[ECS] [request]: Allow Headers modification in Service Connect envoy proxy
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
The server response headers shown when connecting to containers using service connect show internal information, which can be flagged in certain scenarios. It would be good if these headers are able to be dropped/modified.
**Which service(s) is this request for?**
ECS, Fargate
**Are you currently working around this issue?**
No workarounds
**Additional context**
This is similar to the request opened in AppMesh: https://github.com/aws/aws-app-mesh-roadmap/issues/392 however opening request here specifically for service connect on account of AppMesh being discontinued in the near future.
Have attempted to create a custom service connect agent image as per below and use the EC2 launch type for tasks:
https://github.com/aws/amazon-ecs-service-connect-agent
As it bootstraps the relay config on startup, I adjusted the bootstrap file to set the `server_header_transformation` to `PASS_THROUGH` and have attempted to remove the `server` and `x-envoy-upstream-service-time` headers. See bootstrap file attached.
Replaced the `ecs-service-connect-agent:interface-v1` image with the above custom image on container instance startup using User Data. Tasks start successfully but the configuration does not take effect as the headers are still returned. However I can confirm that the relay service connect container successfully generates the configuration:
```
$ docker cp :/ /tmp/relay
$ grep -r response_headers_to_remove /tmp/relay
/tmp/relay/agent-resources/bootstrap_configs/relay_bootstrap.yaml: response_headers_to_remove:
/tmp/relay/tmp/envoy-config-679633366.yaml: response_headers_to_remove:
```
**Attachments**
[relay_bootstrap.yaml.txt](https://github.com/user-attachments/files/18846962/relay_bootstrap.yaml.txt)
Contributor guide
Research direction
Start by reviewing the attached relay_bootstrap.yaml.txt and the referenced amazon-ecs-service-connect-agent repository, focusing on how the relay configuration is generated and applied. Done would mean Service Connect on ECS/Fargate reliably allows the requested response headers to be dropped or modified, with behavior confirmed through a reproducible task request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100