aws: support AWS_EC2_METADATA_SERVICE_ENDPOINT for custom IMDS endpoints#12151
aws: support AWS_EC2_METADATA_SERVICE_ENDPOINT for custom IMDS endpoints#12151drappier-charles wants to merge 4 commits into
Conversation
- Added a new environment variable `AWS_EC2_METADATA_SERVICE_ENDPOINT` to allow users to specify a custom IMDS endpoint. - Updated the EC2 provider creation logic to check for this environment variable and adjust the upstream connection accordingly. - Implemented a new test case to verify the functionality of the custom endpoint. These changes improve flexibility for users needing to connect to non-default IMDS endpoints.
- Removed hardcoded checks for the EC2 IMDS TCP host and port in the `flb_aws_imds_create` function. - Added comments to clarify that custom IMDS endpoints can now be specified via the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable. These changes enhance flexibility for users needing to connect to non-default IMDS endpoints, following the recent addition of the environment variable support.
- Introduced a new constant `FLB_AWS_IMDS_TIMEOUT_CUSTOM` to specify a 10-second timeout for custom IMDS endpoints, accommodating longer connection times for services like IAM Roles Anywhere. - Updated the EC2 provider creation logic to dynamically set connection and I/O timeouts based on whether a custom endpoint is used. - Added informative logging to indicate when the extended timeout is applied. These changes improve the flexibility and reliability of connections to custom IMDS endpoints, ensuring appropriate timeout settings are utilized.
- Updated the `get_imds_version` function to first attempt to retrieve an IMDSv2 token, falling back to IMDSv1 if the request fails. This change enhances compatibility with custom IMDS implementations, such as IAM Roles Anywhere. - Removed the previous method of sending an invalid token header to determine IMDSv2 availability, streamlining the logic and improving clarity. - Added debug and info logging to provide better insights during the token retrieval process. These changes improve the robustness of the IMDS version detection mechanism, ensuring a more reliable connection to metadata services.
📝 WalkthroughWalkthroughCustom EC2 IMDS endpoints can be configured through an environment variable. Endpoint parsing, port and timeout selection, IMDS version detection, and provider test coverage are updated accordingly. ChangesCustom EC2 IMDS endpoint support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Environment
participant EC2Provider
participant IMDSClient
participant CustomIMDS
Environment->>EC2Provider: Read AWS_EC2_METADATA_SERVICE_ENDPOINT
EC2Provider->>IMDSClient: Configure parsed host, port, and timeouts
IMDSClient->>CustomIMDS: Request IMDSv2 token
CustomIMDS-->>IMDSClient: Return token or failure
IMDSClient->>CustomIMDS: Probe metadata root without token
CustomIMDS-->>IMDSClient: Return HTTP status
IMDSClient-->>EC2Provider: Retrieve instance credentials
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15e973f861
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if (use_custom_endpoint) { | ||
| upstream->base.net.connect_timeout = FLB_AWS_IMDS_TIMEOUT_CUSTOM; | ||
| upstream->base.net.io_timeout = FLB_AWS_IMDS_TIMEOUT_CUSTOM; |
There was a problem hiding this comment.
When AWS_EC2_METADATA_SERVICE_ENDPOINT is set, this gives the EC2 upstream a 10s timeout only at provider creation, but every AWS output later calls provider_vtable->upstream_set(...); upstream_set_fn_ec2 then restores both timeouts to FLB_AWS_IMDS_TIMEOUT (1s). That means slow custom endpoints such as aws_signing_helper serve can still time out on credential refreshes after plugin initialization, so the provider needs to remember the custom timeout and restore that same value in upstream_set_fn_ec2.
Useful? React with 👍 / 👎.
| ctx->imds_version = FLB_AWS_IMDS_VERSION_2; | ||
| ret = refresh_imds_v2_token(ctx); | ||
| if (ret == 0) { |
There was a problem hiding this comment.
This changes version detection so the first mocked request is now PUT /latest/api/token, but the existing tests/internal/aws_credentials_ec2.c cases still start their response chains with GET / plus the invalid-token header. The mock checks requests in order, so test_ec2_provider_v2, test_ec2_provider_v1, and the error-path cases will fail before they reach the credential requests unless those expectations are rewritten for the new probe order.
Useful? React with 👍 / 👎.
| /* Allow custom IMDS endpoints via AWS_EC2_METADATA_SERVICE_ENDPOINT */ | ||
| /* The hardcoded host/port checks have been removed to support custom endpoints */ |
There was a problem hiding this comment.
Removing the host/port rejection makes flb_aws_imds_create() succeed for any non-null upstream, but test_ec2_imds_create_and_destroy still asserts that "Invalid host", an extended host string, and port 0xBAD return NULL. That existing internal test will now fail and leak the successful contexts it overwrites, so the test needs to be adjusted to the new custom-endpoint contract.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
tests/internal/aws_credentials_ec2.c (2)
1028-1064: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNo negative-path test for an invalid custom IMDS endpoint.
This test only covers a well-formed
AWS_EC2_METADATA_SERVICE_ENDPOINT. Given the fallback-on-parse-failure behavior inflb_ec2_provider_create(see companion comment onsrc/aws/flb_aws_credentials_ec2.c), consider adding a case with a malformed endpoint value to confirm the provider still falls back to the default IMDS host/port. As per coding guidelines, "Add or update tests for behavior changes, especially protocol parsing and encoder/decoder paths."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/internal/aws_credentials_ec2.c` around lines 1028 - 1064, The EC2 provider tests lack coverage for malformed custom endpoint fallback. Add a negative-path test alongside test_ec2_provider_custom_endpoint that sets AWS_EC2_METADATA_SERVICE_ENDPOINT to an invalid value, configures the mock for the default IMDS host/port, and verifies get_credentials still succeeds with the expected credentials; clean up the environment and test fixtures afterward.Source: Coding guidelines
1030-1030: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
setenvbeforeTEST_ASSERT-guarded setup risks leaking the env var into later tests.
setup_test()callsTEST_ASSERTonconfig/provider, which aborts the current test function on failure. If that happens,unsetenv("AWS_EC2_METADATA_SERVICE_ENDPOINT")at line 1062 never executes, so the variable stays set for whichever test runs next in this binary.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/internal/aws_credentials_ec2.c` at line 1030, Ensure AWS_EC2_METADATA_SERVICE_ENDPOINT is unset even when TEST_ASSERT aborts setup_test(). Move the environment-variable setup into a location after the config/provider TEST_ASSERT-guarded initialization, or otherwise add cleanup handling that always runs before setup_test() can return on failure; preserve the existing endpoint value for the successful test path.src/aws/flb_aws_credentials_ec2.c (1)
276-276: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winPrefer
strtoloveratoifor port parsing.
atoiperforms no error detection; a malformed port string silently becomes0, which happens to be caught here by the bounds check, but astrtol-based approach witherrno/endptrchecking would surface malformed input in a robust way.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/aws/flb_aws_credentials_ec2.c` at line 276, Replace the atoi call in the port-parsing logic with strtol, using errno and an endptr to validate conversion and reject malformed or out-of-range input before applying the existing port bounds check.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/aws/flb_aws_credentials_ec2.c`:
- Around line 264-287: Update the custom endpoint handling around
flb_utils_url_split_sds to log a warning when parsing fails or no host is
returned, while preserving the existing fallback to the default IMDS endpoint
and cleanup of parsed values. Keep successful valid-host handling unchanged.
- Line 267: Move the use_custom_endpoint declaration to the function’s existing
local-variable declaration block at the start of the function, preserving its
FLB_FALSE initialization and removing the mid-function declaration.
- Around line 264-289: Update the custom endpoint handling around
flb_utils_url_split_sds() and flb_upstream_create() to preserve the parsed
protocol and propagate HTTPS as TLS-enabled upstream configuration. Use the
URL-aware upstream creation path or explicitly set the corresponding secure
flags, while retaining plain TCP for HTTP/default endpoints; only destroy
protocol after the upstream setup no longer needs it.
---
Nitpick comments:
In `@src/aws/flb_aws_credentials_ec2.c`:
- Line 276: Replace the atoi call in the port-parsing logic with strtol, using
errno and an endptr to validate conversion and reject malformed or out-of-range
input before applying the existing port bounds check.
In `@tests/internal/aws_credentials_ec2.c`:
- Around line 1028-1064: The EC2 provider tests lack coverage for malformed
custom endpoint fallback. Add a negative-path test alongside
test_ec2_provider_custom_endpoint that sets AWS_EC2_METADATA_SERVICE_ENDPOINT to
an invalid value, configures the mock for the default IMDS host/port, and
verifies get_credentials still succeeds with the expected credentials; clean up
the environment and test fixtures afterward.
- Line 1030: Ensure AWS_EC2_METADATA_SERVICE_ENDPOINT is unset even when
TEST_ASSERT aborts setup_test(). Move the environment-variable setup into a
location after the config/provider TEST_ASSERT-guarded initialization, or
otherwise add cleanup handling that always runs before setup_test() can return
on failure; preserve the existing endpoint value for the successful test path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b5d3297b-497e-4e3c-b222-da042d5ac788
📒 Files selected for processing (4)
include/fluent-bit/aws/flb_aws_imds.hsrc/aws/flb_aws_credentials_ec2.csrc/aws/flb_aws_imds.ctests/internal/aws_credentials_ec2.c
| /* Check for custom IMDS endpoint */ | ||
| use_host = FLB_AWS_IMDS_HOST; | ||
| use_port = FLB_AWS_IMDS_PORT; | ||
| int use_custom_endpoint = FLB_FALSE; | ||
|
|
||
| endpoint = getenv(AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV); | ||
| if (endpoint && strlen(endpoint) > 0) { | ||
| ret = flb_utils_url_split_sds(endpoint, &protocol, &host, &port_str, &path); | ||
| if (ret >= 0 && host) { | ||
| use_host = host; | ||
| use_custom_endpoint = FLB_TRUE; | ||
| if (port_str) { | ||
| use_port = atoi(port_str); | ||
| if (use_port <= 0 || use_port > 65535) { | ||
| use_port = FLB_AWS_IMDS_PORT; | ||
| } | ||
| } | ||
| flb_info("[aws_credentials] Using custom IMDS endpoint: %s:%d", | ||
| use_host, use_port); | ||
| } | ||
| flb_sds_destroy(protocol); | ||
| flb_sds_destroy(port_str); | ||
| flb_sds_destroy(path); | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Silent fallback when the custom endpoint URL fails to parse.
If flb_utils_url_split_sds fails or returns no host, use_custom_endpoint stays FLB_FALSE and the code falls back to the default IMDS host with no log at all. A user who sets AWS_EC2_METADATA_SERVICE_ENDPOINT to a malformed value has no way to know their configuration was silently ignored and requests are instead going to 169.254.169.254. As per coding guidelines, "Validate both success and failure paths, including invalid payloads, boundary sizes, and null or missing fields."
🛠️ Proposed fix to log on parse failure
endpoint = getenv(AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV);
if (endpoint && strlen(endpoint) > 0) {
ret = flb_utils_url_split_sds(endpoint, &protocol, &host, &port_str, &path);
if (ret >= 0 && host) {
use_host = host;
use_custom_endpoint = FLB_TRUE;
if (port_str) {
use_port = atoi(port_str);
if (use_port <= 0 || use_port > 65535) {
use_port = FLB_AWS_IMDS_PORT;
}
}
flb_info("[aws_credentials] Using custom IMDS endpoint: %s:%d",
use_host, use_port);
}
+ else {
+ flb_error("[aws_credentials] invalid %s value: %s, using default IMDS endpoint",
+ AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV, endpoint);
+ }
flb_sds_destroy(protocol);
flb_sds_destroy(port_str);
flb_sds_destroy(path);
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| /* Check for custom IMDS endpoint */ | |
| use_host = FLB_AWS_IMDS_HOST; | |
| use_port = FLB_AWS_IMDS_PORT; | |
| int use_custom_endpoint = FLB_FALSE; | |
| endpoint = getenv(AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV); | |
