kitchen-ec2 3.22.7 → 3.22.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54005acc701e50833f4592f90156aa8d41f74ceba73c824df2903940afd4232d
-  data.tar.gz: e1c55129e883dfa0e92f0c2510a47d4719fe7ceb2f2b3c9db4bcb766c05fe18c
+  metadata.gz: adbbc52b9c77d773ae78ebd08798d629a6781793d0e91ff46fb14eb080c70595
+  data.tar.gz: 8df7160b05b65d0187b24d9525ea458593db0c95cf9cef261683229752ca1cf6
 SHA512:
-  metadata.gz: 61ddb4833e791864530709dba1bd080519a7e8e8d18268ee147f6cf8f2bfa212218e81f40990e8fc7e13288abb2d77edfba580a757cb8488fc7738189cfb940c
-  data.tar.gz: 415028713bf3467ed42152c5249730212d0124e5a0424867cd1580f55f1b23dbaef199bc8aa82cc88fa2e0e0e85e7ae1de30d3f55de7e967588fcabbda333450
+  metadata.gz: 956f2322fd4e6bb42ad179c677159be0acb108b30c651c940e95b3c6e266466a548a982f9bb9bcc6edeea3e3ae9734ddc37d80dad14cce80a78c268d733a97ba
+  data.tar.gz: f98fe3846db116988011feefebae241fec7145cbbc49aa45d3e82620c1ba5fa36ae15222125144cf37405d7f373db0c5fbcf32505b62453b9f677e84cfa3c765

data/lib/kitchen/driver/aws/dedicated_hosts.rb

@@ -91,7 +91,9 @@ module Kitchen
         #   host costs money whether or not it is used.
         def allocate_host
           unless allow_allocate_host?
-            warn "ERROR: Attempted to allocate dedicated host but need environment variable TK_ALLOCATE_DEDICATED_HOST to be set"
+            warn "ERROR: Attempted to allocate a dedicated host, but the driver setting `allocate_dedicated_host` is not enabled. " \
+                 "Set `allocate_dedicated_host: true` to allow it, remembering that a dedicated host is billed from allocation " \
+                 "until it is released."
             exit!
           end
 

data/lib/kitchen/driver/aws/instance_generator.rb

@@ -92,34 +92,29 @@ module Kitchen
             security_groups = []
             filters = [config[:security_group_filter]].flatten
             filters.each do |sg_filter|
-              r = {}
+              # Built up rather than assigned, so that a filter carrying both a
+              # name and a tag searches on both. Assigning meant the tag
+              # replaced the name outright, silently widening the search to
+              # whatever else carried that tag.
+              criteria = []
               if sg_filter[:name]
-                r[:filters] = [
-                  {
-                    name: "group-name",
-                    values: [sg_filter[:name]],
-                  },
-                  {
-                    name: "vpc-id",
-                    values: [vpc_id],
-                  },
-                ]
+                criteria << { name: "group-name", values: [sg_filter[:name]] }
               end
-
               if sg_filter[:tag]
-                r[:filters] = [
-                  {
-                    name: "tag:#{sg_filter[:tag]}",
-                    values: [sg_filter[:value]],
-                  },
-                  {
-                    name: "vpc-id",
-                    values: [vpc_id],
-                  },
-                ]
+                criteria << { name: "tag:#{sg_filter[:tag]}", values: [sg_filter[:value]] }
+              end
+
+              # Refused rather than sent: describe_security_groups with no
+              # filters returns every security group in the region, and all of
+              # them were then attached to the instance.
+              if criteria.empty?
+                raise "A security_group_filter needs a `name` or a `tag`, but " \
+                      "#{sg_filter.inspect} has neither."
               end
 
-              security_group = client.describe_security_groups(r).security_groups
+              criteria << { name: "vpc-id", values: [vpc_id] }
+
+              security_group = client.describe_security_groups(filters: criteria).security_groups
 
               if security_group.any?
                 security_group.each { |sg| security_groups.push(sg.group_id) }
@@ -232,11 +227,13 @@ module Kitchen
               i[:placement][:tenancy] = placement[:tenancy]
             end
           end
+          # RunInstances calls this `license_specifications`. The driver option
+          # is `licenses`, and the payload key used to match the option rather
+          # than the API, which no EC2 API accepts.
           license_specifications = config[:licenses]
           if license_specifications
-            i[:licenses] = []
-            license_specifications.each do |license_configuration_arn|
-              i[:licenses].append({ license_configuration_arn: license_configuration_arn[:license_configuration_arn] })
+            i[:license_specifications] = license_specifications.map do |license|
+              { license_configuration_arn: license[:license_configuration_arn] }
             end
           end
           unless config[:instance_initiated_shutdown_behavior].nil? ||

