Skip to content
This repository was archived by the owner on Jan 16, 2025. It is now read-only.

Commit 4965d06

Browse files
npalmnpalm
authored
Merge pull request #2518 from philips-labs/develop
chore: Release
2 parents 3f9fd74 + cd9b9b1 commit 4965d06

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1316
-1022
lines changed

Diff for: ‎MAINTAINERS.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
Gertjan Maas <gertjan.maas@philips.com>
1+
Navdeep Gupta <navdeep.gupta@philips.com>
22
Niek Palm <[email protected]>
3+
Scott Guymer <[email protected]>

Diff for: ‎README.md

+12-3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ This [Terraform](https://www.terraform.io/) module creates the required infrastr
2626
- [Sub modules](#sub-modules)
2727
- [ARM64 configuration for submodules](#arm64-configuration-for-submodules)
2828
- [Debugging](#debugging)
29+
- [Security Consideration](#security-consideration)
2930
- [Requirements](#requirements)
3031
- [Providers](#providers)
3132
- [Modules](#modules)
@@ -352,6 +353,14 @@ In case the setup does not work as intended follow the trace of events:
352353
- Once an EC2 instance is running, you can connect to it in the EC2 user interface using Session Manager (use `enable_ssm_on_runners = true`). Check the user data script using `cat /var/log/user-data.log`. By default several log files of the instances are streamed to AWS CloudWatch, look for a log group named `<environment>/runners`. In the log group you should see at least the log streams for the user data installation and runner agent.
353354
- Registered instances should show up in the Settings - Actions page of the repository or organization (depending on the installation mode).
354355

356+
## Security Consideration
357+
358+
This module creates resources in your AWS infrastructure, and EC2 instances for hosting the self-hosted runners on-demand. IAM permissions are set to a minimal level, and could be further limit by using permission boundaries. Instances permissions are limit to retrieve and delete the registration token, access the instance own tags, and terminate the instance itself.
359+
360+
The examples are using standard AMI's for different operation systems. Instances are not hardened, and sudo operation are not blocked. To provide an out of the box working expierence by default the module installs and configure the runner. However secrets are not hard coded, they finally end up in the memory of the instances. You can harden the instance by providing your own AMI and overwriting the cloud-init script.
361+
362+
We welcome any improvement to the standard module to make the default as secure as possible, in the end it remains your responsibility to keep your environment secure.
363+
355364
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
356365
## Requirements
357366

@@ -380,7 +389,6 @@ In case the setup does not work as intended follow the trace of events:
380389

381390
| Name | Type |
382391
|------|------|
383-
| [aws_resourcegroups_group.resourcegroups_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/resourcegroups_group) | resource |
384392
| [aws_sqs_queue.queued_builds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
385393
| [aws_sqs_queue.queued_builds_dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
386394
| [aws_sqs_queue_policy.build_queue_dlq_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
@@ -409,6 +417,7 @@ In case the setup does not work as intended follow the trace of events:
409417
| <a name="input_enable_runner_binaries_syncer"></a> [enable\_runner\_binaries\_syncer](#input\_enable\_runner\_binaries\_syncer) | Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI. | `bool` | `true` | no |
410418
| <a name="input_enable_runner_detailed_monitoring"></a> [enable\_runner\_detailed\_monitoring](#input\_enable\_runner\_detailed\_monitoring) | Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details. | `bool` | `false` | no |
411419
| <a name="input_enable_ssm_on_runners"></a> [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners) | Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. | `bool` | `false` | no |
420+
| <a name="input_enable_user_data_debug_logging_runner"></a> [enable\_user\_data\_debug\_logging\_runner](#input\_enable\_user\_data\_debug\_logging\_runner) | Option to enable debug logging for user-data, this logs all secrets as well. | `bool` | `false` | no |
412421
| <a name="input_enabled_userdata"></a> [enabled\_userdata](#input\_enabled\_userdata) | Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI. | `bool` | `true` | no |
413422
| <a name="input_environment"></a> [environment](#input\_environment) | A name that identifies the environment, used as prefix and for tagging. | `string` | `null` | no |
414423
| <a name="input_fifo_build_queue"></a> [fifo\_build\_queue](#input\_fifo\_build\_queue) | Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners. | `bool` | `false` | no |
@@ -451,9 +460,9 @@ In case the setup does not work as intended follow the trace of events:
451460
| <a name="input_runner_allow_prerelease_binaries"></a> [runner\_allow\_prerelease\_binaries](#input\_runner\_allow\_prerelease\_binaries) | (Deprecated, no longer used), allow the runners to update to prerelease binaries. | `bool` | `null` | no |
452461
| <a name="input_runner_architecture"></a> [runner\_architecture](#input\_runner\_architecture) | The platform architecture of the runner instance\_type. | `string` | `"x64"` | no |
453462
| <a name="input_runner_as_root"></a> [runner\_as\_root](#input\_runner\_as\_root) | Run the action runner under the root user. Variable `runner_run_as` will be ignored. | `bool` | `false` | no |
463+
| <a name="input_runner_binaries_s3_logging_bucket"></a> [runner\_binaries\_s3\_logging\_bucket](#input\_runner\_binaries\_s3\_logging\_bucket) | Bucket for action runner distribution bucket access logging. | `string` | `null` | no |
464+
| <a name="input_runner_binaries_s3_logging_bucket_prefix"></a> [runner\_binaries\_s3\_logging\_bucket\_prefix](#input\_runner\_binaries\_s3\_logging\_bucket\_prefix) | Bucket prefix for action runner distribution bucket access logging. | `string` | `null` | no |
454465
| <a name="input_runner_binaries_s3_sse_configuration"></a> [runner\_binaries\_s3\_sse\_configuration](#input\_runner\_binaries\_s3\_sse\_configuration) | Map containing server-side encryption configuration for runner-binaries S3 bucket. | `any` | `{}` | no |
455-
| <a name="input_runner_binaries_s3_logging_bucket"></a> [runner\_binaries\_s3\_logging\_bucket](#input\_runner\_binaries\_s3\_logging\_bucket) | Bucket for action runner distribution bucket access logging. | `string` | `null` | no |
456-
| <a name="input_runner_binaries_s3_logging_bucket_prefix"></a> [runner\_binaries\_s3\_logging\_bucket\_prefix](#input\_runner\_binaries\_s3\logging\_bucket\_prefix) | Bucket prefix for action runner distribution bucket access logging. | `string` | `null` | no |
457466
| <a name="input_runner_binaries_syncer_lambda_timeout"></a> [runner\_binaries\_syncer\_lambda\_timeout](#input\_runner\_binaries\_syncer\_lambda\_timeout) | Time out of the binaries sync lambda in seconds. | `number` | `300` | no |
458467
| <a name="input_runner_binaries_syncer_lambda_zip"></a> [runner\_binaries\_syncer\_lambda\_zip](#input\_runner\_binaries\_syncer\_lambda\_zip) | File location of the binaries sync lambda zip file. | `string` | `null` | no |
459468
| <a name="input_runner_boot_time_in_minutes"></a> [runner\_boot\_time\_in\_minutes](#input\_runner\_boot\_time\_in\_minutes) | The minimum time for an EC2 runner to boot and register as a runner. | `number` | `5` | no |

Diff for: ‎examples/base/main.tf

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "aws_resourcegroups_group" "resourcegroups_group" {
2+
name = "${var.prefix}-group"
3+
resource_query {
4+
query = templatefile("${path.module}/templates/resource-group.json", {
5+
example = var.prefix
6+
})
7+
}
8+
}

Diff for: ‎examples/base/outputs.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "vpc" {
2+
value = module.vpc
3+
}

Diff for: ‎templates/resource-group.json renamed to ‎examples/base/templates/resource-group.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
"ResourceTypeFilters": ["AWS::AllSupported"],
33
"TagFilters": [
44
{
5-
"Key": "Environment",
6-
"Values": ["${environment}"]
5+
"Key": "Example",
6+
"Values": ["${example}"]
77
}
88
]
99
}

Diff for: ‎examples/base/variables.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "prefix" {
2+
description = "Prefix used for resource naming."
3+
type = string
4+
}
5+
6+
variable "aws_region" {
7+
description = "AWS region to create the VPC, assuming zones `a` and `b` exists."
8+
type = string
9+
}

Diff for: ‎examples/base/vpc.tf

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
module "vpc" {
2+
source = "terraform-aws-modules/vpc/aws"
3+
version = "3.16.0"
4+
5+
name = "${var.prefix}-vpc"
6+
cidr = "10.0.0.0/16"
7+
8+
azs = ["${var.aws_region}a", "${var.aws_region}b"]
9+
private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
10+
public_subnets = ["10.0.101.0/24", "10.0.102.0/24"]
11+
12+
enable_dns_hostnames = true
13+
enable_nat_gateway = true
14+
map_public_ip_on_launch = false
15+
single_nat_gateway = true
16+
}

Diff for: ‎examples/default/main.tf

+7-5
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,19 @@ resource "random_id" "random" {
77
byte_length = 20
88
}
99

10+
module "base" {
11+
source = "../base"
1012

11-
################################################################################
12-
### Hybrid account
13-
################################################################################
13+
prefix = local.environment
14+
aws_region = local.aws_region
15+
}
1416

1517
module "runners" {
1618
source = "../../"
1719
create_service_linked_role_spot = true
1820
aws_region = local.aws_region
19-
vpc_id = module.vpc.vpc_id
20-
subnet_ids = module.vpc.private_subnets
21+
vpc_id = module.base.vpc.vpc_id
22+
subnet_ids = module.base.vpc.private_subnets
2123

2224
prefix = local.environment
2325
tags = {

Diff for: ‎examples/default/providers.tf

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
11
provider "aws" {
22
region = local.aws_region
3+
4+
default_tags {
5+
tags = {
6+
Example = local.environment
7+
}
8+
}
39
}

Diff for: ‎examples/default/vpc.tf

-21
This file was deleted.

Diff for: ‎examples/ephemeral/main.tf

+10-2
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,20 @@ resource "random_id" "random" {
99

1010
data "aws_caller_identity" "current" {}
1111

12+
13+
module "base" {
14+
source = "../base"
15+
16+
prefix = local.environment
17+
aws_region = local.aws_region
18+
}
19+
1220
module "runners" {
1321
source = "../../"
1422
create_service_linked_role_spot = true
1523
aws_region = local.aws_region
16-
vpc_id = module.vpc.vpc_id
17-
subnet_ids = module.vpc.private_subnets
24+
vpc_id = module.base.vpc.vpc_id
25+
subnet_ids = module.base.vpc.private_subnets
1826

1927
prefix = local.environment
2028
tags = {

Diff for: ‎examples/ephemeral/providers.tf

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
provider "aws" {
22
region = local.aws_region
3+
default_tags {
4+
tags = {
5+
Example = local.environment
6+
}
7+
}
38
}

Diff for: ‎examples/ephemeral/vpc.tf

-21
This file was deleted.

Diff for: ‎examples/prebuilt/main.tf

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
environment = "prebuilt"
3+
aws_region = "eu-west-1"
34
}
45

56
resource "random_id" "random" {
@@ -8,12 +9,19 @@ resource "random_id" "random" {
89

910
data "aws_caller_identity" "current" {}
1011

12+
module "base" {
13+
source = "../base"
14+
15+
prefix = local.environment
16+
aws_region = local.aws_region
17+
}
18+
1119
module "runners" {
1220
source = "../../"
1321
create_service_linked_role_spot = true
14-
aws_region = var.aws_region
15-
vpc_id = module.vpc.vpc_id
16-
subnet_ids = module.vpc.private_subnets
22+
aws_region = local.aws_region
23+
vpc_id = module.base.vpc.vpc_id
24+
subnet_ids = module.base.vpc.private_subnets
1725

1826
prefix = local.environment
1927
enable_organization_runners = false

Diff for: ‎examples/prebuilt/providers.tf

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
provider "aws" {
2-
region = var.aws_region
2+
region = local.aws_region
3+
default_tags {
4+
tags = {
5+
Example = local.environment
6+
}
7+
}
38
}

Diff for: ‎examples/prebuilt/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,3 @@ variable "ami_name_filter" {
1212
type = string
1313
default = "github-runner-amzn2-x86_64-*"
1414
}
15-
16-
variable "aws_region" {
17-
type = string
18-
default = "eu-west-1"
19-
}

Diff for: ‎examples/prebuilt/vpc.tf

-21
This file was deleted.

Diff for: ‎examples/ubuntu/main.tf

+13-3
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,20 @@ resource "random_id" "random" {
99

1010
data "aws_caller_identity" "current" {}
1111

12+
13+
module "base" {
14+
source = "../base"
15+
16+
prefix = local.environment
17+
aws_region = local.aws_region
18+
}
19+
1220
module "runners" {
1321
source = "../../"
1422

1523
aws_region = local.aws_region
16-
vpc_id = module.vpc.vpc_id
17-
subnet_ids = module.vpc.private_subnets
24+
vpc_id = module.base.vpc.vpc_id
25+
subnet_ids = module.base.vpc.private_subnets
1826

1927
prefix = local.environment
2028
tags = {
@@ -32,7 +40,7 @@ module "runners" {
3240
# runners_lambda_zip = "lambdas-download/runners.zip"
3341

3442
enable_organization_runners = false
35-
runner_extra_labels = "ubuntu,example"
43+
runner_extra_labels = "default,example"
3644

3745
# enable access to the runners via SSM
3846
enable_ssm_on_runners = true
@@ -102,4 +110,6 @@ module "runners" {
102110
# idleCount = 1
103111
# }]
104112

113+
# Enable logging all commands of user_data, secrets will be logged!!!
114+
# enable_user_data_debug_logging_runner = true
105115
}

Diff for: ‎examples/ubuntu/providers.tf

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
provider "aws" {
22
region = local.aws_region
3-
3+
default_tags {
4+
tags = {
5+
Example = local.environment
6+
}
7+
}
48
// If you use roles with specific permissions please add your role
59
// assume_role {
610
// role_arn = "arn:aws:iam::123456789012:role/MyAdminRole"

Diff for: ‎examples/ubuntu/templates/user-data.sh

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
1-
#!/bin/bash -x
1+
#!/bin/bash
22
exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1
33

4+
5+
# AWS suggest to create a log for debug purpose based on https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-log-user-data/
6+
# As side effect all command, set +x disable debugging explicitly.
7+
#
8+
# An alternative for masking tokens could be: exec > >(sed 's/--token\ [^ ]* /--token\ *** /g' > /var/log/user-data.log) 2>&1
9+
set +x
10+
11+
%{ if enable_debug_logging }
12+
set -x
13+
%{ endif }
14+
415
${pre_install}
516

617
# Install AWS CLI

Diff for: ‎examples/windows/main.tf

+9-2
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,19 @@ resource "random_id" "random" {
77
byte_length = 20
88
}
99

10+
module "base" {
11+
source = "../base"
12+
13+
prefix = local.environment
14+
aws_region = local.aws_region
15+
}
16+
1017
module "runners" {
1118
source = "../../"
1219

1320
aws_region = local.aws_region
14-
vpc_id = module.vpc.vpc_id
15-
subnet_ids = module.vpc.private_subnets
21+
vpc_id = module.base.vpc.vpc_id
22+
subnet_ids = module.base.vpc.private_subnets
1623
prefix = local.environment
1724

1825
github_app = {

Diff for: ‎examples/windows/providers.tf

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
provider "aws" {
22
region = local.aws_region
3+
default_tags {
4+
tags = {
5+
Example = local.environment
6+
}
7+
}
38
}

0 commit comments

Comments
 (0)