the bind-mounted agent so ECS execute-command works with non-root containers.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.