data/lib/kitchen/driver/aws/standard_platform/alma.rb

@@ -50,6 +50,23 @@ module Kitchen
             search
           end
 
+          # Sort images newest release first, keeping Kitten builds last.
+          #
+          # AlmaLinux Kitten is AlmaLinux's development distribution, published
+          # from the same account and under the same "AlmaLinux OS" prefix as
+          # the releases. Its name carries no release number, so {.from_image}
+          # reads the major straight into the build date: "AlmaLinux OS Kitten
+          # 10.20260727.0" yields "10.20260727", a far larger number than the
+          # "10.2" of an actual release, which sorts Kitten ahead of
+          # everything. A versioned search is unaffected, since "AlmaLinux OS
+          # 10*" does not match "AlmaLinux OS Kitten 10*".
+          #
+          # @param images [Array<Aws::EC2::Image>] the images to sort
+          # @return [Array<Aws::EC2::Image>] the images, newest release first
+          def sort_by_version(images)
+            prefer(super) { |image| !image.name.include?("Kitten") }
+          end
+
           # Detect this platform from an EC2 image.
           #
           # Matching is done on the image name, which is the only reliable signal

data/lib/kitchen/driver/aws/standard_platform/debian.rb

@@ -98,6 +98,29 @@ module Kitchen
             search
           end
 
+          # Sort images newest release first, keeping backports images last.
+          #
+          # Debian publishes a backports image alongside each release, from the
+          # same account and under the same "debian-<release>-" prefix,
+          # differing only by the word "backports" in the name:
+          #
+          #     debian-12-backports-amd64-20260821-2577
+          #     debian-12-amd64-20260821-2577
+          #
+          # It runs the backports kernel rather than the release's own -- 6.12
+          # against 6.1 for Debian 12 -- and is often published minutes after
+          # its plain counterpart, so a tie broken on creation date handed
+          # every Debian platform the backports image.
+          #
+          # This is a preference rather than a filter, so a release with only
+          # backports images published is still selectable.
+          #
+          # @param images [Array<Aws::EC2::Image>] the images to sort
+          # @return [Array<Aws::EC2::Image>] the images, newest release first
+          def sort_by_version(images)
+            prefer(super) { |image| !image.name.include?("backports") }
+          end
+
           # Detect this platform from an EC2 image.
           #
           # Matching is done on the image name, which is the only reliable signal

data/lib/kitchen/driver/aws/standard_platform/fedora.rb

@@ -23,6 +23,12 @@ module Kitchen
         class Fedora < StandardPlatform
           StandardPlatform.platforms["fedora"] = self
 
+          # Name fragments marking an image as a development stream rather
+          # than a Fedora release: Rawhide (the rolling development branch),
+          # ELN (Enterprise Linux Next) and the Prerelease builds published
+          # while a release is still stabilising.
+          DEVELOPMENT_STREAMS = /-(?:Rawhide|ELN|Prerelease)-/i
+
           # The account EC2 creates on this platform's official AMIs.
           #
           # Used as the SSH username when the transport does not specify one.
@@ -43,12 +49,36 @@ module Kitchen
           def image_search
             search = {
               "owner-id" => "125523088429",
-              "name" => version ? "Fedora-Cloud-Base-#{version}-*" : "Fedora-Cloud-Base-*",
+              "name" => if version
+                          # Both naming schemes are searched because the older
+                          # one is still present in some regions.
+                          ["Fedora-Cloud-Base-AmazonEC2.*-#{version}-*",
+                           "Fedora-Cloud-Base-#{version}-*"]
+                        else
+                          "Fedora-Cloud-Base-*"
+                        end,
             }
             search["architecture"] = architecture if architecture
             search
           end
 