| if (endpoint && strlen(endpoint) > 0) { | |
| ret = flb_utils_url_split_sds(endpoint, &protocol, &host, &port_str, &path); | |
| if (ret >= 0 && host) { | |
| use_host = host; | |
| use_custom_endpoint = FLB_TRUE; | |
| if (port_str) { | |
| use_port = atoi(port_str); | |
| if (use_port <= 0 || use_port > 65535) { | |
| use_port = FLB_AWS_IMDS_PORT; | |
| } | |
| } | |
| flb_info("[aws_credentials] Using custom IMDS endpoint: %s:%d", | |
| use_host, use_port); | |
| } | |
| flb_sds_destroy(protocol); | |
| flb_sds_destroy(port_str); | |
| flb_sds_destroy(path); | |
| } | |
| /* Check for custom IMDS endpoint */ | |
| use_host = FLB_AWS_IMDS_HOST; | |
| use_port = FLB_AWS_IMDS_PORT; | |
| int use_custom_endpoint = FLB_FALSE; | |
| endpoint = getenv(AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV); | |
| if (endpoint && strlen(endpoint) > 0) { | |
| ret = flb_utils_url_split_sds(endpoint, &protocol, &host, &port_str, &path); | |
| if (ret >= 0 && host) { | |
| use_host = host; | |
| use_custom_endpoint = FLB_TRUE; | |
| if (port_str) { | |
| use_port = atoi(port_str); | |
| if (use_port <= 0 || use_port > 65535) { | |
| use_port = FLB_AWS_IMDS_PORT; | |
| } | |
| } | |
| flb_info("[aws_credentials] Using custom IMDS endpoint: %s:%d", | |
| use_host, use_port); | |
| } | |
| else { | |
| flb_error("[aws_credentials] invalid %s value: %s, using default IMDS endpoint", | |
| AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV, endpoint); | |
| } | |
| flb_sds_destroy(protocol); | |
| flb_sds_destroy(port_str); | |
| flb_sds_destroy(path); | |
| } |
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] 275-275: Avoid atoi/atol/atoll/atof: they perform no error detection, returning 0 on non-numeric input and invoking undefined behavior on out-of-range values. This rule flags every use of these functions regardless of data provenance. Convert strings with strtol/strtoul/strtod and check errno (and the endptr) so malformed or overflowing input is rejected.
Context: atoi(port_str)
Note: [CWE-20] Improper Input Validation.
(atoi-no-error-detection-c)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/aws/flb_aws_credentials_ec2.c` around lines 264 - 287, Update the custom
endpoint handling around flb_utils_url_split_sds to log a warning when parsing
fails or no host is returned, while preserving the existing fallback to the
default IMDS endpoint and cleanup of parsed values. Keep successful valid-host
handling unchanged.
Source: Coding guidelines
| /* Check for custom IMDS endpoint */ | ||
| use_host = FLB_AWS_IMDS_HOST; | ||
| use_port = FLB_AWS_IMDS_PORT; | ||
| int use_custom_endpoint = FLB_FALSE; | ||
|
|
||
| endpoint = getenv(AWS_EC2_METADATA_SERVICE_ENDPOINT_ENV); | ||
| if (endpoint && strlen(endpoint) > 0) { | ||
| ret = flb_utils_url_split_sds(endpoint, &protocol, &host, &port_str, &path); | ||
| if (ret >= 0 && host) { | ||
| use_host = host; | ||
| use_custom_endpoint = FLB_TRUE; | ||
| if (port_str) { | ||
| use_port = atoi(port_str); | ||
| if (use_port <= 0 || use_port > 65535) { | ||
| use_port = FLB_AWS_IMDS_PORT; | ||
| } | ||
| } | ||
| flb_info("[aws_credentials] Using custom IMDS endpoint: %s:%d", | ||
| use_host, use_port); | ||
| } | ||
| flb_sds_destroy(protocol); | ||
| flb_sds_destroy(port_str); | ||
| flb_sds_destroy(path); | ||
| } | ||
|
|
||
| upstream = flb_upstream_create(config, use_host, use_port, FLB_IO_TCP, NULL); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does fluent-bit's flb_upstream_create_url function handle https scheme and set FLB_IO_TLS automatically?
