webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

gokrazy/build: use AWS SDK instead of shelling out to aws CLI

Browse Source 
Replace the four aws CLI shell-outs (s3 cp, ec2 import-snapshot,
describe-import-snapshot-tasks, register-image) with aws-sdk-go-v2 S3
and EC2 clients. Credentials come from the SDK default chain, so
existing aws sso login / aws configure / AWS_PROFILE / env / aws-vault
sessions keep working.

Verify auth via sts:GetCallerIdentity before the slow image build so a
logged-out user fails in seconds, not minutes. Upload via the S3
manager (concurrent multipart) with a native progress reader, log
[n/4] step lines, and bail on terminal import-snapshot failure states
instead of polling forever.

Updates #1866

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby
2026-07-15 15:15:17 +02:00
committed by Kristoffer Dalby
parent b049ce71a5
commit a7f3e08335
5 changed files with 392 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gokrazy/README.md
+8 -2
View File
@@ -51,8 +51,14 @@ For UTM, see the [UTM instructions](UTM.md).
### Build an AMI
`go run build.go --bucket=your-S3-temp-bucket` to build an AMI. Make
sure your "aws" command is in your path and has access.
`go run build.go --bucket=your-S3-temp-bucket` to build an AMI.
Credentials come from the AWS SDK's default chain, so authenticate any way it
recognizes: `aws sso login`, `aws configure`, an `AWS_PROFILE`,
`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` env vars, or
`aws-vault exec <profile> -- go run build.go --bucket=...` (aws-vault injects
temporary credentials as env vars). If no credentials are found the build stops
with a message telling you how to log in.
### Creating an instance