+          # Sort images newest release first, keeping development streams last.
+          #
+          # Fedora publishes Rawhide, ELN and Prerelease images from the same
+          # account and under the same "Fedora-Cloud-Base-" prefix as its
+          # releases. Those names carry a build date where a release carries a
+          # release number, so {.from_image} reads a version like "20250820.0"
+          # off them -- larger than any real release, which sorts them to the
+          # front. They are pushed to the back afterwards, the same way RHEL
+          # handles its Beta images.
+          #
+          # @param images [Array<Aws::EC2::Image>] the images to sort
+          # @return [Array<Aws::EC2::Image>] the images, newest release first
+          def sort_by_version(images)
+            images = super
+            prefer(images) { |image| !DEVELOPMENT_STREAMS.match?(image.name) }
+          end
+
           # Detect this platform from an EC2 image.
           #
           # Matching is done on the image name, which is the only reliable signal

data/lib/kitchen/driver/aws/standard_platform/freebsd.rb

@@ -57,6 +57,28 @@ module Kitchen
             search
           end
 
+          # Sort images newest release first, preferring the cloud-init flavor.
+          #
+          # FreeBSD publishes several flavors of each release, distinguished
+          # only by a word at the end of the image name, and only the
+          # cloud-init flavor is a general-purpose cloud image. "base" and
+          # "small" ship without sudo, so a converge fails on them; "builder"
+          # is a developer image that does not boot to a usable state on a
+          # small instance -- launched on a t3.micro it reaches "impaired" and
+          # never opens port 22. Nothing in the name distinguishes them by
+          # date or version, so without a preference the flavor selected is
+          # effectively arbitrary.
+          #
+          # Releases old enough to predate the flavored names publish a single
+          # image each. Because this is a stable partition rather than a
+          # filter, those are left where the version sort put them.
+          #
+          # @param images [Array<Aws::EC2::Image>] the images to sort
+          # @return [Array<Aws::EC2::Image>] the images, best match first
+          def sort_by_version(images)
+            prefer(super) { |image| image.name.include?("cloud-init") }
+          end
+
           # Detect this platform from an EC2 image.
           #
           # Matching is done on the image name, which is the only reliable signal

data/lib/kitchen/driver/aws/standard_platform/rhel.rb

@@ -90,10 +90,11 @@ module Kitchen
           # @param images [Array<Aws::EC2::Image>] the images to sort
           # @return [Array<Aws::EC2::Image>] the images, best match first
           def sort_by_version(images)
-            # First do a normal version sort
-            super(images)
-            # Now sort again, shunning Beta releases.
-            prefer(images) { |image| !image.name.match(/_Beta-/i) }
+            # `prefer(super)`, not `super(images)` followed by
+            # `prefer(images)`: `prefer` returns a new array rather than
+            # reordering in place, so applying it to the original argument
+            # discarded the version sort entirely.
+            prefer(super) { |image| !image.name.match?(/_Beta-/i) }
           end
         end
       end

data/lib/kitchen/driver/aws/standard_platform.rb

@@ -153,6 +153,20 @@ module Kitchen
         #
         def self.from_platform_string(driver, platform_string)
           platform, version, architecture = parse_platform_string(platform_string)
+
+          # A few platform names end in what looks like a version but is
+          # really part of the distribution's name: "amazon2023" and "amazon2"
+          # are Amazon Linux 2023 and Amazon Linux 2, not releases 2023 and 2
+          # of "amazon" (which is the long-EOL Amazon Linux 1). Written with a
+          # dash -- the spelling the documentation uses -- the split above
+          # lands on the "amazon" platform searching for a release that never
+          # existed, and no image matches. Fold the release back into the name
+          # whenever the two together name a platform that is registered.
+          if version && platforms["#{platform}#{version}"]
+            platform = "#{platform}#{version}"
+            version = nil
+          end
+
           return unless platform && platforms[platform]
 
           platforms[platform].new(driver, platform, version, architecture)

data/lib/kitchen/driver/ec2.rb

@@ -16,8 +16,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require "fileutils" unless defined?(FileUtils)
 require "sshkey" unless defined?(SSHKey)
 require "benchmark" unless defined?(Benchmark)
+require "open3" unless defined?(Open3)
 require "json" unless defined?(JSON)
 require "kitchen"
 require_relative "ec2_version"
@@ -228,6 +230,19 @@ module Kitchen
         end
       end
 