💡 Result:
Yes, the flb_upstream_create_url function in Fluent Bit correctly handles the https scheme and automatically sets the FLB_IO_TLS flag if it is not already present [1][2]. When flb_upstream_create_url parses a URL, it examines the protocol component [1][2]. If the protocol is identified as https and no port is explicitly specified, the function defaults the port to 443 [1][2]. During this process, it checks the provided flags; if the FLB_IO_TLS bit is not set, it performs a bitwise OR operation to add FLB_IO_TLS to the flags [1][2]. This ensures that the upstream context is initialized with the appropriate transport security settings for an HTTPS connection [1][2].
Citations:
- 1: https://github.com/fluent/fluent-bit/blob/master/src/flb_upstream.c
- 2: https://github.com/fluent/fluent-bit/blob/4f8c50b8/src/flb_upstream.c
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^|/)flb_aws_credentials_ec2\.c$|(^|/)flb_upstream\.c$|(^|/)flb_upstream\.h$|(^|/)aws.*credentials.*ec2.*\.(c|h)$' || true
echo "== target section =="
sed -n '1,340p' src/aws/flb_aws_credentials_ec2.c | nl -ba | sed -n '220,310p'
echo "== upstream create/url symbols =="
rg -n "flb_upstream_create\(|flb_upstream_create_url|AWSCONFIG_HTTPS|AWS_EC2_METADATA_SERVICE_ENDPOINT|FLB_IO_TLS|FLB_AWS_IMDS" src/aws/flb_aws_credentials_ec2.c src/flb_upstream.c src/include/flb_upstream.h 2>/dev/null || true
echo "== flb_upstream_create_url implementation slice =="
rg -n "flb_upstream_create_url" src/flb_upstream.c src -g '*upstream*'
sed -n '1,420p' src/flb_upstream.c | nl -ba | sed -n '1,520p' | rg -C 25 "flb_upstream_create_url|AWSCONFIG_HTTPS|protocol" || trueRepository: fluent/fluent-bit
Length of output: 362
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository files =="
git ls-files | grep -E '(^|/)flb_aws_credentials_ec2\.c$|(^|/)flb_upstream\.c$|(^|/)flb_upstream\.h$|(^|/)tests/internal/aws_credentials_ec2\.c$' || true
echo "== target section =="
awk '{printf "%d\t%s\n", NR, $0}' src/aws/flb_aws_credentials_ec2.c | sed -n '230,305p'
echo "== upstream symbols in target/context files =="
grep -n "flb_upstream_create\|flb_upstream_create_url\|AWS_EC2_METADATA_SERVICE_ENDPOINT\|FLB_AWS_IMDS\|FLB_IO_TLS\|AWSCONFIG_HTTPS\|AWS_EC2_METADATA_SERVICE_ENDPOINT_TLS" src/aws/flb_aws_credentials_ec2.c src/flb_upstream.c include/fluent-bit/flb_upstream.h tests/internal/aws_credentials_ec2.c
echo "== flb_upstream_create_url implementation =="
awk '{printf "%d\t%s\n", NR, $0}' src/flb_upstream.c | sed -n '1,380p' | grep -C 25 "flb_upstream_create_url\|AWSCONFIG_HTTPS\|protocol\|https\|FLB_IO_TLS"
echo "== AWS cred create helper declarations/usages around credentials env =="
awk '{printf "%d\t%s\n", NR, $0}' src/aws/flb_aws_credentials_ec2.c | sed -n '20,140p'Repository: fluent/fluent-bit
Length of output: 12203
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== flb_upstream_create_url implementation =="
awk '{printf "%d\t%s\n", NR, $0}' src/flb_upstream.c | sed -n '410,470p'
echo "== headers around constants =="
awk '{printf "%d\t%s\n", NR, $0}' include/fluent-bit/aws/flb_aws_imds.h | sed -n '1,160p'
awk '{printf "%d\t%s\n", NR, $0}' include/fluent-bit/flb_http_client.h | sed -n '1,80p'
echo "== credential tests around HTTPS custom endpoint =="
awk '{printf "%d\t%s\n", NR, $0}' tests/internal/aws_credentials_ec2.c | sed -n '1000,1080p'
grep -Rn "AWS_EC2_METADATA_SERVICE_ENDPOINT.*https\|https://" tests include src/aws | head -n 80Repository: fluent/fluent-bit
Length of output: 22267
Propagate the IMDS URL protocol into the upstream flags.
flb_utils_url_split_sds() already parses protocol, but this path always destroys it and creates the EC2 metadata upstream with FLB_IO_TCP and no TLS. An https:// custom IMDS endpoint is accepted, then connected to over plaintext; default to HTTPS/TLS for https:// URLs, use flb_upstream_create_url(), or make the scheme explicit.
