Skip to content

Commit

Permalink
Disable AWS IMDSv1 fallback
Browse files Browse the repository at this point in the history 
Teleport should never use AWS IMDSv1 for requests, so disable the
ability to fallback to it, as it could be a malicious attempt to
downgrade security.
  • Loading branch information
@reedloden
reedloden committed Nov 7, 2023
1 parent 7ce3d7a commit 97ed9a7
Show file tree
Hide file tree
Showing 10 changed files with 38 additions and 41 deletions.
2 changes: 1 addition & 1 deletion examples/teleport-usage/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module usage-script
go 1.19

require (
github.com/aws/aws-sdk-go v1.44.269
github.com/aws/aws-sdk-go v1.47.2
github.com/stretchr/testify v1.8.3
)

Expand Down
32 changes: 2 additions & 30 deletions examples/teleport-usage/go.sum
View file
Original file line number Diff line number Diff line change
@@ -1,45 +1,17 @@
github.com/aws/aws-sdk-go v1.44.269 h1:NUNq++KMjhWUVVUIx7HYLgBpX16bWfTY1EdQRraLALo=
github.com/aws/aws-sdk-go v1.44.269/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
github.com/aws/aws-sdk-go v1.47.2 h1:KEdO2PbjfEBmHvnEwbYEpr65ZIkmwK5aB85Gj19ASuA=
github.com/aws/aws-sdk-go v1.47.2/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
Expand Down
10 changes: 10 additions & 0 deletions examples/teleport-usage/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,14 @@ limitations under the License.
package main

import (
"crypto/sha256"
"errors"
"fmt"
"log"
"math"
"math/rand"
"os"
"reflect"
"strconv"
"strings"
"time"
Expand Down Expand Up @@ -61,6 +63,12 @@ func main() {
// If this is too high and we encounter throttling that could impede Teleport, it will be adjusted automatically.
limiter := newAdaptiveRateLimiter(25)

// Check the package name for one of the boring primitives. If the package
// path is from BoringCrypto, we know this binary was compiled using
// `GOEXPERIMENT=boringcrypto`.
hash := sha256.New()
isBoringBinary := reflect.TypeOf(hash).Elem().PkgPath() == "crypto/internal/boring"

// create an AWS session using default SDK behavior, i.e. it will interpret
// the environment and ~/.aws directory just like an AWS CLI tool would:
session, err := awssession.NewSessionWithOptions(awssession.Options{
Expand All @@ -69,6 +77,8 @@ func main() {
Retryer: limiter,
Region: aws.String(params.awsRegion),
CredentialsChainVerboseErrors: aws.Bool(true),
EC2MetadataEnableFallback: aws.Bool(false),
UseFIPSEndpoint: aws.Bool(isBoringBinary),
},
})
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ require (
github.com/andybalholm/brotli v1.0.6
github.com/aquasecurity/libbpfgo v0.5.1-libbpf-1.2
github.com/armon/go-radix v1.0.0
github.com/aws/aws-sdk-go v1.47.0
github.com/aws/aws-sdk-go v1.47.2
github.com/aws/aws-sdk-go-v2 v1.22.0
github.com/aws/aws-sdk-go-v2/config v1.20.0
github.com/aws/aws-sdk-go-v2/credentials v1.14.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -235,8 +235,8 @@ github.com/aws/aws-sdk-go v1.25.11/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpi
github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
github.com/aws/aws-sdk-go v1.47.2 h1:KEdO2PbjfEBmHvnEwbYEpr65ZIkmwK5aB85Gj19ASuA=
github.com/aws/aws-sdk-go v1.47.2/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
github.com/aws/aws-sdk-go-v2 v1.22.0 h1:CpTS3XO3MWNel8ohoazkLZC6scvkYL2k+m0yzFJ17Hg=
Expand Down
5 changes: 3 additions & 2 deletions lib/auth/join_iam.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -453,8 +453,9 @@ func createSignedSTSIdentityRequest(ctx context.Context, challenge string, opts