+      # A placement group is named either by ID or by name, never both: EC2
+      # rejects a RunInstances call carrying the pair. The payload generator
+      # therefore only applies each one when the other is absent, which means
+      # setting both silently drops both and the instance launches in no
+      # placement group at all, with nothing in the output to say so.
+      validations[:placement] = lambda do |_attr, val, _driver|
+        if val.is_a?(Hash) && val[:group_id] && val[:group_name]
+          warn "Cannot set both 'group_id' and 'group_name' under 'placement'. " \
+            "A placement group is identified by one or the other, so please set only one."
+          exit!
+        end
+      end
+
       # empty keys cause failures when tagging and they make no sense
       validations[:tags] = lambda do |_attr, val, _driver|
         # if someone puts the tags each on their own line it's an array not a hash
@@ -248,11 +263,13 @@ module Kitchen
       #
       # Any failure destroys the instance and everything auto-created alongside
       # it, so that a failed create does not leave billable resources behind.
+      # Interrupts are re-raised untouched once that cleanup has run.
       #
       # @param state [Hash] the instance state, updated in place with
       #   `:server_id`, `:hostname` and any auto-created credentials
       # @return [void]
-      # @raise [RuntimeError] wrapping whatever went wrong, after cleaning up
+      # @raise [Kitchen::ActionFailed] wrapping whatever went wrong, after
+      #   cleaning up
       def create(state)
         return if state[:server_id]
 
@@ -292,7 +309,8 @@ module Kitchen
             exit!
           end
 
-          allocate_host unless host_available?
+          # Remembered so that destroy releases this host and no other.
+          state[:allocated_host_id] = allocate_host unless host_available?
 
           info("Auto placement on one dedicated host out of: #{hosts_with_capacity.map(&:host_id).join(", ")}")
         end
@@ -335,10 +353,60 @@ module Kitchen
         attach_network_interface(state) unless config[:elastic_network_interface_id].nil?
         create_ec2_json(state) if /chef/i.match?(instance.provisioner.name)
         debug("ec2:create '#{state[:hostname]}'")
-      rescue Exception => e
-        # Clean up the instance and any auto-created security groups or keys on the way out.
+      rescue ::Exception => e
+        # Deliberately ::Exception, and deliberately broad: a create that is
+        # interrupted partway through must still clean up, or the user is left
+        # paying for an instance Test Kitchen has forgotten about.
+        #
+        # Root-qualified because this file is nested inside `module Kitchen`.
+        # There is no Kitchen::Exception today, but Kitchen::StandardError does
+        # exist, and an unqualified constant would silently pick it up if one
+        # were ever added.
         destroy(state)
-        raise "#{e.message} in the specified region #{config[:region]}. Please check this AMI is available in this region."
+
+        # Signals and exits are re-raised untouched. Wrapping a Ctrl-C in an
+        # ActionFailed would report the user's own interrupt as a driver bug.
+        raise if e.is_a?(::SignalException) || e.is_a?(::SystemExit)
+
+        raise Kitchen::ActionFailed, create_failure_message(e), e.backtrace
+      end
+
+      # Describe a failed create without discarding what actually went wrong.
+      #
+      # This message used to append "in the specified region <region>. Please
+      # check this AMI is available in this region" to *every* failure, and to
+      # raise a bare RuntimeError, so the original exception class and
+      # backtrace were lost. A local OpenSSL fault, an expired credential or a
+      # missing subnet all arrived looking like an AMI problem, sending users
+      # to check something that was never wrong.
+      #
+      # The hint is worth keeping -- an AMI that does not exist in the region
+      # really is a common mistake -- but only when the failure is about the
+      # image.
+      #
+      # @param error [Exception] the underlying failure
+      # @return [String]
+      # @see https://github.com/test-kitchen/kitchen-ec2/issues/606
+      def create_failure_message(error)
+        message = "Failed to create the EC2 instance: #{error.class}: #{error.message}"
+        return message unless image_related_error?(error)
+
+        "#{message} Check that image #{config[:image_id]} exists and is available " \
+          "in region #{config[:region]}."
+      end
+
+      # Whether a failure is about the AMI rather than something else entirely.
+      #
+      # EC2 reports every image problem with a code beginning "InvalidAMI"; the
+      # message check catches errors raised by the driver itself, which are
+      # plain strings with no code attached.
+      #
+      # @param error [Exception] the underlying failure
+      # @return [Boolean]
+      def image_related_error?(error)
+        return true if error.respond_to?(:code) && error.code.to_s.start_with?("InvalidAMI")
+
+        error.message.to_s.match?(/\bAMI\b/i)
       end
 
