imghelper: set AWS_CA_BUNDLE if cert is available

bottlerocket-os · Jan 23, 2025 · 60113ea · 60113ea
1 parent 0d967cc
commit 60113ea
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/twoliter/embedded/imghelper b/twoliter/embedded/imghelper
@@ -430,6 +430,11 @@ sbsetup_wrapup() {
 }
 
 sbsetup_aws_profile() {
+  # Use the CA bundle override as the AWS CA cert bundle, if present.
+  if [[ -s "/root/certs/ca-bundle.crt" ]]; then
+    cp /root/certs/ca-bundle.crt /etc/pki/tls/cert.pem
+    export AWS_CA_BUNDLE=/etc/pki/tls/cert.pem
+  fi
   # Set AWS environment variables from build secrets, if present.
   local var val
   for var in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do