Skip to content

Commit b237a2f

Browse files
IND-1931 Vulnerability Remediation, aws-sdk-go migration from v1 to v2
1 parent 5eb1507 commit b237a2f

19 files changed

+244
-180
lines changed

cmd/discover/main.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"flag"
66
"fmt"
77
"io"
8-
"io/ioutil"
98
"log"
109
"os"
1110
"strings"
@@ -32,7 +31,7 @@ func main() {
3231

3332
var w io.Writer = os.Stderr
3433
if quiet {
35-
w = ioutil.Discard
34+
w = io.Discard
3635
}
3736
l := log.New(w, "", 0)
3837

go.mod

+26-9
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ require (
44
github.com/Azure/azure-sdk-for-go v44.0.0+incompatible
55
github.com/Azure/go-autorest/autorest v0.11.18
66
github.com/Azure/go-autorest/autorest/azure/auth v0.5.0
7-
github.com/aws/aws-sdk-go v1.44.262
7+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.200.0
88
github.com/denverdino/aliyungo v0.0.0-20170926055100-d3308649c661
99
github.com/digitalocean/godo v1.7.5
1010
github.com/gophercloud/gophercloud v0.1.0
11-
github.com/hashicorp/go-discover/provider/gce v0.0.0-20240829171124-547b9abd20f6
11+
github.com/hashicorp/go-discover/provider/gce v0.0.0-20241120163552-5eb1507d16b4
1212
github.com/hashicorp/go-multierror v1.0.0
1313
github.com/hashicorp/mdns v1.0.1
1414
github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443
@@ -28,6 +28,18 @@ require (
2828
k8s.io/client-go v0.22.2
2929
)
3030

31+
require (
32+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.28 // indirect
33+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.28 // indirect
34+
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
35+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
36+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.9 // indirect
37+
github.com/aws/aws-sdk-go-v2/service/sso v1.24.11 // indirect
38+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.10 // indirect
39+
github.com/aws/aws-sdk-go-v2/service/sts v1.33.9 // indirect
40+
github.com/aws/smithy-go v1.22.1 // indirect
41+
)
42+
3143
require (
3244
cloud.google.com/go/auth v0.9.1 // indirect
3345
cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
@@ -41,6 +53,11 @@ require (
4153
github.com/Azure/go-autorest/logger v0.2.1 // indirect
4254
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
4355
github.com/abdullin/seq v0.0.0-20160510034733-d5467c17e7af // indirect
56+
github.com/aws/aws-sdk-go-v2 v1.33.0
57+
github.com/aws/aws-sdk-go-v2/config v1.29.1
58+
github.com/aws/aws-sdk-go-v2/credentials v1.17.54
59+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.24
60+
github.com/aws/aws-sdk-go-v2/service/ecs v1.53.8
4461
github.com/davecgh/go-spew v1.1.1 // indirect
4562
github.com/dimchansky/utfbom v1.1.0 // indirect
4663
github.com/dnaeon/go-vcr v1.0.1 // indirect
@@ -78,13 +95,13 @@ require (
7895
go.opentelemetry.io/otel v1.24.0 // indirect
7996
go.opentelemetry.io/otel/metric v1.24.0 // indirect
8097
go.opentelemetry.io/otel/trace v1.24.0 // indirect
81-
golang.org/x/crypto v0.26.0 // indirect
98+
golang.org/x/crypto v0.31.0 // indirect
8299
golang.org/x/mod v0.17.0 // indirect
83-
golang.org/x/net v0.28.0 // indirect
84-
golang.org/x/sync v0.8.0 // indirect
85-
golang.org/x/sys v0.24.0 // indirect
86-
golang.org/x/term v0.23.0 // indirect
87-
golang.org/x/text v0.17.0 // indirect
100+
golang.org/x/net v0.33.0 // indirect
101+
golang.org/x/sync v0.10.0 // indirect
102+
golang.org/x/sys v0.28.0 // indirect
103+
golang.org/x/term v0.27.0 // indirect
104+
golang.org/x/text v0.21.0 // indirect
88105
golang.org/x/time v0.6.0 // indirect
89106
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
90107
google.golang.org/api v0.195.0 // indirect
@@ -98,7 +115,7 @@ require (
98115
gopkg.in/resty.v1 v1.12.0 // indirect
99116
gopkg.in/yaml.v2 v2.4.0 // indirect
100117
gopkg.in/yaml.v3 v3.0.1 // indirect
101-
k8s.io/klog/v2 v2.9.0 // indirect
118+
k8s.io/klog/v2 v2.130.1 // indirect
102119
k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a // indirect
103120
sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect
104121
sigs.k8s.io/yaml v1.2.0 // indirect

go.sum

+46-33
Large diffs are not rendered by default.

