ansible-lockdown/AMAZON2023-CIS

AMAZON linux 2023 unable to connect to ssm

Closed this issue · 3 comments

globalpayments-shoebsyed commented

Describe the Issue
We have use the CIS hardening of amazon linux 2023 and build a new AMI.
With this AMI we have created a instance however instance is unable to connect ssm agent.

We have received below error
[ 14.119919] hibinit-agent[1747]: OSError: [Errno 101] Network is unreachable

Could you please suggest on it.

Expected Behavior
A clear and concise description of what you expected to happen.

Actual Behavior
A clear and concise description of what's happening.

Control(s) Affected
What controls are being affected by the issue

Environment (please complete the following information):

  • branch being used: [e.g. devel]
  • Ansible Version: [e.g. 2.10]
  • Host Python Version: [e.g. Python 3.7.6]
  • Ansible Server Python Version: [e.g. Python 3.7.6]
  • Additional Details:

Additional Notes
Anything additional goes here

Possible Solution
Enter a suggested fix here

globalpayments-shoebsyed commented

Receiving below error
Cannot open access to console, the root account is locked.

uk-bolly commented

hi @shoebsyed561

Thank you for taking the time to raise this issue, im hoping we are able to follow this up for you, if you could please let us know.
We don't make any changes in the playbook to change the root password, we check it is set with the correct crypto but no changes take place, So this would need to be carried out as part of the system coinfiguration.
With regard to connecting to SSM are you seeing firewall denies? i assume this is trying to get to a location that has not been allowed by firewall settings?

Any information that you can provide if this is still an issue, happy to investigate further if this is a playbook issue.

many thanks

uk-bolly

globalpayments-shoebsyed commented

@uk-bolly Thank you for response, The issue was because we are using the old CIS, By updating the CIS file to latest release the issue resolved.