aws / aws/containers-roadmap

[ECS] [request]: Allow Headers modification in Service Connect envoy proxy

Open
#2,547 0 comments 27 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
The server response headers shown when connecting to containers using service connect show internal information, which can be flagged in certain scenarios. It would be good if these headers are able to be dropped/modified.

**Which service(s) is this request for?**
ECS, Fargate

**Are you currently working around this issue?**
No workarounds

**Additional context**
This is similar to the request opened in AppMesh: https://github.com/aws/aws-app-mesh-roadmap/issues/392 however opening request here specifically for service connect on account of AppMesh being discontinued in the near future.

Have attempted to create a custom service connect agent image as per below and use the EC2 launch type for tasks:
https://github.com/aws/amazon-ecs-service-connect-agent

As it bootstraps the relay config on startup, I adjusted the bootstrap file to set the `server_header_transformation` to `PASS_THROUGH` and have attempted to remove the `server` and `x-envoy-upstream-service-time` headers. See bootstrap file attached.

Replaced the `ecs-service-connect-agent:interface-v1` image with the above custom image on container instance startup using User Data. Tasks start successfully but the configuration does not take effect as the headers are still returned. However I can confirm that the relay service connect container successfully generates the configuration:

```
$ docker cp :/ /tmp/relay
$ grep -r response_headers_to_remove /tmp/relay
/tmp/relay/agent-resources/bootstrap_configs/relay_bootstrap.yaml: response_headers_to_remove:
/tmp/relay/tmp/envoy-config-679633366.yaml: response_headers_to_remove:
```

**Attachments**
[relay_bootstrap.yaml.txt](https://github.com/user-attachments/files/18846962/relay_bootstrap.yaml.txt)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the attached relay_bootstrap.yaml.txt and the referenced amazon-ecs-service-connect-agent repository, focusing on how the relay configuration is generated and applied. Done would mean Service Connect on ECS/Fargate reliably allows the requested response headers to be dropped or modified, with behavior confirmed through a reproducible task request.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.