Skip to content

agent_aws: handle bytes values in special agent JSON serializer - #953

Open
terashiman wants to merge 1 commit into
Checkmk:masterfrom
terashiman:fix/aws-wafv2-bytes-json-serialization
Open

agent_aws: handle bytes values in special agent JSON serializer#953
terashiman wants to merge 1 commit into
Checkmk:masterfrom
terashiman:fix/aws-wafv2-bytes-json-serialization

Conversation

@terashiman

Copy link
Copy Markdown

Summary

The AWS special agent's custom JSON serializer (datetime_serializer in agent_aws.py) only handles datetime objects and raises TypeError for anything else. AWS WAFv2's ByteMatchStatement.SearchString field is decoded by boto3 as Python bytes (e.g. b'/admin/' for a rule blocking that URI path), which is a completely ordinary WAFv2 rule configuration. When such a rule exists on a monitored Web ACL, serializing the wafv2_web_acl section raises an unhandled TypeError, and the special agent exits with code 1 before finishing output. This causes Check_MK Discovery to report the WAFv2 (and any other not-yet-emitted) services as vanished/critical, even though AWS connectivity and credentials are fine.

Reproduced with --debug:

TypeError: b'/admin/' is not JSON serializable

Fix

Add a bytes branch to datetime_serializer that decodes to str (UTF-8, errors="replace") instead of falling through to the TypeError.

Test plan

  • Ran agent_aws manually against a WAFv2 Web ACL containing a ByteMatchStatement rule; reproduced TypeError: b'...' is not JSON serializable and exit code 1 on the unpatched agent
  • Applied the fix; reran the same invocation, got exit code 0 and a correctly decoded SearchString value in the wafv2_web_acl section
  • Re-enabled WAFv2 monitoring on the affected host and confirmed Check_MK Discovery and all AWS/WAFv2 services report OK

WAFv2 ByteMatchStatement.SearchString is returned by boto3 as bytes.
The special agent's custom JSON serializer only handled datetime
objects and raised TypeError for anything else, crashing the AWS
special agent (and check_mk_discovery with it) whenever a monitored
WAFv2 Web ACL contains a byte-match rule (e.g. one blocking a URI
path such as "/admin/").

Decode bytes to str so the wafv2_web_acl section can be serialized
instead of aborting the whole agent run.
@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@terashiman

terashiman commented Aug 24, 2026

Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants