You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jan 16, 2025. It is now read-only.
@@ -352,6 +353,14 @@ In case the setup does not work as intended follow the trace of events:
352
353
- Once an EC2 instance is running, you can connect to it in the EC2 user interface using Session Manager (use `enable_ssm_on_runners = true`). Check the user data script using `cat /var/log/user-data.log`. By default several log files of the instances are streamed to AWS CloudWatch, look for a log group named `<environment>/runners`. In the log group you should see at least the log streams for the user data installation and runner agent.
353
354
- Registered instances should show up in the Settings - Actions page of the repository or organization (depending on the installation mode).
354
355
356
+
## Security Consideration
357
+
358
+
This module creates resources in your AWS infrastructure, and EC2 instances for hosting the self-hosted runners on-demand. IAM permissions are set to a minimal level, and could be further limit by using permission boundaries. Instances permissions are limit to retrieve and delete the registration token, access the instance own tags, and terminate the instance itself.
359
+
360
+
The examples are using standard AMI's for different operation systems. Instances are not hardened, and sudo operation are not blocked. To provide an out of the box working expierence by default the module installs and configure the runner. However secrets are not hard coded, they finally end up in the memory of the instances. You can harden the instance by providing your own AMI and overwriting the cloud-init script.
361
+
362
+
We welcome any improvement to the standard module to make the default as secure as possible, in the end it remains your responsibility to keep your environment secure.
363
+
355
364
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
356
365
## Requirements
357
366
@@ -409,6 +418,7 @@ In case the setup does not work as intended follow the trace of events:
409
418
| <aname="input_enable_runner_binaries_syncer"></a> [enable\_runner\_binaries\_syncer](#input\_enable\_runner\_binaries\_syncer)| Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI. |`bool`|`true`| no |
410
419
| <aname="input_enable_runner_detailed_monitoring"></a> [enable\_runner\_detailed\_monitoring](#input\_enable\_runner\_detailed\_monitoring)| Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details. |`bool`|`false`| no |
411
420
| <aname="input_enable_ssm_on_runners"></a> [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners)| Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. |`bool`|`false`| no |
421
+
| <aname="input_enable_user_data_debug_logging_runner"></a> [enable\_user\_data\_debug\_logging\_runner](#input\_enable\_user\_data\_debug\_logging\_runner)| Option to enable debug logging for user-data, this logs all secrets as well. |`bool`|`false`| no |
412
422
| <aname="input_enabled_userdata"></a> [enabled\_userdata](#input\_enabled\_userdata)| Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI. |`bool`|`true`| no |
413
423
| <aname="input_environment"></a> [environment](#input\_environment)| A name that identifies the environment, used as prefix and for tagging. |`string`|`null`| no |
414
424
| <aname="input_fifo_build_queue"></a> [fifo\_build\_queue](#input\_fifo\_build\_queue)| Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners. |`bool`|`false`| no |
Copy file name to clipboardExpand all lines: examples/arm64/README.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ This module shows how to create GitHub action runners using AWS Graviton instanc
4
4
5
5
## Usages
6
6
7
-
Steps for the full setup, such as creating a GitHub app can be found in the root module's [README](../../README.md). First download the Lambda releases from GitHub. Alternatively you can build the lambdas locally with Node or Docker, there is a simple build script in `<root>/.ci/build.sh`. In the `main.tf` you can simply remove the location of the lambda zip files, the default location will work in this case.
7
+
Steps for the full setup, such as creating a GitHub app can be found in the root module's [README](https://github.com/philips-labs/terraform-aws-github-runner). First download the Lambda releases from GitHub. Alternatively you can build the lambdas locally with Node or Docker, there is a simple build script in `<root>/.ci/build.sh`. In the `main.tf` you can simply remove the location of the lambda zip files, the default location will work in this case.
8
8
9
9
> Ensure you have set the version in `lambdas-download/main.tf` for running the example. The version needs to be set to a GitHub release version, see https://github.com/philips-labs/terraform-aws-github-runner/releases
10
10
@@ -15,7 +15,7 @@ terraform apply
15
15
cd ..
16
16
```
17
17
18
-
Before running Terraform, ensure the GitHub app is configured. See the [configuration details](../../README.md#usages) for more details.
18
+
Before running Terraform, ensure the GitHub app is configured. See the [configuration details](https://github.com/philips-labs/terraform-aws-github-runner#usages) for more details.
Copy file name to clipboardExpand all lines: modules/runners/README.md
+1
Original file line number
Diff line number
Diff line change
@@ -130,6 +130,7 @@ yarn run dist
130
130
| <aname="input_enable_runner_binaries_syncer"></a> [enable\_runner\_binaries\_syncer](#input\_enable\_runner\_binaries\_syncer)| Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI. |`bool`|`true`| no |
131
131
| <aname="input_enable_runner_detailed_monitoring"></a> [enable\_runner\_detailed\_monitoring](#input\_enable\_runner\_detailed\_monitoring)| Enable detailed monitoring for runners |`bool`|`false`| no |
132
132
| <aname="input_enable_ssm_on_runners"></a> [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners)| Enable to allow access to the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. |`bool`| n/a | yes |
133
+
| <aname="input_enable_user_data_debug_logging"></a> [enable\_user\_data\_debug\_logging](#input\_enable\_user\_data\_debug\_logging)| Option to enable debug logging for user-data, this logs all secrets as well. |`bool`|`false`| no |
133
134
| <aname="input_enabled_userdata"></a> [enabled\_userdata](#input\_enabled\_userdata)| Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI |`bool`|`true`| no |
134
135
| <aname="input_environment"></a> [environment](#input\_environment)| A name that identifies the environment, used as prefix and for tagging. |`string`|`null`| no |
135
136
| <aname="input_ghes_ssl_verify"></a> [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify)| GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). |`bool`|`true`| no |
0 commit comments