jadeallenx / net-amazon-ec2 Goto Github PK

As reported in the object, calling the delete_snapshot method with an array reference assigned to SnapshotID results in a
$VAR1 = {
'RequestID' => 'e0e2d000-a7b8-46ce-9ff3-909f0af51e13',
'Errors' => [
{
'Error' => {
'Code' => 'InvalidParameterCombination',
'Message' => 'The parameter 'SnapshotId' may only be specified once.'
}
}
]
};
which I think is self-explanatory.
Or at least so it seems.

After upgrading to a new release i keep getting:

ERROR CODE: HTTP POST FAILURE MESSAGE: 500 Can't connect to ec2.eu-west-1.amazonaws.com:443 (certificate verify failed) FOR REQUEST: N/A

For testing purposes i am just running this (in my perl script):

#!/opt/csw/bin/perl

use Net::Amazon::EC2;

my $ec2 = Net::Amazon::EC2->new(
                AWSAccessKeyId => 'my_key',
                SecretAccessKey => 'my_key',
                region => 'eu-west-1',
                debug => '1'
        );

my $running_instances = $ec2->describe_instances;

foreach my $reservation (@$running_instances) {
          foreach my $instance ($reservation->instances_set) {
                       print $instance->instance_id . "\n";
 }

describe_instances throws error:

Attribute (code) does not pass the type constraint because: Validation failed for 'Int|Str' with value undef at constructor Net::Amazon::EC2::StateReason::new (defined at /usr/local/share/perl/5.22.1/Net/Amazon/EC2/StateReason.pm line 31) line 31
Net::Amazon::EC2::StateReason::new('Net::Amazon::EC2::StateReason', 'code', undef, 'message', undef) called at /usr/local/share/perl/5.22.1/Net/Amazon/EC2.pm line 2098

The undocumented default signature_version is "2".

The leads to code that runs in some regions but not others, which could lead to surprising or unexpected failures when identical code is deployed in multiple regions.

This official AWS page documents which regions don't support Signature Version 2. The failing defaults causes downstream projects like ec2-consistent-snapshot to also fail when deployed in new regions.

Reference: alestic/ec2-consistent-snapshot#87

Hi,

I think it would be better to throw an exception instead of returning an error when a method call fails.

I'm thinking in a patch where you could activate the new behaviour via a new constructor parameter (ala DBI's "RaiseError"). It would be off by default, so it won't break backwards compatibility.

Would you be interested in it? Maybe there's a reason which suggests this is not a good idea?

Best regards,
Miquel

Hi, I think your CPAN tarball misses 4 M::I modules necessary for running 'perl Makefile.PL':

inc/Module/Install/Can.pm
inc/Module/Install/Fetch.pm
inc/Module/Install/Win32.pm
inc/Module/Install/WriteAll.pm

Perhaps you forgot to run 'make dist' or some such?

I'm using CentOS 7. I can install 0.32 but not 0.33 with cpanm. See below.

[09:57:10 [email protected] deploytmp]$ sudo yum update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile

• base: ftp.iij.ad.jp
• extras: ftp.iij.ad.jp
• updates: ftp.iij.ad.jp
  No packages marked for update

[09:57:15 [email protected] deploytmp]$ sudo cpanm http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.32.tar.gz
--> Working on http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.32.tar.gz
Fetching http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.32.tar.gz ... OK
Configuring Net-Amazon-EC2-0.30_1 ... OK
Building and testing Net-Amazon-EC2-0.30_1 ... OK
Successfully installed Net-Amazon-EC2-0.30_1
1 distribution installed

[09:57:19 [email protected] deploytmp]$ sudo cpanm http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.33.tar.gz
--> Working on http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.33.tar.gz
Fetching http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.33.tar.gz ... OK
Configuring Net-Amazon-EC2-0.33 ... N/A
! Configure failed for Net-Amazon-EC2-0.33. See /root/.cpanm/work/1514422640.24102/build.log for details.

[09:57:20 [email protected] deploytmp]$ sudo cat /root/.cpanm/work/1514422640.24102/build.log
cpanm (App::cpanminus) 1.6922 on perl 5.016003 built for x86_64-linux-thread-multi
Work directory is /root/.cpanm/work/1514422640.24102
You have make /bin/make
You have LWP 6.05
You have /bin/tar: tar (GNU tar) 1.26
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by John Gilmore and Jay Fenlason.
You have /bin/unzip
--> Working on http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.33.tar.gz
Fetching http://search.cpan.org/CPAN/authors/id/M/MA/MALLEN/Net-Amazon-EC2-0.33.tar.gz
-> OK
Unpacking Net-Amazon-EC2-0.33.tar.gz
Entering Net-Amazon-EC2-0.33
Checking configure dependencies from META.yml
Checking if you have ExtUtils::MakeMaker 6.36 ... Yes (6.68)
Configuring Net-Amazon-EC2-0.33
Running Makefile.PL
Bareword "WriteAll" not allowed while "strict subs" in use at Makefile.PL line 28.
Execution of Makefile.PL aborted due to compilation errors.
-> N/A
-> FAIL Configure failed for Net-Amazon-EC2-0.33. See /root/.cpanm/work/1514422640.24102/build.log for details.
[09:57:29 [email protected] deploytmp]$