func newSTSClient(ctx context.Context, cfg *stsIdentityRequestConfig) (*sts.STS, error) {
awsConfig := awssdk.Config{
UseFIPSEndpoint: cfg.fipsEndpointOption,
STSRegionalEndpoint: cfg.regionalEndpointOption,
EC2MetadataEnableFallback: awssdk.Bool(false),
UseFIPSEndpoint: cfg.fipsEndpointOption,
STSRegionalEndpoint: cfg.regionalEndpointOption,
}
sess, err := session.NewSessionWithOptions(session.Options{
SharedConfigState: session.SharedConfigEnable,
Expand Down
15 changes: 11 additions & 4 deletions lib/cloud/clients.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ import (
libcloudaws "github.com/gravitational/teleport/lib/cloud/aws"
"github.com/gravitational/teleport/lib/cloud/azure"
"github.com/gravitational/teleport/lib/cloud/gcp"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/utils"
)

Expand Down Expand Up @@ -636,7 +637,9 @@ func (c *cloudClients) getAWSSessionForRegion(region string) (*awssession.Sessio
session, err := awssession.NewSessionWithOptions(awssession.Options{
SharedConfigState: awssession.SharedConfigEnable,
Config: aws.Config{
Region: aws.String(region),
Region: aws.String(region),
EC2MetadataEnableFallback: aws.Bool(false),
UseFIPSEndpoint: modules.GetModules().IsBoringBinary(),
},
})
return session, trace.Wrap(err)
Expand Down Expand Up @@ -865,7 +868,9 @@ func (c *TestCloudClients) getAWSSessionForRegion(region string) (*awssession.Se
AccessKeyID: "fakeClientKeyID",
SecretAccessKey: "fakeClientSecret",
}}),
Region: aws.String(region),
Region: aws.String(region),
EC2MetadataEnableFallback: aws.Bool(false),
UseFIPSEndpoint: modules.GetModules().IsBoringBinary(),
})
}

Expand Down Expand Up @@ -1106,8 +1111,10 @@ func newSessionWithRole(ctx context.Context, svc stscreds.AssumeRoler, region, r
roleSession, err := awssession.NewSessionWithOptions(awssession.Options{
SharedConfigState: awssession.SharedConfigEnable,
Config: aws.Config{
Region: aws.String(region),
Credentials: cred,
Region: aws.String(region),
Credentials: cred,
EC2MetadataEnableFallback: aws.Bool(false),
UseFIPSEndpoint: modules.GetModules().IsBoringBinary(),
},
})
return roleSession, trace.Wrap(err)
Expand Down
4 changes: 3 additions & 1 deletion lib/configurators/aws/aws.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -350,7 +350,9 @@ func (c *ConfiguratorConfig) CheckAndSetDefaults() error {
}
session, err := awssession.NewSessionWithOptions(awssession.Options{
Config: aws.Config{
Region: &region,
Region: &region,
EC2MetadataEnableFallback: aws.Bool(false),
UseFIPSEndpoint: aws.Bool(modules.GetModules().IsBoringBinary()),
},
SharedConfigState: awssession.SharedConfigEnable,
})
Expand Down
3 changes: 3 additions & 0 deletions lib/events/dynamoevents/dynamoevents.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -283,6 +283,9 @@ func New(ctx context.Context, cfg Config) (*Log, error) {
// Explicitly enable or disable FIPS endpoints for DynamoDB
b.session.Config.UseFIPSEndpoint = events.FIPSProtoStateToAWSState(cfg.UseFIPSEndpoint)

// Explicitly disable IMDSv1 fallback
b.session.Config.EC2MetadataEnableFallback = aws.Bool(false)

// create DynamoDB service:
svc, err := dynamometrics.NewAPIMetrics(dynamometrics.Events, dynamodb.New(b.session))
if err != nil {
Expand Down
2 changes: 2 additions & 0 deletions lib/events/s3sessions/s3handler.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,8 @@ func (s *Config) CheckAndSetDefaults() error {
sess.Config.Credentials = s.Credentials
}

sess.Config.EC2MetadataEnableFallback = aws.Bool(false)

sess.Config.UseFIPSEndpoint = events.FIPSProtoStateToAWSState(s.UseFIPSEndpoint)

s.Session = sess
Expand Down

0 comments on commit 97ed9a7

Please sign in to comment.