{"action":"created","issue":{"url":"https://api.github.com/repos/convox/rack/issues/949","repository_url":"https://api.github.com/repos/convox/rack","labels_url":"https://api.github.com/repos/convox/rack/issues/949/labels{/name}","comments_url":"https://api.github.com/repos/convox/rack/issues/949/comments","events_url":"https://api.github.com/repos/convox/rack/issues/949/events","html_url":"https://github.com/convox/rack/issues/949","id":168190896,"number":949,"title":"Security updates not applied on instance launch","user":{"login":"mwarkentin","id":67560,"avatar_url":"https://avatars.githubusercontent.com/u/67560?v=3","gravatar_id":"","url":"https://api.github.com/users/mwarkentin","html_url":"https://github.com/mwarkentin","followers_url":"https://api.github.com/users/mwarkentin/followers","following_url":"https://api.github.com/users/mwarkentin/following{/other_user}","gists_url":"https://api.github.com/users/mwarkentin/gists{/gist_id}","starred_url":"https://api.github.com/users/mwarkentin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mwarkentin/subscriptions","organizations_url":"https://api.github.com/users/mwarkentin/orgs","repos_url":"https://api.github.com/users/mwarkentin/repos","events_url":"https://api.github.com/users/mwarkentin/events{/privacy}","received_events_url":"https://api.github.com/users/mwarkentin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-07-28T20:38:37Z","updated_at":"2016-07-29T16:08:00Z","closed_at":null,"body":"It appears that the expected behaviour of applying `yum` security updates at instance launch via cloud-init is not happening:\r\n\r\n```\r\n$ convox instances\r\nID                   AGENT  STATUS  STARTED        PS  CPU     MEM\r\ni-03c528cd198c13f67  on     active  2 minutes ago  0   0.00%   0.00%\r\n\r\n$ convox instances ssh i-03c528cd198c13f67\r\nLast login: Thu Jul 28 20:30:24 2016 from ip-10-0-5-84.ec2.internal\r\n\r\n   __|  __|  __|\r\n   _|  (   \\__ \\   Amazon ECS-Optimized Amazon Linux AMI 2016.03.c\r\n ____|\\___|____/\r\n\r\nFor documentation visit, http://aws.amazon.com/documentation/ecs\r\n4 package(s) needed for security, out of 10 available\r\nRun \"sudo yum update\" to apply all updates.\r\n```\r\n\r\n@MiguelMoll thought that `repo_upgrade: security` should be the default for Amazon Linux, however that doesn't seem to be the case (docs?)."},"comment":{"url":"https://api.github.com/repos/convox/rack/issues/comments/236222214","html_url":"https://github.com/convox/rack/issues/949#issuecomment-236222214","issue_url":"https://api.github.com/repos/convox/rack/issues/949","id":236222214,"user":{"login":"mwarkentin","id":67560,"avatar_url":"https://avatars.githubusercontent.com/u/67560?v=3","gravatar_id":"","url":"https://api.github.com/users/mwarkentin","html_url":"https://github.com/mwarkentin","followers_url":"https://api.github.com/users/mwarkentin/followers","following_url":"https://api.github.com/users/mwarkentin/following{/other_user}","gists_url":"https://api.github.com/users/mwarkentin/gists{/gist_id}","starred_url":"https://api.github.com/users/mwarkentin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mwarkentin/subscriptions","organizations_url":"https://api.github.com/users/mwarkentin/orgs","repos_url":"https://api.github.com/users/mwarkentin/repos","events_url":"https://api.github.com/users/mwarkentin/events{/privacy}","received_events_url":"https://api.github.com/users/mwarkentin/received_events","type":"User","site_admin":false},"created_at":"2016-07-29T16:08:00Z","updated_at":"2016-07-29T16:08:00Z","body":"@MiguelMoll Spent some time discussing with our security guy - we're ok with it as-is for now. We'll spend some more time monitoring and analyzing ALAS alerts over the next couple of weeks to get a better sense of how important we consider being able to update the medium / low vulnerable packages are to us."}}
{"actor":{"display_login":"mwarkentin"}}