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] 275-275: Avoid atoi/atol/atoll/atof: they perform no error detection, returning 0 on non-numeric input and invoking undefined behavior on out-of-range values. This rule flags every use of these functions regardless of data provenance. Convert strings with strtol/strtoul/strtod and check errno (and the endptr) so malformed or overflowing input is rejected.
Context: atoi(port_str)
Note: [CWE-20] Improper Input Validation.
(atoi-no-error-detection-c)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/aws/flb_aws_credentials_ec2.c` around lines 264 - 289, Update the custom
endpoint handling around flb_utils_url_split_sds() and flb_upstream_create() to
preserve the parsed protocol and propagate HTTPS as TLS-enabled upstream
configuration. Use the URL-aware upstream creation path or explicitly set the
corresponding secure flags, while retaining plain TCP for HTTP/default
endpoints; only destroy protocol after the upstream setup no longer needs it.
| /* Check for custom IMDS endpoint */ | ||
| use_host = FLB_AWS_IMDS_HOST; | ||
| use_port = FLB_AWS_IMDS_PORT; | ||
| int use_custom_endpoint = FLB_FALSE; |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Mid-function variable declaration.
int use_custom_endpoint = FLB_FALSE; is declared mid-block instead of alongside the other locals at the top of the function. As per coding guidelines, "Declare variables at the start of functions rather than mid-block."
🛠️ Proposed fix
const char *use_host;
int use_port;
int ret;
+ int use_custom_endpoint;
provider = flb_calloc(1, sizeof(struct flb_aws_provider));
@@
use_host = FLB_AWS_IMDS_HOST;
use_port = FLB_AWS_IMDS_PORT;
- int use_custom_endpoint = FLB_FALSE;
-
+ use_custom_endpoint = FLB_FALSE;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| int use_custom_endpoint = FLB_FALSE; | |
| int use_custom_endpoint; |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/aws/flb_aws_credentials_ec2.c` at line 267, Move the use_custom_endpoint
declaration to the function’s existing local-variable declaration block at the
start of the function, preserving its FLB_FALSE initialization and removing the
mid-function declaration.
Source: Coding guidelines
1 participant
The EC2 credentials provider currently hardcodes the IMDS endpoint to
169.254.169.254:80and rejects any other host/port. This prevents Fluent Bit from retrieving credentials when the metadata service is reached through a local proxy or a compatible implementation such as AWS IAM Roles Anywhere (viaaws_signing_helper serve), which exposes an IMDS-compatible endpoint on a different address/port.This change makes the IMDS endpoint configurable through the standard AWS SDK environment variable
AWS_EC2_METADATA_SERVICE_ENDPOINT:flb_aws_credentials_ec2.c): readAWS_EC2_METADATA_SERVICE_ENDPOINT; when set, parse it withflb_utils_url_split_sds()and point the upstream at the custom host/port instead of the defaults.flb_aws_imds.c): remove the hardcodedtcp_host == 169.254.169.254/tcp_port == 80guards inflb_aws_imds_create()so a custom endpoint is accepted.FLB_AWS_IMDS_TIMEOUT_CUSTOM(10s) is applied only when a custom endpoint is configured, since certificate-based auth (IAM Roles Anywhere) can take longer than the local link-local endpoint.get_imds_version): try to obtain an IMDSv2 token first and fall back to IMDSv1 on failure, instead of probing with a deliberately invalid token. This is more compatible with custom IMDS implementations that don't return401for the invalid-token probe.Default behavior is unchanged when the environment variable is unset: standard EC2 IMDS at
169.254.169.254:80with the 1s timeout.Addresses #10873
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
This introduces a user-facing environment variable, so a docs update is warranted in fluent-bit-docs (AWS credentials / IMDS page) documenting
AWS_EC2_METADATA_SERVICE_ENDPOINTand the 10s custom-endpoint timeout. A companion docs PR will be linked here.Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.