Skip to content

[Asset Inventory][AWS] ELBv2: resolve IPAddresses from DNSName when API returns none - #8230

Open
kubasobon wants to merge 1 commit into
asset-inventory/forward-port-7277from
asset-inventory/elbv2-dns-fallback
Open

[Asset Inventory][AWS] ELBv2: resolve IPAddresses from DNSName when API returns none#8230
kubasobon wants to merge 1 commit into
asset-inventory/forward-port-7277from
asset-inventory/elbv2-dns-fallback

Conversation

@kubasobon

Copy link
Copy Markdown
Member

Summary

Stacked on #8229 (forward-port of #7277). Review #8229 first; this PR's diff shows only the ELBv2 DNS fallback on top of it.

Problem

entity.Details.IPAddresses is always empty for real-world ALBs and NLBs. The AWS API field AvailabilityZones[].LoadBalancerAddresses[].IpAddress is only populated for NLBs with explicitly assigned Elastic IPs — across 200 sampled internet-facing NLBs it was empty on all of them. The classic ELB (v1) fetcher was given a DNS-resolution fallback in #7277; ELBv2 was not.

Fix

Mirror the ELBv1 pattern in the elb_v2 package:

  • elb_v2.go: add unexported hostResolver interface (LookupHost) + resolver field on Provider; set net.DefaultResolver in NewElbV2Provider.
  • load_balancer_v2.go: add dnsResolvedIPs []string field; GetIPAddresses() returns it as a fallback when the API slice is empty; add NewElasticLoadBalancerInfo constructor for testability.
  • provider_v2.go: after listeners are fetched, if GetIPAddresses() is still empty, resolve DNSName via the injected resolver, sort the result, soft-fail on error (a DNS outage must not fail the fetch cycle).
  • provider_v2_test.go: add per-case resolver column with four cases: DNS fallback used + sorted, resolver error soft-fail, API IPs win (resolver not called), and the existing error path.
  • fetcher_elb_test.go: switch ELBv2 case to NewElasticLoadBalancerInfo with pre-resolved IPs; assert IPAddresses in expected Details.

Caveat

DNS-resolved IPs are point-in-time. ALB/NLB addresses rotate and vary by resolver vantage point. This matches what the classic ELB fetcher already does and what InfoSec's legacy scripts do — parity, not a new compromise.

Related

Checklist

  • Tests added (DNS fallback, soft-fail, API-wins paths)
  • Mocks updated (mockHostResolver added to elb_v2_mock.go)

@kubasobon
kubasobon requested a review from a team as a code owner September 1, 2026 10:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant