falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.4k stars 902 forks source link

AWS-Region issue when trying to work with EC2-Instance Profiles via KIAM #2034

Closed VF-mbrauer closed 2 years ago

VF-mbrauer commented 2 years ago

Describe the bug

Using a Kubernetes Installation on AWS-EC2-VMs. To communicate to AWS (Assume-Roles) we use KIAM (https://github.com/uswitch/kiam) When trying to remove the Access_Keys and Access_Secrets and make use of EC2-Instance Profiles, Falcosidekick fails when it tries to connect to AWS.

Error Message in the Logs: 2022/06/01 10:30:33 [ERROR] : AWS - MissingRegion: could not find region configuration

How to reproduce it

When removing the following Entries from secret of Falcosidekick:

it will show the following error: 2022/06/01 10:30:33 [ERROR] : AWS - MissingRegion: could not find region configuration

When putting the AWS_REGION with the the correct Region (ex. "eu-central-1") then it will show the following error: 2022/06/01 10:50:45 [ERROR] : AWS - Error while getting AWS Token

After a hint from @Issif I tried to define Environment variable: AWS_STS_REGIONAL_ENDPOINTS = true the following error message is shown: 2022/06/01 11:00:30 [ERROR] : AWS - Error while creating AWS Session

Expected behaviour

Login via Instance-Role Profile should work and should be able to communicate with the AWS-API.

Environment

VF-mbrauer commented 2 years ago

Wrong repository. Created a new issue on Falcosidekick: https://github.com/falcosecurity/falcosidekick/issues/325