user-data has too wide permission on AWS backend about nixops-aws

[edolstra]

/root/.ssh/id_charon_vpn is a different key by the way. It's the private client key allowing the machine to create tunnels to other machines.

[edolstra]

The key in the user data is a temporary key only used while creating the machine, when there are no other users. It's then replaced by the actual key (see https://github.com/NixOS/nixops/blob/master/nixops/backends/ec2.py#L991).

Once upon a time we didn't replace the key, so we had a blackhole route to prevent access to the metadata server, but that's no longer needed.

[spinus]

@edolstra thanks for explaining.

1. Should user-data been removed after key is replaced?
2. /root/.ssh/id_charon_vpn - indeed is different key, sorry for false alarm. I just compared not enough characters :-)

[edolstra]

AFAIK, there is no way to remove/change user data after instance creation. If there were, we wouldn't have to generate a new host key, we could just wipe the user data.

[spinus]

Do you think it's worth to add this info to documentation or add description field to user-data with information for people that this is only one-time key?

[spinus]

Should I make something to improve this (if yes, what could be the good way) or close the ticket?