Release 2.1.3: retry lifecycle results on transient errors, directory symlinks, non-UTF-8 file names, and Windows install permissions

CHANGELOG.md

@@ -1,3 +1,22 @@
+## 2.1.3
+
+### Added
+
+* **Optional `preserve_directory_symlinks`** (default `false`, Linux and macOS). A symlink to a directory in the revision is installed as a symlink instead of copying the directory it points to ([#152](https://github.com/aws/aws-codedeploy-agent/issues/152)). The AppSpec `permissions` section is not applied through a preserved link; a warning is logged instead.
+
+### Fixed
+
+* **Lifecycle event results are retried on transient errors.** When reporting a result fails with a 5xx or network error, the agent retries with exponential backoff for up to 65 minutes after the command was acknowledged. Previously only throttling was retried, so a hook that succeeded could fail with "CodeDeploy agent was not able to notify CodeDeploy server the execution result of this lifecycle event". Stopping the agent during retries can take as long as the retry period, bounded by `kill_agent_max_wait_time_seconds`.
+* **Symlinks replace existing files and symlinks ([#143](https://github.com/aws/aws-codedeploy-agent/issues/143)).** Installing a symlink over an existing file or symlink now replaces it. A symlink over an existing directory is refused before any file is copied, and cleanup removes dangling symlinks.
+* **File names that are not valid UTF-8 ([#284](https://github.com/aws/aws-codedeploy-agent/issues/284)).** Such files no longer hang the Install event; they are installed and removed on the next deployment when a revision drops them. A destination path that contains a line break fails the deployment before any files are copied.
+* **Concurrent deployments that create the same missing parent directory ([#429](https://github.com/aws/aws-codedeploy-agent/pull/429))** no longer fail the Install event.
+* **GitHub deployments that use an access token ([#434](https://github.com/aws/aws-codedeploy-agent/issues/434))** no longer fail with HTTP 401. The token is now redacted only in the debug log.
+* **On Windows, agent deployment folders stay readable by standard users** (`deployment-logs`, `ongoing-deployment`, and the per-deployment folders), matching the 0755 folders on Linux and macOS. Standard users cannot modify them.
+
+### Security
+
+* Improved file system permissions on the agent installation folder on Windows Server.
+
 ## 2.1.2
 
 ### Added

Cargo.toml

@@ -7,7 +7,7 @@ edition = "2024"
 rust-version = "1.91"
 homepage = "https://aws.amazon.com/codedeploy/"
 repository = "https://github.com/aws/aws-codedeploy-agent"
-version = "2.1.2"
+version = "2.1.3"
 description = "AWS CodeDeploy agent responsible for deploying software on an individual EC2/On-prem instance"
 license = "Apache-2.0"
 authors = ["Amazon Web Services"]

conf/codedeployagent.yml

@@ -39,6 +39,11 @@
 # Any reuse failure falls back to a normal download.
 :enable_archive_reuse: true
 
+# Copy a symlink to a directory in the revision as a symlink (default: false).
+# When false, the agent copies the contents of the directory the link points to.
+# Linux and macOS only.
+# :preserve_directory_symlinks: false
+
 # Security
 :use_fips_mode: false
 :enable_auth_policy: false

crates/codedeploy-commands/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codedeploy-commands"
-version = "2.1.2"
+version = "2.1.3"
 edition = "2024"
 rust-version = "1.91"
 publish = false

crates/codedeploy-commands/src/client.rs

@@ -13,7 +13,10 @@ use aws_sigv4::sign::v4;
 use std::time::{Duration, SystemTime};
 
 /// `CodeDeploy` Command Service client.
-#[derive(Debug)]
+///
+/// Cheap to clone: the credentials and the reqwest client are reference-counted,
+/// so clones share one connection pool.
+#[derive(Debug, Clone)]
 pub struct Client {
     endpoint: String,
     region: String,
@@ -26,6 +29,9 @@ pub struct Client {
     http: reqwest::blocking::Client,
     credentials: AwsCredentials,
     agent_version: Option<String>,
+    // Kept so `reset_http_connections` can rebuild `http` identically.
+    http_read_timeout: Duration,
+    proxy_uri: Option<String>,
 }
 
 impl Client {
@@ -52,6 +58,20 @@ impl Client {
         self.agent_version.as_deref()
     }
 
+    /// Drop pooled connections by replacing the HTTP client.
+    ///
+    /// Pooled keep-alive connections stay pinned to whichever backend host the
+    /// load balancer first chose. Call this after a 5xx or network error so the
+    /// next request opens a fresh connection and can reach a healthy host.
+    /// Requests already in flight on the old client finish normally.
+    ///
+    /// # Errors
+    /// Returns an error if the HTTP client cannot be rebuilt.
+    pub fn reset_http_connections(&mut self) -> Result<(), Error> {
+        self.http = build_http(self.http_read_timeout, self.proxy_uri.as_deref())?;
+        Ok(())
+    }
+
     /// Poll for a host command.
     ///
     /// # Errors
@@ -318,16 +338,7 @@ impl ClientBuilder {
             self.enable_auth_policy,
         );
 