       # Terminate the instance and clean up everything created alongside it.
@@ -385,11 +453,22 @@ module Kitchen
         delete_security_group(state)
         delete_key(state)
 
-        # Clean up dedicated hosts matching instance_type and unused (if allowed)
+        # Release the dedicated host this instance's create allocated, if it
+        # allocated one and nothing else is left running on it.
+        #
+        # Only that host. Dedicated hosts are a shared pool -- create places
+        # onto any managed host with room rather than always allocating, so
+        # most runs allocate nothing -- and releasing every empty managed host
+        # tore down hosts belonging to other suites, including one allocated
+        # seconds earlier by a concurrent run whose instance had not launched
+        # onto it yet.
         return unless config[:tenancy] == "host" && allow_deallocate_host?
 
-        empty_hosts = hosts_with_capacity.select { |host| host_unused?(host) }
-        empty_hosts.each { |host| deallocate_host(host.host_id) }
+        host_id = state.delete(:allocated_host_id)
+        return unless host_id
+
+        host = host_for_id(host_id)
+        deallocate_host(host_id) if host && host_unused?(host)
       end
 
       # The EC2 image this instance will be created from.
@@ -901,20 +980,35 @@ module Kitchen
       # @return [String] a PowerShell script wrapped in `<powershell>` tags
       def default_windows_user_data
         base_script = Kitchen::Util.outdent!(<<-EOH)
-	$OSVersion = (get-itemproperty -Path "HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" -Name ProductName).ProductName
-  If($OSVersion.contains('2016') -Or $OSVersion.contains('2019') -Or $OSVersion -eq 'Windows Server Datacenter') {
-    New-Item -ItemType Directory -Force -Path 'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log'
-    $logfile='C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log\\kitchen-ec2.log'
-    # EC2Launch doesn't init extra disks by default
-    C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Scripts\\InitializeDisks.ps1
-  } Else {
-     New-Item -ItemType Directory -Force -Path 'C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs'
-     $logfile='C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs\\kitchen-ec2.log'
-  }
-
-        # Logfile fail-safe in case the directory does not exist
+        # Log where the installed launch agent already logs, chosen by looking
+        # for it rather than by matching the OS against known release names.
+        # Writing into the directory of an agent that is not installed would
+        # invent a misleading empty tree.
+        $logdir = If (Test-Path 'C:\\ProgramData\\Amazon\\EC2Launch') {
+            'C:\\ProgramData\\Amazon\\EC2Launch\\log'
+        } ElseIf (Test-Path 'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch') {
+            'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log'
+        } ElseIf (Test-Path 'C:\\Program Files\\Amazon\\Ec2ConfigService') {
+            'C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs'
+        } Else {
+            Join-Path $env:ProgramData 'Amazon\\kitchen-ec2'
+        }
+        New-Item -ItemType Directory -Force -Path $logdir | Out-Null
+        $logfile = Join-Path $logdir 'kitchen-ec2.log'
         New-Item $logfile -Type file -Force
 
+        # Extra EBS volumes are attached but left uninitialized: no launch
+        # agent partitions them by default, on any release. Done with the
+        # storage cmdlets rather than by calling a particular agent's script,
+        # so it does not matter which agent is installed. Only RAW disks are
+        # touched, so a volume that already carries a filesystem is never
+        # reformatted.
+        "Initializing any uninitialized volumes" >> $logfile
+        Get-Disk | Where-Object PartitionStyle -eq 'RAW' |
+          Initialize-Disk -PartitionStyle MBR -PassThru |
+          New-Partition -AssignDriveLetter -UseMaximumSize |
+          Format-Volume -FileSystem NTFS -Confirm:$false >> $logfile
+
         # Allow script execution
         Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
         #PS Remoting and & winrm.cmd basic config
@@ -927,7 +1021,6 @@ module Kitchen
         & winrm.cmd set winrm/config '@{MaxTimeoutms="1800000"}' >> $logfile
         & winrm.cmd set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}' >> $logfile
         & winrm.cmd set winrm/config/winrs '@{MaxShellsPerUser="50"}' >> $logfile
-        & winrm.cmd set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}' >> $logfile
         #Firewall Config
         & netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" profile=public protocol=tcp localport=5985 remoteip=localsubnet new remoteip=any  >> $logfile
         Set-ItemProperty -Name LocalAccountTokenFilterPolicy -Path HKLM:\\software\\Microsoft\\Windows\\CurrentVersion\\Policies\\system -Value 1
@@ -1179,7 +1272,12 @@ module Kitchen
         info("Removing automatic key pair #{state[:auto_key_id]}")
         ec2.client.delete_key_pair(key_name: state[:auto_key_id])
         state.delete(:auto_key_id)
-        File.unlink("#{config[:kitchen_root]}/.kitchen/#{instance.name}.pem")
+        # The file is not always still there: it may have been cleaned up by
+        # hand, wiped along with .kitchen, or never written at all, since
+        # create records the key pair in the state before writing it. This is
+        # the last thing destroy does, so raising here fails the whole action
+        # after every AWS resource has already been cleaned up successfully.
+        FileUtils.rm_f("#{config[:kitchen_root]}/.kitchen/#{instance.name}.pem")
       end
 
