Surface plugin-not-found error for ssm start-session when the plugin is missing - #10626
Open
Sanjays2402 wants to merge 1 commit into
Open
Surface plugin-not-found error for ssm start-session when the plugin is missing#10626Sanjays2402 wants to merge 1 commit into
Sanjays2402 wants to merge 1 commit into
Conversation
Previously the plugin was checked only after the StartSession API call succeeded. When the plugin was missing, the CLI called TerminateSession to clean up the started session; if the caller lacked the ssm:TerminateSession permission, that AccessDenied error masked the real "plugin not found" error. Check for the plugin before starting the session so the actionable error is always surfaced, and never let a cleanup failure mask it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fixes #9837.
When
aws ssm start-sessionis run without the session-manager-plugin installed, the CLI only discovered the missing plugin after theStartSessionAPI call had already succeeded. It then calledTerminateSessionto clean up the just-started session. If the caller lacked thessm:TerminateSessionpermission, thatAccessDeniedExceptionreplaced the real, actionable error — telling the user they had a permissions problem when the actual problem was a missing plugin.Fix
session-manager-plugin --version) before callingStartSession. When it is missing, fail fast with the existing "SessionManagerPlugin is not found" message — no session is created, so no cleanup API call (and no extra permission) is needed.TerminateSessioncleanup in the remaining edge case (plugin vanishing mid-command) is now logged at debug level instead of masking the plugin-not-found error.Testing
TerminateSessionsurfacedAccessDeniedException; after the fix, the user getsSessionManagerPlugin is not found...and neitherStartSessionnorTerminateSessionis called.tests/unit/customizations/test_sessionmanager.py: 83 passed (added 2 regression tests; updated 2 tests for the new fail-fast ordering).tests/functional/ssm/test_start_session.py: 9 passed (updated 1 test that encoded the old start-then-terminate behavior).flake8clean on all touched files.AI disclosure
This PR was prepared with the assistance of AI coding tools; independent human review is still pending.