provider/aliyun/aliyun_discover.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package aliyun
33

44
import (
55
"fmt"
6-
"io/ioutil"
6+
"io"
77
"log"
88

99
"github.com/denverdino/aliyungo/common"
@@ -39,7 +39,7 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
3939
}
4040

4141
if l == nil {
42-
l = log.New(ioutil.Discard, "", 0)
42+
l = log.New(io.Discard, "", 0)
4343
}
4444

4545
region := args["region"]

provider/aws/aws_discover.go

+79-70
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
package aws
33

44
import (
5+
"context"
56
"encoding/json"
67
"fmt"
7-
"github.com/aws/aws-sdk-go/aws/arn"
8-
"github.com/aws/aws-sdk-go/service/ecs"
9-
"io/ioutil"
8+
"io"
109
"log"
1110
"net/http"
1211
"os"
1312

14-
"github.com/aws/aws-sdk-go/aws"
15-
"github.com/aws/aws-sdk-go/aws/credentials"
16-
"github.com/aws/aws-sdk-go/aws/defaults"
17-
"github.com/aws/aws-sdk-go/aws/ec2metadata"
18-
"github.com/aws/aws-sdk-go/aws/session"
19-
"github.com/aws/aws-sdk-go/service/ec2"
13+
"github.com/aws/aws-sdk-go-v2/aws"
14+
"github.com/aws/aws-sdk-go-v2/aws/arn"
15+
"github.com/aws/aws-sdk-go-v2/config"
16+
"github.com/aws/aws-sdk-go-v2/credentials"
17+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
18+
"github.com/aws/aws-sdk-go-v2/service/ec2"
19+
"github.com/aws/aws-sdk-go-v2/service/ec2/types"
20+
"github.com/aws/aws-sdk-go-v2/service/ecs"
21+
ecstypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
2022
)
2123

2224
type Provider struct{}
@@ -61,11 +63,11 @@ func (p *Provider) Help() string {
6163

6264
func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error) {
6365
if args["provider"] != "aws" {
64-
return nil, fmt.Errorf("discover-aws: invalid provider " + args["provider"])
66+
return nil, fmt.Errorf("%s", "discover-aws: invalid provider "+args["provider"])
6567
}
6668

6769
if l == nil {
68-
l = log.New(ioutil.Discard, "", 0)
70+
l = log.New(io.Discard, "", 0)
6971
}
7072

7173
region := args["region"]
@@ -122,8 +124,8 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
122124
}
123125
} else {
124126
l.Printf("[INFO] discover-aws: Region not provided. Looking up region in ec2 metadata...")
125-
ec2meta := ec2metadata.New(session.New())
126-
identity, err := ec2meta.GetInstanceIdentityDocument()
127+
ec2meta := imds.New(imds.Options{})
128+
identity, err := ec2meta.GetInstanceIdentityDocument(context.TODO(), &imds.GetInstanceIdentityDocumentInput{})
127129
if err != nil {
128130
return nil, fmt.Errorf("discover-aws: GetInstanceIdentityDocument failed: %s", err)
129131
}
@@ -133,33 +135,36 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
133135
l.Printf("[INFO] discover-aws: Region is %s", region)
134136

135137
l.Printf("[DEBUG] discover-aws: Creating session...")
136-
config := aws.Config{
137-
Region: &region,
138-
Credentials: credentials.NewChainCredentials(
139-
[]credentials.Provider{
140-
&credentials.StaticProvider{
141-
Value: credentials.Value{
142-
AccessKeyID: accessKey,
143-
SecretAccessKey: secretKey,
144-
SessionToken: sessionToken,
145-
},
146-
},
147-
&credentials.EnvProvider{},
148-
&credentials.SharedCredentialsProvider{},
149-
defaults.RemoteCredProvider(*(defaults.Config()), defaults.Handlers()),
150-
}),
151-
}
152-
if endpoint != "" {
153-
l.Printf("[INFO] discover-aws: Endpoint is %s", endpoint)
154-
config.Endpoint = &endpoint
138+
var cfg aws.Config
139+
var err error
140+
if accessKey != "" && secretKey != "" {
141+
log.Println("Using static credentials provider")
142+
staticCreds := credentials.NewStaticCredentialsProvider(accessKey, secretKey, sessionToken)
143+
cfg, err = config.LoadDefaultConfig(context.TODO(), config.WithRegion(region),
144+
config.WithCredentialsProvider(aws.NewCredentialsCache(staticCreds)))
145+
if err != nil {
146+
l.Printf("unable to load SDK config with Static Provider, %v", err)
147+
}
148+
} else {
149+
log.Println("Using default credential chain")
150+
cfg, err = config.LoadDefaultConfig(context.TODO(),
151+
config.WithRegion(region), // Specify your region
152+
)
153+
if err != nil {
154+
return nil, fmt.Errorf("unable to load SDK config with default credential chain, %s", err)
155+
}
155156
}
156157