-        let mut http_builder =
-            reqwest::blocking::ClientBuilder::new().timeout(self.http_read_timeout);
-
-        if let Some(proxy) = self.proxy_uri {
-            let proxy = reqwest::Proxy::all(&proxy)
-                .map_err(|e| Error::new(ErrorKind::Build, e.to_string()))?;
-            http_builder = http_builder.proxy(proxy);
-        }
-
-        let http = http_builder.build().map_err(|e| Error::new(ErrorKind::Build, e.to_string()))?;
+        let http = build_http(self.http_read_timeout, self.proxy_uri.as_deref())?;
 
         // Signing name and target prefix both track enable_auth_policy, which
         // also selects the `-secure` endpoint.
@@ -358,10 +369,27 @@ impl ClientBuilder {
             http,
             credentials,
             agent_version: self.agent_version,
+            http_read_timeout: self.http_read_timeout,
+            proxy_uri: self.proxy_uri,
         })
     }
 }
 
+fn build_http(
+    http_read_timeout: Duration,
+    proxy_uri: Option<&str>,
+) -> Result<reqwest::blocking::Client, Error> {
+    let mut http_builder = reqwest::blocking::ClientBuilder::new().timeout(http_read_timeout);
+
+    if let Some(proxy) = proxy_uri {
+        let proxy =
+            reqwest::Proxy::all(proxy).map_err(|e| Error::new(ErrorKind::Build, e.to_string()))?;
+        http_builder = http_builder.proxy(proxy);
+    }
+
+    http_builder.build().map_err(|e| Error::new(ErrorKind::Build, e.to_string()))
+}
+
 impl Default for ClientBuilder {
     fn default() -> Self {
         Self {
@@ -386,6 +414,28 @@ mod tests {
         AwsCredentials::new("test-key", "test-secret", None, None, "test")
     }
 
+    #[test]
+    fn reset_http_connections_keeps_configuration() {
+        let mut client = Client::builder()
+            .region("us-west-2")
+            .credentials(test_credentials())
+            .http_read_timeout(Duration::from_secs(7))
+            .proxy_uri(Some("http://proxy.example:3128".into()))
+            .agent_version(Some("2.1.3".into()))
+            .build()
+            .unwrap();
+        let endpoint = client.endpoint().to_string();
+
+        client.reset_http_connections().unwrap();
+        client.reset_http_connections().unwrap();
+
+        assert_eq!(client.endpoint(), endpoint);
+        assert_eq!(client.region(), "us-west-2");
+        assert_eq!(client.agent_version(), Some("2.1.3"));
+        assert_eq!(client.http_read_timeout, Duration::from_secs(7));
+        assert_eq!(client.proxy_uri.as_deref(), Some("http://proxy.example:3128"));
+    }
+
     #[test]
     fn build_requires_region() {
         let err = Client::builder().credentials(test_credentials()).build().unwrap_err();

crates/codedeploy-commands/src/error.rs

@@ -7,11 +7,13 @@ use std::fmt;
 pub struct Error {
     kind: ErrorKind,
     message: String,
+    /// HTTP status of the response, when the error came from one.
+    status: Option<u16>,
 }
 
 impl Error {
     pub fn new(kind: ErrorKind, message: impl Into<String>) -> Self {
-        Self { kind, message: message.into() }
+        Self { kind, message: message.into(), status: None }
     }
 
     /// The error kind.
@@ -20,8 +22,28 @@ impl Error {
         &self.kind
     }
 
-    /// Parse error from HTTP response body.
+    /// The HTTP status code, if the error came from a service response.
+    ///
+    /// `None` for errors raised before a response was received (network,
+    /// signing, serialization).
+    #[must_use]
+    pub fn status(&self) -> Option<u16> {
+        self.status
+    }
+
+    /// Attach an HTTP status code.
+    #[must_use]
+    pub fn with_status(mut self, status: u16) -> Self {
+        self.status = Some(status);
+        self
+    }
+
+    /// Parse error from HTTP response body, keeping the status code.
     pub(crate) fn from_response(status: u16, body: &[u8]) -> Self {
+        Self { status: Some(status), ..Self::classify_response(status, body) }
+    }
+
+    fn classify_response(status: u16, body: &[u8]) -> Self {
         // Detect throttling (HTTP 429) before parsing the body — the service
         // may return 429 with or without a JSON body.
         if status == 429 {
@@ -285,6 +307,30 @@ mod tests {
         let error = Error::new(ErrorKind::Http, "test");
         assert_eq!(error.kind(), &ErrorKind::Http);
         assert_eq!(error.message, "test");
+        assert_eq!(error.status(), None);
+    }
+
+    #[test]
+    fn from_response_keeps_status_for_service_unavailable() {
+        // A 503 with a ServiceUnavailableException body.
+        let body = r#"{"__type": "com.amazonaws.codedeploy#ServiceUnavailableException"}"#;
+        let error = Error::from_response(503, body.as_bytes());
+        assert_eq!(error.kind(), &ErrorKind::Http);
+        assert_eq!(error.status(), Some(503));
+    }
+
+    #[test]
+    fn from_response_keeps_status_for_bodyless_500() {
+        let error = Error::from_response(500, b"");
+        assert_eq!(error.kind(), &ErrorKind::Http);
+        assert_eq!(error.status(), Some(500));
+    }
+
+    #[test]
+    fn from_response_keeps_status_when_throttled() {
+        let error = Error::from_response(429, b"not json");
+        assert_eq!(error.kind(), &ErrorKind::Throttled);
+        assert_eq!(error.status(), Some(429));
     }
 
     #[test]