Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFE: Make GCE and AWS EC2 images public #191

Closed
cevich opened this issue Sep 7, 2022 · 2 comments
Closed

RFE: Make GCE and AWS EC2 images public #191

cevich opened this issue Sep 7, 2022 · 2 comments

Comments

@cevich
Copy link
Member

cevich commented Sep 7, 2022

There's no secret-sauce in our VM images. However keeping them private excludes the community from utilizing the images for auxiliary purposes. For example, leveraging GCE compute_engine_instance in their own Cirrus-CI setup.

Making images public in GCE requires a gcloud command. , it cannot be done in packer. OTOH, making our AWS EC2 images public is just a change to the packer templates.

Thanks to @n1hility for the suggestion and for pointing this out.
@cevich cevich mentioned this issue Nov 21, 2022
Merged
@cevich
Copy link
Member Author

cevich commented Dec 7, 2022

I can't easily/safely fix this using our automation workflows for GCE because it involves granting far to permissive IAM access to the service account. Since every PR potentially publishes new images, it's simply too large of an attack vector for me to open.

AWS Images OTOH are much easier to make public, since all I need to do is remove some metadata we set with Packer. The AWS images are substantially identical to the GCP ones, at least for Fedora.

cevich added a commit to cevich/automation_images that referenced this issue Dec 7, 2022
@cevich
Make AWS AMI's accessible by the public
1a88780 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
cevich added a commit to cevich/automation_images that referenced this issue Dec 7, 2022
@cevich
Make AWS AMI's accessible by the public
1ae4d54 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich mentioned this issue Dec 7, 2022
Closed
cevich added a commit to cevich/automation_images that referenced this issue Dec 9, 2022
@cevich
Make AWS AMI's accessible by the public
4f80d2e 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
cevich added a commit to cevich/automation_images that referenced this issue Dec 9, 2022
@cevich
Make AWS AMI's accessible by the public
95b31b7 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
cevich added a commit to cevich/automation_images that referenced this issue Dec 9, 2022
@cevich
Make AWS AMI's accessible by the public
9fe344c 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
cevich added a commit to cevich/automation_images that referenced this issue Dec 9, 2022
@cevich
Make AWS AMI's accessible by the public
a4c5a7c 
Fixes: containers#191

On at least two occasions I can remember, users outside the
containers-team have requested access to our CI VM images.
Unfortunately doing this for the GCE images has some security-interest
conflicts with our build automation.  However, making the AWS AMI's
public is rather easy to do.  In fact it's the default unless they are
specifically locked down.  Simply remove the private restrictions and
allow access to `"all"` AWS groups.

Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich
Copy link
Member Author

cevich commented Jan 9, 2023

Closing as "can't fix". Opening up the GCP images requires relaxing build-time security posture more than I'm willing. Opening up AWS image will swiftly run into their "max 5 public AMIs" limit.

@cevich cevich closed this as completed Jan 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Make AWS AMI's accessible by the public cevich/automation_images
1 participant
@cevich