157158
// Split here for ec2 vs ecs decision tree
158159
if service == "ecs" {
159-
svc := ecs.New(session.New(), &config)
160+
svc := ecs.NewFromConfig(cfg, func(o *ecs.Options) {
161+
if endpoint != "" {
162+
o.BaseEndpoint = aws.String(endpoint)
163+
}
164+
})
160165

161166
log.Printf("[INFO] discover-aws: Filter ECS tasks with %s=%s", tagKey, tagValue)
162-
var clusterArns []*string
167+
var clusterArns []string
163168

164169
// If an ECS Cluster Name (ARN) was specified, dont lookup all the cluster arns
165170
if ecsCluster == "" {
@@ -169,12 +174,12 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
169174
}
170175
clusterArns = arns
171176
} else {
172-
clusterArns = []*string{&ecsCluster}
177+
clusterArns = []string{ecsCluster}
173178
}
174179

175180
var taskIps []string
176181
for _, clusterArn := range clusterArns {
177-
taskArns, err := getEcsTasks(svc, clusterArn, &ecsFamily)
182+
taskArns, err := getEcsTasks(svc, &clusterArn, &ecsFamily)
178183
if err != nil {
179184
return nil, fmt.Errorf("discover-aws: Failed to get ECS Tasks: %s", err)
180185
}
@@ -185,7 +190,7 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
185190
pageLimit := 100
186191
for i := 0; i < len(taskArns); i += pageLimit {
187192
taskGroup := taskArns[i:min(i+pageLimit, len(taskArns))]
188-
ecsTaskIps, err := getEcsTaskIps(svc, clusterArn, taskGroup, &tagKey, &tagValue)
193+
ecsTaskIps, err := getEcsTaskIps(svc, &clusterArn, taskGroup, &tagKey, &tagValue)
189194
if err != nil {
190195
return nil, fmt.Errorf("discover-aws: Failed to get ECS Task IPs: %s", err)
191196
}
@@ -199,18 +204,22 @@ func (p *Provider) Addrs(args map[string]string, l *log.Logger) ([]string, error
199204

200205
// When not using ECS continue with the default EC2 search
201206

202-
svc := ec2.New(session.New(), &config)
207+
svc := ec2.NewFromConfig(cfg, func(o *ec2.Options) {
208+
if endpoint != "" {
209+
o.BaseEndpoint = aws.String(endpoint)
210+
}
211+
})
203212

204213
l.Printf("[INFO] discover-aws: Filter instances with %s=%s", tagKey, tagValue)
205-
resp, err := svc.DescribeInstances(&ec2.DescribeInstancesInput{
206-
Filters: []*ec2.Filter{
207-
&ec2.Filter{
214+
resp, err := svc.DescribeInstances(context.TODO(), &ec2.DescribeInstancesInput{
215+
Filters: []types.Filter{
216+
{
208217
Name: aws.String("tag:" + tagKey),
209-
Values: []*string{aws.String(tagValue)},
218+
Values: []string{tagValue},
210219
},
211-
&ec2.Filter{
220+
{
212221
Name: aws.String("instance-state-name"),
213-
Values: []*string{aws.String("running")},
222+
Values: []string{"running"},
214223
},
215224
},
216225
})
@@ -276,18 +285,17 @@ func min(a, b int) int {
276285
return b
277286
}
278287

279-
func getEcsClusters(svc *ecs.ECS) ([]*string, error) {
280-
pageNum := 0
281-
var clusterArns []*string
282-
err := svc.ListClustersPages(&ecs.ListClustersInput{}, func(page *ecs.ListClustersOutput, lastPage bool) bool {
283-
pageNum++
284-
clusterArns = append(clusterArns, page.ClusterArns...)
285-
log.Printf("[DEBUG] discover-aws: Retrieved %d TaskArns from page %d", len(clusterArns), pageNum)
286-
return !lastPage // return false to exit page function
287-
})
288+
func getEcsClusters(svc *ecs.Client) ([]string, error) {
289+
var clusterArns []string
290+
paginator := ecs.NewListClustersPaginator(svc, &ecs.ListClustersInput{})
288291

