Skip to content

Validate profiles_endpoint and otlp_http exporter names in endpoint validator - #2276

Open
OisinMcMenamin wants to merge 1 commit into
aws:mainfrom
OisinMcMenamin:otlphttp-validator-profiles-endpoint
Open

Validate profiles_endpoint and otlp_http exporter names in endpoint validator#2276
OisinMcMenamin wants to merge 1 commit into
aws:mainfrom
OisinMcMenamin:otlphttp-validator-profiles-endpoint

Conversation

@OisinMcMenamin

@OisinMcMenamin OisinMcMenamin commented Sep 7, 2026

Copy link
Copy Markdown

Description of the issue

The otlphttp exporter endpoint validator restricts endpoint, metrics_endpoint,
traces_endpoint, and logs_endpoint to AWS domains, so the agent cannot be
configured to ship telemetry to a non-AWS destination. Two endpoint keys are not
covered: profiles_endpoint, and any endpoint on an exporter keyed with the
otlp_http type name.

Description of changes

  • Adds profiles_endpoint to the set of otlphttp exporter endpoint keys checked
    against the AWS DNS-suffix allowlist, so it is validated exactly like the other
    four signal endpoints.
  • Matches the exporter type as otlp_http in addition to otlphttp. The
    exporter translator derives its component key from the factory type
    (component.NewIDWithName(t.factory.Type(), name)), so covering both names
    keeps the allowlist applied regardless of which name the vendored collector
    registers.
  • Selects exporters by splitting the component key on / and comparing the type
    exactly, matching the convention used in cmd/amazon-cloudwatch-agent/merge.go.
    Near-miss names such as otlphttpx are not matched.

Configurations that do not set profiles_endpoint are unaffected. A non-AWS
profiles_endpoint, and a non-AWS endpoint on an otlp_http-keyed exporter,
are now rejected at startup, consistent with the existing signal endpoints.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

Added unit test cases to TestOTLPHTTPValidator covering, for each of the
otlphttp and otlp_http type names in both bare and named-instance form
(<type>/profiles): a valid AWS endpoint accepted, and a third-party endpoint
rejected. Also added a case asserting a near-miss name (otlphttpx) is not
matched.

Commands run locally:

  • go build ./... — clean
  • make test — 267 packages pass
  • make lint — 0 issues
  • make fmt, make fmt-sh — no changes produced
  • make check_secrets — reports a match on its own definition in the Makefile;
    reproduces on an unmodified checkout

PR checklist

  • Commits are squashed into a logical, reviewable set (one commit for a single change)
  • Commits and PR description comply with Amazon internal guidelines
  • make passes locally — ran go build ./..., make test, make lint, make fmt, make fmt-sh (see Tests)
  • All GitHub Actions checks on the PR are passing
  • Integration test evidence: N/A — the change only affects validation during config loading and adds no runtime pipeline behavior; covered by unit tests
  • New or updated integration test coverage: N/A — no new integration surface
  • New functionality has unit tests; bug fixes have a reproducing test
  • Config translation changes include updated golden files: N/A — no translator changes
  • Breaking or customer-visible changes are called out in the PR description

@OisinMcMenamin
OisinMcMenamin requested a review from a team as a code owner September 7, 2026 15:10
@OisinMcMenamin
OisinMcMenamin force-pushed the otlphttp-validator-profiles-endpoint branch from 202fe26 to d926008 Compare September 8, 2026 09:00
Extends the otlphttp AWS-endpoint allowlist validation to cover the
profiles_endpoint key, matching the existing checks for endpoint,
metrics_endpoint, traces_endpoint, and logs_endpoint.

Also matches otlp_http, the exporter type name the collector registers
from v0.150 onward, in addition to the otlphttp name it registers
today, so the AWS-endpoint allowlist stays live across the collector
upgrade.
@OisinMcMenamin
OisinMcMenamin force-pushed the otlphttp-validator-profiles-endpoint branch from d926008 to 2d2e0c0 Compare September 8, 2026 15:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant