Added AWS image filtering based on the image owner
Details
| Detail name | Value |
|---|---|
| Changelog Number | 24026 |
| Type | Improvement |
| Status | Resolved |
| Fix Versions | Exasol 2025.1.1, C4 4.19.11, C4 4.28.3, Exasol 8.29.12 |
| Resolution Date | 2025-07-23 |
Background
The Exasol deployment tool “c4” has a configuration parameter called CCC_AWS_IMAGE_NAME. The c4 tool tries to find the corresponding image ID using the image name in the current region. However, an attacker could in theory create their own image with the same name (but a different ID) and c4 could accidentally pick it up when trying to find the image ID.
Improvement
c4 now has a new configuration parameter called CCC_AWS_IMAGE_OWNER, which it uses to validate that the resolved image ID is actually owned by the image owner. The default image owner is currently set to Exasol’s private account since the default image that is used is a custom Ubuntu AMI published by Exasol.
