search

aws / amazon-cloudwatch-logs-for-fluent-bit

A Fluent Bit output plugin for CloudWatch Logs
Apache License 2.0
170 stars 49 forks source link

Should credentials_endpoint have validation that it can only be a private or link local IP, and not a hostname or public IP? #357

Open PettitWesley opened 10 months ago

PettitWesley commented 10 months ago

Currently, we have credentials_endpoint in this output plugin. This supports use cases for custom credential vending.

For a dataplane agent that runs on hosts like Fluent Bit, I wonder if any custom credential vending service should always listen on a link local or private IP or localhost IP. It seems insecure and never wise to reach out to a public IP or hostname for credentials.

We could add validation to reject the config if the endpoint is not local/private. This would hurt users who have their custom credential server reachable through a private DNS hostname, which seems like a valid and reasonable use case.