aws, out_cloudwatch_logs: honor the output tls setting (valgrind logs added)

[cvas22]

Logs

valgrind-flb-it-aws_credentials_http.log
valgrind-flb-rt-out_cloudwatch.log
valgrind-fluent-bit.log
valgrind-flb-it-aws_credentials_ec2.log

cloudwatch_logs output always used TLS, whatever tls was set to. That made plain-HTTP endpoints such as a local AWS emulator unusable.

The cause was in the EC2 and HTTP credential providers. Their upstream_set turned ins->use_tls off while setting up their plain-HTTP upstream, then set it to FLB_TRUE regardless of its previous value. Because the EC2 provider is always part of the standard chain, every output using it ended up with use_tls on after init. out_cloudwatch_logs reads use_tls after upstream_set, so tls off was lost. That plugin also registered with .flags = 0, so it only used TLS by default because of this side effect, and tls on was rejected with "does not support TLS".

Changes (one commit per component):

• out_cloudwatch_logs: register with FLB_OUTPUT_NET | FLB_IO_TLS (same as out_s3), so TLS stays on by default and tls on/tls off are both accepted. This commit comes first so that every commit keeps TLS on by default.
• aws: in upstream_set_fn_ec2() and upstream_set_fn_http(), save the instance's use_tls and restore it after flb_output_upstream_set() instead of forcing it to true.
• tests: new internal tests test_ec2_provider_upstream_set_keeps_use_tls and test_http_provider_upstream_set_keeps_use_tls, and new out_cloudwatch runtime cases tls_default, tls_off, tls_on, which check use_tls, the CloudWatch client flags and the upstream flags.

Other AWS outputs are unaffected. out_kinesis_streams and out_kinesis_firehose hardcode TLS. out_s3 and out_bigquery already register FLB_IO_TLS. out_es and out_opensearch read use_tls before they call upstream_set.

Fixes #12577

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change
• Attached Valgrind output that shows no leaks or memory corruption was found

All runs were on Linux (Debian bookworm, GCC 12, in Docker), configured with -DFLB_TESTS_RUNTIME=On -DFLB_TESTS_INTERNAL=On -DFLB_USE_SIMDUTF=No. I turned simdutf off only because its AVX2 code did not build with GCC 12 in that container. It is unrelated to this change.

• flb-it-aws_credentials_ec2, flb-it-aws_credentials_http, flb-rt-out_cloudwatch: all pass.
• I reverted the three source files and kept the new tests. The two internal tests and tls_off then fail (tls=off use_tls=1 client flags=2 upstream flags=26), and tls_on fails with cloudwatch_logs.0 does not support TLS.
• Regression runs of flb-it-aws_credentials, flb-it-aws_credentials_sts, flb-rt-out_s3, flb-rt-out_kinesis and flb-rt-out_firehose all pass.
• Valgrind (--leak-check=full) on the five new test cases reports ERROR SUMMARY: 0 errors from 0 contexts.
• tests/integration/scenarios/out_s3 (shares the AWS credential code): 19 passed, 6 skipped, both normally and with VALGRIND=1 VALGRIND_STRICT=1. out_cloudwatch_logs has no integration scenario.

Manual check with the configuration from the issue against python3 -m http.server 4566:

[SERVICE]
    Flush     1
    Log_Level debug
[INPUT]
    Name  dummy
    Tag   test
[OUTPUT]
    Name              cloudwatch_logs
    Match             test
    region            eu-west-2
    endpoint          localhost
    port              4566
    tls               Off
    log_group_name    test-group
    log_stream_name   test-stream
    auto_create_group On

The requests now reach the plain-HTTP server, which rejects them with 501 because it does not implement POST. Before the fix they failed in the TLS handshake with wrong version number.

[debug] [aws_client] localhost: http_do=0, HTTP Status: 501
[debug] [output:cloudwatch_logs:cloudwatch_logs.0] CreateLogStream http status=501

http.server log:

127.0.0.1 - - [18/Oct/2026 21:02:49] "POST / HTTP/1.0" 501 -

Not tested: real AWS endpoints, ECS/EKS credential sources, and Windows/macOS builds.

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• [N/A] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • CloudWatch Logs now correctly honors its configured TLS setting, including when TLS is turned off.
  • AWS EC2 and HTTP credential lookups no longer override an output’s existing TLS setting while configuring credential connections.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T23:05:19.898763Z	cb5806b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 055af7a7-fa15-4c4e-8102-ea1a99268c77

📥 Commits

Reviewing files that changed from the base of the PR and between b43b6a6 and cb5806b.

📒 Files selected for processing: 6

• plugins/out_cloudwatch_logs/cloudwatch_logs.c
• src/aws/flb_aws_credentials_ec2.c
• src/aws/flb_aws_credentials_http.c
• tests/internal/aws_credentials_ec2.c
• tests/internal/aws_credentials_http.c
• tests/runtime/out_cloudwatch.c

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The CloudWatch Logs output now declares TLS support. EC2 and HTTP credential providers preserve the output instance’s TLS setting during upstream setup. Added tests cover provider TLS preservation and CloudWatch’s default, off, and on settings.

Changes: CloudWatch TLS behavior

Layer / File(s)	Summary
Declare and preserve CloudWatch TLS settings plugins/out_cloudwatch_logs/cloudwatch_logs.c, src/aws/flb_aws_credentials_ec2.c, src/aws/flb_aws_credentials_http.c, tests/internal/aws_credentials_ec2.c, tests/internal/aws_credentials_http.c, tests/runtime/out_cloudwatch.c	The CloudWatch Logs plugin registers network and TLS flags. EC2 and HTTP credential providers restore the output instance’s previous TLS setting after upstream setup. Tests check provider TLS preservation and CloudWatch TLS defaults, off, and on.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: edsiper

Merge Risk: ⚪ Minimal · up to cb580

No identified issue remains that should prevent merging after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Issue [#12577] requires CloudWatch Logs to honor tls off, preserve the output TLS value in the EC2 and HTTP credential providers, and keep TLS enabled by default. The reviewed provider code saves `i…
Out of Scope Changes check		The changes stay within issue [#12577]. The source changes modify only CloudWatch TLS registration and AWS credential-provider TLS restoration. The added internal and runtime tests verify those change…
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: honoring the configured TLS setting for the AWS CloudWatch Logs output. The Valgrind note is also related to the reported validation.

Full details: Linked Issues check

Explanation

Issue [#12577] requires CloudWatch Logs to honor tls off, preserve the output TLS value in the EC2 and HTTP credential providers, and keep TLS enabled by default. The reviewed provider code saves ins->use_tls, disables it only for plain-HTTP upstream setup, and restores the saved value. The CloudWatch code reads ins->use_tls after provider setup. The supplied change summary reports FLB_OUTPUT_NET | FLB_IO_TLS registration and runtime tests for default, tls off, and tls on. These changes satisfy the issue requirements.

Full details: Out of Scope Changes check

Explanation

The changes stay within issue [#12577]. The source changes modify only CloudWatch TLS registration and AWS credential-provider TLS restoration. The added internal and runtime tests verify those changes. The reported regression and Valgrind tests support affected AWS outputs and do not introduce unrelated product behavior.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}