Validate profiles_endpoint and otlp_http exporter names in endpoint validator - #2276
Open
OisinMcMenamin wants to merge 1 commit into
Open
Validate profiles_endpoint and otlp_http exporter names in endpoint validator#2276OisinMcMenamin wants to merge 1 commit into
OisinMcMenamin wants to merge 1 commit into
Conversation
OisinMcMenamin
force-pushed
the
otlphttp-validator-profiles-endpoint
branch
from
September 8, 2026 09:00
202fe26 to
d926008
Compare
Extends the otlphttp AWS-endpoint allowlist validation to cover the profiles_endpoint key, matching the existing checks for endpoint, metrics_endpoint, traces_endpoint, and logs_endpoint. Also matches otlp_http, the exporter type name the collector registers from v0.150 onward, in addition to the otlphttp name it registers today, so the AWS-endpoint allowlist stays live across the collector upgrade.
OisinMcMenamin
force-pushed
the
otlphttp-validator-profiles-endpoint
branch
from
September 8, 2026 15:56
d926008 to
2d2e0c0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the issue
The otlphttp exporter endpoint validator restricts
endpoint,metrics_endpoint,traces_endpoint, andlogs_endpointto AWS domains, so the agent cannot beconfigured to ship telemetry to a non-AWS destination. Two endpoint keys are not
covered:
profiles_endpoint, and any endpoint on an exporter keyed with theotlp_httptype name.Description of changes
profiles_endpointto the set of otlphttp exporter endpoint keys checkedagainst the AWS DNS-suffix allowlist, so it is validated exactly like the other
four signal endpoints.
otlp_httpin addition tootlphttp. Theexporter translator derives its component key from the factory type
(
component.NewIDWithName(t.factory.Type(), name)), so covering both nameskeeps the allowlist applied regardless of which name the vendored collector
registers.
/and comparing the typeexactly, matching the convention used in
cmd/amazon-cloudwatch-agent/merge.go.Near-miss names such as
otlphttpxare not matched.Configurations that do not set
profiles_endpointare unaffected. A non-AWSprofiles_endpoint, and a non-AWS endpoint on anotlp_http-keyed exporter,are now rejected at startup, consistent with the existing signal endpoints.
License
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Tests
Added unit test cases to
TestOTLPHTTPValidatorcovering, for each of theotlphttpandotlp_httptype names in both bare and named-instance form(
<type>/profiles): a valid AWS endpoint accepted, and a third-party endpointrejected. Also added a case asserting a near-miss name (
otlphttpx) is notmatched.
Commands run locally:
go build ./...— cleanmake test— 267 packages passmake lint— 0 issuesmake fmt,make fmt-sh— no changes producedmake check_secrets— reports a match on its own definition in theMakefile;reproduces on an unmodified checkout
PR checklist
makepasses locally — rango build ./...,make test,make lint,make fmt,make fmt-sh(see Tests)