bottlerocket-os/bottlerocket-control-container

A container for remote control of Bottlerocket

bottlerocket-control-container's Issues

Allow setting VPC endpoints for AWS SSM agent

Image I'm using:

Issue or Feature Request:

In our setup, we need to set VPC endpoints for aws ssm agent, and not pass all the communication via proxy. It will be nice, when there will be possible to set vpc endpointf for ssm agent / push own content of amazon-ssm-agent.json using bottlerocket settings.

Improve accounts management for SSM sessions

Issue or Feature Request:

With the current control container, there isn't any type of enforcement on passwords, inactive accounts, historical password storage, lock outs, etc. We could increase the security of the admin container by enforcing some of this through policies. A good example of what the policy should enforce is as follows:

• Inactive accounts – 90 days
• 15 minute idle sessions
• Lock within 10 failed attempts, for 30 minutes or more
• New and unique value for all new accounts
  • Minimum 12 characters, contain numbers and letters
  • Remember the last 4 passwords within the last 12 months
  • Passwords changed every 90 days

Bump SSM Agent version

We should update SSM agent to 3.x
https://github.com/aws/amazon-ssm-agent/releases/

SSM logging expects script binary to be available

What I'd like:

To have script installed such that the SSM logging works.

Currently I get this message ending up in the log bucket:

unable to generate log data: Failed to generate transcript with the following errors:
exec: "script": executable file not found in $PATH:
exec: "script": executable file not found in $PATH:

For example, I run:

aws ssm start-session --target i-xyz

I am now connected to the instance. I should expect to see logs in the log bucket which is configured as part of SSM, however I only see a stderr file with the logs shown above.

Any alternatives you've considered:

Not sure there is another option, I assume it depends on what the SSM agent expects is available on the node where it's running.

Display value of `settings.motd` prominently in the control container

Image I'm using:
n/a

Issue or Feature Request:

It would be nice to have the value of settings.motd from the host displayed prominently when a user does a login, in addition to the container's own motd.

cgroup settings and ssh

Image I'm using:

Issue or Feature Request:
This is how Facebook has their cgroup limits set for production https://youtu.be/cSJFLBJusVY?t=2222

How should they be set for this container? How should the build be modified to add one for ssh users?

Install jq

In order for maintenance scripts to be able to parse the output of apiclient, it would be useful to install jq to provide for easy field extraction.

See bottlerocket-os/bottlerocket#1165 for additional details.

Set PS1

In Bottlerocket, we're adding the ability to jump between host containers using apiclient, so it'd be useful to set the PS1 variable in the control container's bash configuration to identify where you are.

Non-AWS control container

Image I'm using:

Issue or Feature Request:
Is it possible to have a control container that is independent of AWS?
Is there any documentation on how to achieve this? That is, the functionality and integration points the container provides/respects.

I assume such a container would be associated with a new variant?