Support Secrets Manager Secrets for the GitHub App secrets

[dgokcin]

We have been testing this module for a while and totally loved it so far. I do not want to commit the encoded github app secrets to my repository so I was wondering if it is a good idea to extend the module with secrets-manager secrets. Thanks!

[npalm]

As long you don't commit your state and set your secrets via as parameter there is no need to commit the GItHub App secrets.

[dgokcin]

As long you don't commit your state and set your secrets via as parameter there is no need to commit the GItHub App secrets.

@npalm I know that not commiting is an option but I want my infrastructure code to follow the best practices and I do not think that not committing something and having people random secrets in their local machines is a good practice.

It would be great if the module gives me the option to use aws secrets manager.

[v-rosa]

@dgokcin could you elaborate your use case a little more?

From the module PoV you just need to pass the secrets via github_app variable.

Is the execution context the developer laptop? Is it an automation? I understand that you want to give possibility to other developers to test this module without have access to the secrets, if so, you would just need to store the secrets in SSM or SecretManager outside this module, set the needed permissions and share the resource arn with your colleagues.

@npalm shouldn't github_app variable be marked as sensitive?

[dgokcin]

@v-rosa thanks for the reply!

The execution context is actually an automation(github actions) and also developer laptops(only for the cloud/devops people). Right now, I need to commit the github_app variable into my repository and than CI/CD takes care of creating it. I want to avoid that and give the arn of the secret manager secret to the github_app variable(using terragrunt dependency block like the vpc dependency). I am sharing my terragrunt config below.

include {
  path = find_in_parent_folders()
}

locals {
  common_vars = yamldecode(file(find_in_parent_folders("common_vars.yaml")))
}

terraform {
  source = "../../..//modules/terraform-aws-github-runner/modules/multi-runner"
}

inputs = {
  aws_region                        = "eu-west-1"
  vpc_id                            = dependency.vpc.outputs.vpc_id
  subnet_ids                        = ["subnet-0af90af0db24f23a7"]
  runners_scale_up_lambda_timeout   = 60
  runners_scale_down_lambda_timeout = 60
  prefix                            = "gh-ci"
  github_app = {
    key_base64     = "secret=="
    id             = "191299"
    webhook_secret = "webhook_secret"
  }
  enable_organization_runners = true

  # Assuming local build lambda's to use pre build ones, uncomment the lines below and download the
  # lambda zip files lambda_download
  webhook_lambda_zip                = "../download-lambda/webhook.zip"
  runner_binaries_syncer_lambda_zip = "../download-lambda/runner-binaries-syncer.zip"
  runners_lambda_zip                = "../download-lambda/runners.zip"

  # enable_workflow_job_events_queue = true
  # override delay of events in seconds

  # log_level = "debug"
  multi_runner_config = {
    "linux-arm64" = {
      matcherConfig : {
        labelMatchers = [["self-hosted", "linux", "arm64", "amazon"]]
        exactMatch    = true
      }
      fifo                = true
      delay_webhook_event = 0
      redrive_build_queue = {
        enabled         = false
        maxReceiveCount = null
      }
      runner_config = {
        runner_os                       = "linux"
        runner_architecture             = "arm64"
        runner_extra_labels             = "amazon"
        enable_ssm_on_runners           = true
        instance_types                  = ["t4g.large", "c6g.large"]
        runners_maximum_count           = 1
        create_service_linked_role_spot = true
        scale_down_schedule_expression  = "cron(* * * * ? *)"
      }
    },
    "linux-ubuntu" = {
      matcherConfig : {
        labelMatchers = [["self-hosted", "linux", "x64", "ubuntu-latest"], ["self-hosted", "linux", "x64", "ubuntu-2204"]]
        exactMatch    = true
      }
      fifo                = true
      delay_webhook_event = 0
      redrive_build_queue = {
        enabled         = false
        maxReceiveCount = null
      }
      runner_config = {
        runner_os                       = "linux"
        runner_architecture             = "x64"
        runner_extra_labels             = "ubuntu-latest,ubuntu-2204"
        runner_run_as                   = "ubuntu"
        enable_ssm_on_runners           = true
        instance_types                  = ["m5n.8xlarge", "m5n.4xlarge", "m5n.2xlarge", "m5n.xlarge", "m5n.large"]
        runners_maximum_count           = 1
        scale_down_schedule_expression  = "cron(* * * * ? *)"
        create_service_linked_role_spot = true
        userdata_template               = "./templates/user-data.sh"
        ami_owners                      = ["099720109477"] # Canonical's Amazon account ID

        ami_filter = {
          name = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
        }
        block_device_mappings = [{
          # Set the block device name for Ubuntu root device
          device_name           = "/dev/sda1"
          delete_on_termination = true
          volume_type           = "gp3"
          volume_size           = 30
          encrypted             = true
          iops                  = null
          throughput            = null
          kms_key_id            = null
          snapshot_id           = null
        }]
        runner_log_files = [
          {
            log_group_name   = "syslog"
            prefix_log_group = true
            file_path        = "/var/log/syslog"
            log_stream_name  = "{instance_id}"
          },
          {
            log_group_name   = "user_data"
            prefix_log_group = true
            file_path        = "/var/log/user-data.log"
            log_stream_name  = "{instance_id}/user_data"
          },
          {
            log_group_name   = "runner"
            prefix_log_group = true
            file_path        = "/opt/actions-runner/_diag/Runner_**.log",
            log_stream_name  = "{instance_id}/runner"
          }
        ]
      }
    },
    "linux-x64" = {
      matcherConfig : {
        labelMatchers = [["self-hosted", "linux", "x64", "amazon"]]
        exactMatch    = false
      }
      fifo                = true
      delay_webhook_event = 0
      runner_config = {
        runner_os                       = "linux"
        runner_architecture             = "x64"
        create_service_linked_role_spot = true
        enable_ssm_on_runners           = true
        instance_types                  = ["m5ad.large", "m5a.large"]
        runner_extra_labels             = "amazon"
        runners_maximum_count           = 1
        enable_ephemeral_runners        = true
        scale_down_schedule_expression  = "cron(* * * * ? *)"
      }
    }
  }

  tags = local.common_vars.tags
}

dependency "vpc" {
  config_path = "../vpc"
}

[v-rosa]

Ok, this is more related to the terragrunt layer than the module. I'm not very familiar with terragrunt, but I would test if this workaround would work for you: gruntwork-io/terragrunt#254 (comment)

• Adding a data resource to get the secretmanager version
  • Export it as output to common_vars
• Use it as the input for the inputs in terragrunt

Another thread related with this: gruntwork-io/terragrunt#1748

This is by design, as it is recommended to track all the input variables in terragrunt and avoid having them injected externally. There are two recommended ways to handle secrets management in terragrunt that work with run-all:

• Use one of the helper functions to retrieve the secrets and feed it to the inputs. Either use sops_decrypt_file or run_cmd for this purpose.

• If your secrets are stored in secrets manager, consider adding logic in the terraform module to take in a secrets manager ARN as input and look it up using a data store.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed if no further activity occurs. Thank you for your contributions.

[jrarmstro]

Ideally, the terraform-aws-github-runner deployment would pull the keys from secrets manager so that they're never stored in tfstate.