289-
if err != nil {
290-
return nil, fmt.Errorf("ListClusters failed: %s", err)
292+
for paginator.HasMorePages() {
293+
page, err := paginator.NextPage(context.TODO())
294+
if err != nil {
295+
return nil, fmt.Errorf("ListClusters failed: %s", err)
296+
}
297+
clusterArns = append(clusterArns, page.ClusterArns...)
298+
log.Printf("[DEBUG] discover-aws: Retrieved %d ClusterArns", len(clusterArns))
291299
}
292300

293301
return clusterArns, nil
@@ -304,7 +312,7 @@ func getECSTaskMetadata() (ECSTaskMeta, error) {
304312
if err != nil {
305313
return metadataResp, fmt.Errorf("calling metadata uri: %s", err)
306314
}
307-
respBytes, err := ioutil.ReadAll(resp.Body)
315+
respBytes, err := io.ReadAll(resp.Body)
308316
if err != nil {
309317
return metadataResp, fmt.Errorf("reading metadata uri response body: %s", err)
310318
}
@@ -325,36 +333,37 @@ func getEcsTaskRegion(e ECSTaskMeta) (string, error) {
325333
return a.Region, nil
326334
}
327335

328-
func getEcsTasks(svc *ecs.ECS, clusterArn *string, family *string) ([]*string, error) {
329-
var taskArns []*string
336+
func getEcsTasks(svc *ecs.Client, clusterArn *string, family *string) ([]string, error) {
337+
var taskArns []string
330338
lti := ecs.ListTasksInput{
331339
Cluster: clusterArn,
332-
DesiredStatus: aws.String("RUNNING"),
340+
DesiredStatus: ecstypes.DesiredStatusRunning,
333341
}
334342
if *family != "" {
335343
lti.Family = family
336344
}
337345

346+
paginator := ecs.NewListTasksPaginator(svc, &lti)
347+
338348
pageNum := 0
339-
err := svc.ListTasksPages(&lti, func(page *ecs.ListTasksOutput, lastPage bool) bool {
349+
for paginator.HasMorePages() {
350+
page, err := paginator.NextPage(context.TODO())
351+
if err != nil {
352+
return nil, fmt.Errorf("ListTasks failed: %w", err)
353+
}
340354
pageNum++
341355
taskArns = append(taskArns, page.TaskArns...)
342356
log.Printf("[DEBUG] discover-aws: Retrieved %d TaskArns from page %d", len(taskArns), pageNum)
343-
return !lastPage // return false to exit page function
344-
})
345-
346-
if err != nil {
347-
return nil, fmt.Errorf("ListTasks failed: %s", err)
348357
}
349358

350359
return taskArns, nil
351360
}
352361

353-
func getEcsTaskIps(svc *ecs.ECS, clusterArn *string, taskArns []*string, tagKey *string, tagValue *string) ([]string, error) {
362+
func getEcsTaskIps(svc *ecs.Client, clusterArn *string, taskArns []string, tagKey *string, tagValue *string) ([]string, error) {
354363
// Describe all the tasks listed for this cluster
355-
taskDescriptions, err := svc.DescribeTasks(&ecs.DescribeTasksInput{
364+
taskDescriptions, err := svc.DescribeTasks(context.TODO(), &ecs.DescribeTasksInput{
356365
Cluster: clusterArn,
357-
Include: []*string{aws.String(ecs.TaskFieldTags)},
366+
Include: []ecstypes.TaskField{ecstypes.TaskFieldTags},
358367
Tasks: taskArns,
359368
})
360369

@@ -376,7 +385,7 @@ func getEcsTaskIps(svc *ecs.ECS, clusterArn *string, taskArns []*string, tagKey
376385

377386
if *taskDescription.DesiredStatus == "RUNNING" {
378387
log.Printf("[INFO] discover-aws: Found Running Instance: %s", *taskDescription.TaskArn)
379-
ip := getIpFromTaskDescription(taskDescription)
388+
ip := getIpFromTaskDescription(&taskDescription)
380389

381390
if ip != nil {
382391
log.Printf("[DEBUG] discover-aws: Found Private IP: %s", *ip)
@@ -394,7 +403,7 @@ func getEcsTaskIps(svc *ecs.ECS, clusterArn *string, taskArns []*string, tagKey
394403
return ipList, nil
395404
}
396405

397-
func getIpFromTaskDescription(taskDesc *ecs.Task) *string {
406+
func getIpFromTaskDescription(taskDesc *ecstypes.Task) *string {
398407
log.Printf("[DEBUG] discover-aws: Searching %d attachments for IPs", len(taskDesc.Attachments))
399408
for _, attachment := range taskDesc.Attachments {
400409

0 commit comments

Comments
 (0)