Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AWS provider #118

Merged
merged 3 commits into from
Sep 18, 2024
Merged

Add AWS provider #118

merged 3 commits into from
Sep 18, 2024

Conversation

hhamalai
Copy link
Contributor

Add autoscaler provider to execute builds on AWS

@hhamalai hhamalai force-pushed the main branch 2 times, most recently from bfc5e09 to 02338f4 Compare March 26, 2024 07:22
@anbraten
Copy link
Member

Thanks for your work. I guess AWS is affected by #91 as well, right?

@henkka
Copy link

henkka commented Jun 5, 2024

Thanks for your work. I guess AWS is affected by #91 as well, right?

I believe this pull request is not affected by the issue mentioned in #91 because the AWS Instance Metadata Service v2 hop limit configuration in https://github.com/woodpecker-ci/autoscaler/pull/118/files#diff-c77d8b5077c4d2c3350ad7ca994ceffe1737935b4e1390f0963acca2d338ca67R74 prevents the containers from connecting to the Instance Metadata API 🤔

https://www.element7.io/2023/01/shift-left-security-why-you-should-use-aws-imdsv2-explained-in-detail/ seems to summarize the hop limit as

It becomes interesting once you know that with IMDSv2, the PUT response containing the secret token can, by default, not travel outside the instance. This is accomplished by having a default Time To Live (TTL) on the low-level IP packets containing the secret token set to “1”. Hardware and software that handle packets, including EC2 instances, subtract 1 from each packet’s TTL whenever they pass it on. If the TTL gets to 0, the packet is discarded. A packet with a TTL of “n” can therefore make n “hops” in a network before giving up, while a packet with a TTL of “1” can exist in just one. In the context of IMDSv2, we refer to hop limit of the PUT call instead of TTL. By using a default hop limit (TTL) of 1, a session token can only be used directly from the EC2 instance where that session was initiated.

and without the IMDS session token the cloud-init user-data cannot be fetched

@6543 6543 self-requested a review July 18, 2024 22:03
Copy link
Member

@anbraten anbraten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm. some minor things

providers/aws/provider.go Show resolved Hide resolved
providers/aws/flags.go Outdated Show resolved Hide resolved
providers/aws/flags.go Outdated Show resolved Hide resolved
providers/aws/provider.go Outdated Show resolved Hide resolved
@6543 6543 added feature Add new feature labels Sep 18, 2024
@6543 6543 merged commit 45734c7 into woodpecker-ci:main Sep 18, 2024
3 checks passed
@woodpecker-bot woodpecker-bot mentioned this pull request Sep 18, 2024
1 task
@woodpecker-bot
Copy link
Contributor

🎉 This PR is included in version 0.3.0 🎉

The release is now available here

Thank you for your contribution. ❤️📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature Add new feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants