aws / aws/ec2-image-builder-roadmap
[Bug] Component Validation fails when creating a python file (failed to compute hash - operation not permitted)
- Dominant language
- No language data
- Stars
- 35
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
For some reason, when I create a python script in a component, the validation always fails for the component.
If I remove the script, then the component works as expected. As soon as I add it back in, then component fails.
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
This is the component part that causes it to fail:
```yaml
- name: createClamAvServerScript
action: CreateFile
inputs:
- path: /opt/example-server/server.py
content: |-
import os
from flask import Flask, request, jsonify
# Create the Flask app
app = Flask(__name__)
if __name__ == "__main__":
app.run(host='127.0.0.1', port=5000)
```
I removed most code to get to this as a minimal example. This seems to be due to using `:` in the code. If I remove ` if __name__ == "__main__":` then it will build as expected. This doesnt' seem to handle YAML properly. Even trying to escape the `:` this will not work.
This is a major flaw in the system.
I have not found a work-a-round yet but have been struggling for 2 days on this now. This works fine when I deploy this in an EC2 using userData. Trying to create an EC2 Image builder for this and this is the only part that I cannot get to work.
I even tried creating the file with `ExecuteBash` and the same error happens.
This fails with:
> Image ARN: arn:aws-us-gov:imagebuilder:us-gov-west-1:1172554XXXXX:image/clamav-file-scanner/0.0.22/1 failed with error: Workflow Execution ID: 'wf-d7eff014-6864-449f-8322-d42754215aaa' failed with reason: failed to compute hash for file /var/lib/amazon/toe/TOE_2024-12-04_00-14-07_UTC-0_ad5591d5-b1d4-11ef-b4c9-02c89485f559/D1__imagebuilder-clamavfilescanner-configure-clamav-server__0.0.22_1.yml, open /var/lib/amazon/toe/TOE_2024-12-04_00-14-07_UTC-0_ad5591d5-b1d4-11ef-b4c9-02c89485f559/D1__imagebuilder-clamavfilescanner-configure-clamav-server__0.0.22_1.yml: operation not permitted.
This does not run any parts of the component. This is failing validation of the component before it even attempts to run anything. This happens at the start of the `ApplyBuildComponents` stage
I am using a custom working directory:
```yaml
WorkingDirectory: "/opt/ec2-image-builder-ssm-working-dir"
```
**Are you currently working around this issue?**
How are you currently solving this problem?
Still trying to figure this out...
Contributor guide
Research direction
Reproduce validation during the ApplyBuildComponents stage with the shown CreateFile and ExecuteBash examples, comparing the script with and without the colon. Start from the reported generated file under /var/lib/amazon/toe and the custom WorkingDirectory setting, then trace the failed hash computation. Done means component validation accepts the Python file and reaches execution.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cloud, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100