(aws-ec2): Support Amazon Linux 2023 as a first-class option for BastionHostLinux

[blimmer]

Describe the feature

Today, the excellent BastionHostLinux construct defaults to an Amazon Linux 2 base image:

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/bastion-host.ts

Lines 63 to 69 in fac4a9c

	/**
	* The machine image to use, assumed to have SSM Agent preinstalled.
	*
	* @default - An Amazon Linux 2 image which is kept up-to-date automatically (the instance
	* may be replaced on every deployment) and already has SSM Agent installed.
	*/
	readonly machineImage?: IMachineImage;

However, Amazon Linux 2 will hit end of life in June 2025.

I see that I can pass my own MachineImage, but it'd be nice if there was a first-class flag to opt-in.

Use Case

It'd be nice to still be able to use BastionHostLinux, but use the newer Amazon Linux so I don't have to worry about upgrading next year.

Proposed Solution

It'd probably be a good idea to introduce a new feature flag and plan to automatically opt people into Amazon Linux 2023 on the next major version.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.132.1

Environment details (OS name and version, etc.)

macOS sonoma

[pahud]

I support that but changing the default image would cause breaking changes and the deployed bastion hosts would be replaced. I guess we probably need a feature flag in this case. Need input and ack from the maintainers.

We welcome and appreciate PRs for this. Are you interested to submit a PR for it?

[blimmer]

It looks like it'd be as simple as just updating this line to use a different machine image:

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/bastion-host.ts

Lines 183 to 185 in 1c82930

	machineImage: props.machineImage ?? MachineImage.latestAmazonLinux2({
	cpuType: this.toAmazonLinuxCpuType(instanceType.architecture),
	}),

So it seems like people could just pass 2023 as their image:

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/machine-image/machine-image.ts

Lines 64 to 78 in 1c82930

	/**
	* An Amazon Linux 2023 image that is automatically kept up-to-date
	*
	* This Machine Image automatically updates to the latest version on every
	* deployment. Be aware this will cause your instances to be replaced when a
	* new version of the image becomes available. Do not store stateful information
	* on the instance if you are using this image.
	*/
	public static latestAmazonLinux2023(props?: AmazonLinux2023ImageSsmParameterProps): IMachineImage {
	return new AmazonLinux2023ImageSsmParameter({
	cachedInContext: false,
	...props,
	kernel: AmazonLinux2023Kernel.CDK_LATEST,
	});
	}

So the real question is "can/should we feature flag this as a new default?". I understand that it'd be a breaking change, but that's kinda the point of feature flags. There's a pattern for this with other deprecations like this. Since AmazonLinux2 goes EOL in about 1 year, people are going to have to think about this anyway.

If I can get validation that changing this default via a feature flag is acceptable, I could make the PR.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.