AWS res documentation change
Summary
Added documentation for a known issue where virtual desktops fail to mount read/write S3 buckets with root ARN and custom prefixes, including mitigation steps involving patch application and instance termination
Security assessment
The change documents a functional bug causing permission errors during S3 bucket mounting, but there is no evidence of an exploited security vulnerability. The mitigation involves operational fixes rather than addressing a security flaw. The note about AWS_STS_REGIONAL_ENDPOINTS references existing security best practices but does not indicate a newly discovered vulnerability.
Diff
diff --git a/res/archive/release-minus-4/ug/res-troubleshooting-known-issues.md b/res/archive/release-minus-4/ug/res-troubleshooting-known-issues.md index 5959220e1..6397655cf 100644 --- a//res/archive/release-minus-4/ug/res-troubleshooting-known-issues.md +++ b//res/archive/release-minus-4/ug/res-troubleshooting-known-issues.md @@ -10,0 +11,2 @@ Known Issues 2024.x + * (2024.08) Virtual desktops fail to mount read/write Amazon S3 bucket with root bucket ARN and custom prefixing + @@ -33,0 +36,67 @@ Known Issues 2024.x +........................ + +### (2024.08) Virtual desktops fail to mount read/write Amazon S3 bucket with root bucket ARN and custom prefixing + +**Bug description** + +Research and Engineering Studio 2024.08 fails to mount read/write S3 buckets on to a virtual desktop infrastructure (VDI) instance when using a root bucket ARN (that is, `arn:aws:s3:::example-bucket`) and a custom prefix (project name or project name and user name). + +Bucket configurations that are **not affected** by this issue include: + + * read-only buckets + + * read/write buckets with a prefix as part of the bucket ARN (that is, `arn:aws:s3:::example-bucket/example-folder-prefix`) and custom prefixing (project name or project name and user name) + + * read/write buckets with a root bucket ARN, but no custom prefixing + + + + +After you provision a VDI instance, the specified mount directory for that S3 bucket will not have the bucket mounted. Although the mount directory on the VDI will be present, the directory will be empty and will not contain the current contents of the bucket. When you write a file to the directory using the terminal, the error `Permission denied, unable to write a file` will be thrown and the file contents will not be uploaded to the corresponding S3 bucket. + +**Affected versions** + +2024.08 + +**Mitigation** + + 1. To download the patch script and patch file (`patch.py` and `s3_mount_custom_prefix_fix.patch`), run the following command, replacing `<output-directory>` with the directory where you want to download the patch script and patch file and `<environment-name>` with the name of your RES environment: + + 1. The patch only applies to RES 2024.08. + + 2. The patch script requires [AWS CLI v2](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), Python 3.9.16 or above, and [Boto3](https://aws.amazon.com/sdk-for-python/). + + 3. Configure the AWS CLI for the account and region where RES is deployed, and make sure that you have Amazon S3 permissions to write to the bucket created by RES. + + OUTPUT_DIRECTORY=<output-directory> + ENVIRONMENT_NAME=<environment-name> + + mkdir -p ${OUTPUT_DIRECTORY} + curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/2024.08/patch_scripts/patch.py --output ${OUTPUT_DIRECTORY}/patch.py + curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/2024.08/patch_scripts/patches/s3_mount_custom_prefix_fix.patch --output ${OUTPUT_DIRECTORY}/s3_mount_custom_prefix_fix.patch + + 2. Navigate to the directory where the patch script and patch file are downloaded. Run the following patch command: + + python3 ${OUTPUT_DIRECTORY}/patch.py --environment-name ${ENVIRONMENT_NAME} --res-version 2024.08 --module virtual-desktop-controller --patch ${OUTPUT_DIRECTORY}/s3_mount_custom_prefix_fix.patch + + + 3. To terminate the Virtual Desktop Controller (vdc-controller) instance for your environment, run the following commands. (You already set the `ENVIRONMENT_NAME` variable to the name of your RES environment in the first step.) + + INSTANCE_ID=$(aws ec2 describe-instances \ + --filters \ + Name=tag:Name,Values=${ENVIRONMENT_NAME}-vdc-controller \ + Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME}\ + --query "Reservations[0].Instances[0].InstanceId" \ + --output text) + + aws ec2 terminate-instances --instance-ids ${INSTANCE_ID} + +###### Note + +For private VPC setups, if you haven't already done so, for the `<RES-EnvironmentName>-vdc-custom-credential-broker-lambda` function make sure to add the `Environment variable` with name `AWS_STS_REGIONAL_ENDPOINTS` and value of `regional`. See [Amazon S3 bucket prerequisites for isolated VPC deployments](./S3-buckets-prereqs.html) for more information. + + 4. After the target group starting with the name ``<RES-EnvironmentName>`-vdc-ext` becomes healthy, new VDIs will need to be launched that will have the read/write S3 buckets with root bucket ARN and custom prefixing mounted correctly. + + + +