It seems to me that the removal of the lazy flags by a60f750 is causing has_temp_creds and has_SecurityToken to always return true in _sign_v2:

https://github.com/mrallen1/net-amazon-ec2/blob/ceeb817cc7c3606333cb4e0f7f454856583146fb/lib/Net/Amazon/EC2.pm#L296-L298

causing v2 authentication to fail.

No time to make a full showcase (sorry) but in my code I had to dirty-clean SecurityToken and temp_creds as a workaround.

delete $ec2->{SecurityToken};
delete $ec2->{temp_creds};

Net::Amazon::EC2 0.33 have an auth issue with IAM role and signature version 4.

$ cat test.pl
#!/usr/bin/perl
use strict;
use Net::Amazon::EC2;
my ($signature_version) = @ARGV;
if (not defined $signature_version) {
  die "No signature version specified\n";
}
my $ec2 = Net::Amazon::EC2->new(
  region            => 'ap-northeast-1',
  signature_version => $signature_version
);
my $reservations = $ec2->describe_instances;
foreach my $reservation (@$reservations) {
  foreach my $instance ($reservation->instances_set) {
    print $instance->instance_id . "\n";
  }
}

$ chmod u+x test.pl

$ ./test.pl 2
i-0066cd49489e4faa9
i-05eaa8b03dd55d22b

$ ./test.pl 4
Amazon EC2 Errors [Request 08ecf962-c346-4f75-afc2-837eaec2f78f]:
[AuthFailure] AWS was not able to validate the provided access credentials
$

I'm not sure if this issue is region dependent.
This issue has been reported here about two years ago:
https://rt.cpan.org/Public/Bug/Display.html?id=107491

Place holder for an upcoming PR.

If one wants to change the size of the EBS root volume from what is in the AMI and if one needs to specify ephemeral mappings (e.g. for m3 instances[1]), one needs to mix EBS with ephemeral in the BlockDeviceMapping. With how EC2.pm is passed parameters this means passing three arrays and using undef in some positions. I wanted to document this in the POD but I couldn't find a good place for it. Since parameters to run_instances are listed individually that didn't seem like a good place, and there's no place for advanced examples; placing this in the summary seems to violate the brevity implied by the title summary. I'm opening this issues to fish for suggestions.

Here's some example code that could go in the documentation:

my @BDMDeviceName;
my @BDMEBSVolumeSize;
my @BDMVirtualName;

if ($ebsSize) {
    push @BDMDeviceName,    '/dev/sda1';
    push @BDMEBSVolumeSize, $ebsSize;
    push @BDMVirtualName,   undef;
}

for my $ephemeral ( 0 .. 1 ) {
    push @BDMDeviceName,    '/dev/xvd' . chr( ord("b") + $ephemeral );
    push @BDMEBSVolumeSize, undef;
    push @BDMVirtualName,   'ephemeral' . $ephemeral;
}

$run_options{'BlockDeviceMapping.DeviceName'}     = \@BDMDeviceName;
$run_options{'BlockDeviceMapping.VirtualName'}    = \@BDMVirtualName;
$run_options{'BlockDeviceMapping.Ebs.VolumeSize'} = \@BDMEBSVolumeSize;

[1] "For M3 instances, you must specify instance store volumes in the block device mapping for the instance. When you launch an M3 instance, we ignore any instance store volumes specified in the block device mapping for the AMI." -- [AWS Docs](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ApiReference-query-RunI
nstances.html)

The PrivateIpAddress option is missing in run_instances. Here is a patch.

--- lib/Net/Amazon/EC2.pm   2013-01-02 03:39:02.000000000 +0000
+++ /tmp//EC2.pm    2013-02-10 20:51:04.131334183 +0000
@@ -3751,6 +3751,7 @@
        InstanceInitiatedShutdownBehavior               => { type => SCALAR, optional => 1 },
        ClientToken                                     => { type => SCALAR, optional => 1 },
        EbsOptimized                                        => { type => SCALAR, optional => 1 },
+       PrivateIpAddress                                    => { type => SCALAR, optional => 1 },
    });

    # If we have a array ref of instances lets split them out into their SecurityGroup.n format

Hello.

The code reports the regional ec2 endpoints as following the format REGION.ec2.amazonaws.com .

According to the AWS docs the format is ec2.REGION.amazonaws.com .

The newly created AWS region, eu-central-1, doesn't even have an existing eu-central-1.ec2.amazonaws.com host, therefore all requests to it fail.

Regards,
trantor