Use IAM credential endpoint from IMDS for accurate entity IAM role n…

…ame (#1414) Co-authored-by: Zhihong Lin <[email protected]> Co-authored-by: zhihonl <[email protected]>
aws · Nov 6, 2024 · bc99755 · bc99755
1 parent a19df6f
commit bc99755
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 36 deletions.
diff --git a/extension/entitystore/extension_test.go b/extension/entitystore/extension_test.go
@@ -103,10 +103,6 @@ func (m *mockMetadataProvider) InstanceID(ctx context.Context) (string, error) {
 	return "MockInstanceID", nil
 }
 
-func (m *mockMetadataProvider) InstanceProfileIAMRole() (string, error) {
-	return "arn:aws:iam::123456789:instance-profile/TestRole", nil
-}
-
 func (m *mockMetadataProvider) InstanceTags(ctx context.Context) (string, error) {
 	if m.InstanceTagError {
 		return "", errors.New("an error occurred for instance tag retrieval")
@@ -118,6 +114,10 @@ func (m *mockMetadataProvider) InstanceTags(ctx context.Context) (string, error)
 	return tagsString, nil
 }
 
+func (m *mockMetadataProvider) ClientIAMRole(ctx context.Context) (string, error) {
+	return "TestRole", nil
+}
+
 func (m *mockMetadataProvider) InstanceTagValue(ctx context.Context, tagKey string) (string, error) {
 	tag, ok := m.Tags[tagKey]
 	if !ok {

diff --git a/extension/entitystore/serviceprovider.go b/extension/entitystore/serviceprovider.go
@@ -5,11 +5,9 @@ package entitystore
 
 import (
 	"context"
-	"fmt"
 	"strings"
 	"sync"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
 	"go.uber.org/zap"
 
 	configaws "github.com/aws/amazon-cloudwatch-agent/cfg/aws"
@@ -19,10 +17,9 @@ import (
 )
 
 const (
-	INSTANCE_PROFILE = "instance-profile/"
-	SERVICE          = "service"
-	APPLICATION      = "application"
-	APP              = "app"
+	SERVICE     = "service"
+	APPLICATION = "application"
+	APP         = "app"
 
 	// Matches the default value from OTel
 	// https://opentelemetry.io/docs/languages/sdk-configuration/general/#otel_service_name
@@ -231,23 +228,13 @@ func (s *serviceprovider) serviceAttributeFallback() ServiceAttribute {
 }
 
 func (s *serviceprovider) scrapeIAMRole() error {
-	iamRole, err := s.metadataProvider.InstanceProfileIAMRole()
+	iamRole, err := s.metadataProvider.ClientIAMRole(context.Background())
 	if err != nil {
 		return err
 	}
-	iamRoleArn, err := arn.Parse(iamRole)
-	if err != nil {
-		return err
-	}
-	iamRoleResource := iamRoleArn.Resource
-	if strings.HasPrefix(iamRoleResource, INSTANCE_PROFILE) {
-		roleName := strings.TrimPrefix(iamRoleResource, INSTANCE_PROFILE)
-		s.mutex.Lock()
-		s.iamRole = roleName
-		s.mutex.Unlock()
-	} else {
-		return fmt.Errorf("IAM Role resource does not follow the expected pattern. Should be instance-profile/<role_name>")
-	}
+	s.mutex.Lock()
+	s.iamRole = iamRole
+	s.mutex.Unlock()
 	return nil
 }
 func (s *serviceprovider) scrapeImdsServiceName() error {

diff --git a/internal/ec2metadataprovider/ec2metadataprovider.go b/internal/ec2metadataprovider/ec2metadataprovider.go
@@ -20,8 +20,8 @@ type MetadataProvider interface {
 	Get(ctx context.Context) (ec2metadata.EC2InstanceIdentityDocument, error)
 	Hostname(ctx context.Context) (string, error)
 	InstanceID(ctx context.Context) (string, error)
-	InstanceProfileIAMRole() (string, error)
 	InstanceTags(ctx context.Context) (string, error)
+	ClientIAMRole(ctx context.Context) (string, error)
 	InstanceTagValue(ctx context.Context, tagKey string) (string, error)
 }
 
@@ -61,13 +61,9 @@ func (c *metadataClient) Hostname(ctx context.Context) (string, error) {
 	})
 }
 
-func (c *metadataClient) InstanceProfileIAMRole() (string, error) {
-	return withMetadataFallbackRetry(context.Background(), c, func(metadataClient *ec2metadata.EC2Metadata) (string, error) {
-		iamInfo, err := metadataClient.IAMInfo()
-		if err != nil {
-			return "", err
-		}
-		return iamInfo.InstanceProfileArn, nil
+func (c *metadataClient) ClientIAMRole(ctx context.Context) (string, error) {
+	return withMetadataFallbackRetry(ctx, c, func(metadataClient *ec2metadata.EC2Metadata) (string, error) {
+		return metadataClient.GetMetadataWithContext(ctx, "iam/security-credentials")
 	})
 }
 

diff --git a/plugins/processors/ec2tagger/ec2tagger_test.go b/plugins/processors/ec2tagger/ec2tagger_test.go
@@ -148,14 +148,14 @@ func (m *mockMetadataProvider) InstanceTags(ctx context.Context) (string, error)
 	return "MockInstanceTag", nil
 }
 
-func (m *mockMetadataProvider) InstanceProfileIAMRole() (string, error) {
-	return "MockIAM", nil
-}
-
 func (m *mockMetadataProvider) InstanceTagValue(ctx context.Context, tagKey string) (string, error) {
 	return "MockInstanceValue", nil
 }
 
+func (m *mockMetadataProvider) ClientIAMRole(ctx context.Context) (string, error) {
+	return "MockIAMRole", nil
+}
+
 var mockedInstanceIdentityDoc = &ec2metadata.EC2InstanceIdentityDocument{
 	InstanceID:   "i-01d2417c27a396e44",
 	Region:       "us-east-1",