[ECS] [request]: make bind-mounted SSM agent updatable
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Update (or make it possible to update by the user) bind-mounted SSM agent used in ECS agent (used for execute-command feature).
**Which service(s) is this request for?**
ECS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently, when running ECS container with a non-root user, `execute-command` feature is not working properly.
This issue has been fixed in the [latest release](https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.715.0) of the SSM agent. However, it is impossible for the user, to update the SSM agent used by ECS agent.
**Are you currently working around this issue?**
To verify that it is SSM agent version issue, I manually replaced binary used by the ECS agent with the updated one on the container instance.
Checked the version used within the task (`docker exec ...`).
```
# amazon-ssm-agent -version
SSM Agent version: 3.1.715.0
```
Now accessing container via SSM is possible with a non-root user.
I would like to force ECS agent to use at least `3.1.715.0` version of SSM agent., but there is no way in doing so.
The workaround was to prove that it was SSM agent version issue, it is not possible (nor sane) to run this way on production.
Contributor guide
Research direction
The request names the ECS agent’s bind-mounted SSM agent and references SSM Agent 3.1.715.0; start by locating that integration and reviewing the linked release behavior. No repository files or tests are mentioned. Done means users can update or select the bind-mounted agent so ECS execute-command works with non-root containers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100