       # Finalize the driver config and install transport overrides.
@@ -1562,6 +1660,9 @@ module Kitchen
           return File.read(public_key_path).strip
         end
 
+        public_key = instance_connect_public_key_via_ssh_keygen(private_key_path)
+        return public_key if public_key
+
         begin
           key = SSHKey.new(File.read(private_key_path))
           key.ssh_public_key
@@ -1570,6 +1671,35 @@ module Kitchen
         end
       end
 
+      # Derive the public half of a private key with ssh-keygen.
+      #
+      # OpenSSH reads every key type EC2 can create. The sshkey gem handles
+      # only RSA and DSA, and raises "Neither PUB key nor PRIV key" on an
+      # ed25519 key -- which is exactly what `aws_ssh_key_type: ed25519`
+      # produces, so that documented setting could not be combined with
+      # Instance Connect at all.
+      #
+      # Falling back to the gem rather than requiring ssh-keygen keeps the RSA
+      # default working where OpenSSH is not installed.
+      #
+      # @param private_key_path [String] path to the private key
+      # @return [String, nil] the public key in OpenSSH format, or nil when
+      #   ssh-keygen is unavailable or could not read the key
+      def instance_connect_public_key_via_ssh_keygen(private_key_path)
+        output, status = Open3.capture2e("ssh-keygen", "-y", "-f", private_key_path)
+        return output.strip if status.success?
+
+        debug("ssh-keygen could not read #{private_key_path}: #{output.strip}")
+        nil
+      # ::StandardError, not StandardError: this file is nested inside `module
+      # Kitchen`, which defines Kitchen::StandardError. An unqualified constant
+      # resolves to that one, letting the Errno::ENOENT raised by a missing
+      # ssh-keygen escape the check meant to detect it.
+      rescue ::StandardError => e
+        debug("Could not run ssh-keygen: #{e.message}")
+        nil
+      end
+
       # SSM Session Manager Support Methods
 
       # The SSM Session Manager helper.
@@ -1648,9 +1778,18 @@ module Kitchen
               "--region", driver_instance.config[:region]
             ]
 
-            # Add document name if specified
+            # Tunnelling SSH over SSM needs a session document that forwards a
+            # port. Without one, `start-session` opens an interactive shell
+            # session instead, which speaks nothing SSH understands: pointed at
+            # that as a ProxyCommand, SSH waits for a banner that never comes
+            # and the create hangs until it is interrupted. AWS-StartSSHSession
+            # is the document AWS publishes for this, and `%p` is substituted by
+            # Net::SSH::Proxy::Command with the port being connected on, so a
+            # transport using a port other than 22 tunnels to that port.
             if driver_instance.config[:ssm_session_manager_document_name]
               cmd += ["--document-name", driver_instance.config[:ssm_session_manager_document_name]]
+            else
+              cmd += ["--document-name", "AWS-StartSSHSession", "--parameters", "portNumber=%p"]
             end
 
             # Add AWS profile if specified

data/lib/kitchen/driver/ec2_version.rb

@@ -19,6 +19,6 @@
 module Kitchen
   module Driver
     # Version string for EC2 Test Kitchen driver
-    EC2_VERSION = "3.22.7".freeze
+    EC2_VERSION = "3.22.10".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-ec2
 version: !ruby/object:Gem::Version
-  version: 3.22.7
+  version: 3.22.10
 platform: ruby
 authors:
 - Test Kitchen Team