Commit f0dd0185 authored by nicoo's avatar nicoo Committed by github-actions[bot]
Browse files

nixos/ssm-agent: Handle sudo-rs too 

(cherry picked from commit 690f0272)
parent 1f33d804

nixos/modules/services/misc/amazon-ssm-agent.nix

+8 −11
Original line number Diff line number Diff line
@@ -15,6 +15,11 @@ let 
      -r) echo "${config.system.nixos.version}";;

    esac

  '';



  sudoRule = {

    users = [ "ssm-user" ];

    commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ];

  };

in {

  imports = [

    (mkRenamedOptionModule [ "services" "ssm-agent" "enable" ] [ "services" "amazon-ssm-agent" "enable" ])
@@ -54,17 +59,9 @@ in { 


    # Add user that Session Manager needs, and give it sudo.

    # This is consistent with Amazon Linux 2 images.

    security.sudo.extraRules = [

      {

        users = [ "ssm-user" ];

        commands = [

          {

            command = "ALL";

            options = [ "NOPASSWD" ];

          }

        ];

      }

    ];

    security.sudo.extraRules = [ sudoRule ];

    security.sudo-rs.extraRules = [ sudoRule ];



    # On Amazon Linux 2 images, the ssm-user user is pretty much a

    # normal user with its own group. We do the same.

    users.groups.ssm-user = {};