feat: Restrict instance SSM permissions #3918
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* fix: Restrict instance SSM permissions Previously, EC2 instances could read other instances' tokens (jitconfig for ephemeral runners and tokens for non-ephemeral runners) from SSM parameters. Add an IAM condition to restrict GetParameter access to only instances with ec2:SourceInstanceARN matching an "InstanceId" resource tag on the SSM parameter. Update the control-plane Lambda to add the resource tag containing the instanceId during parameter creation. Unit tests are updated to check for the created resource tag. * add missing permissions, escapes and formatting --------- Co-authored-by: Niek Palm <npalm@users.noreply.github.com> Co-authored-by: Niek Palm <niek.palm@philips.com>
koendelaat
approved these changes
May 22, 2024
npalm
pushed a commit
that referenced
this pull request
May 22, 2024
🤖 I have created a release *beep* *boop* --- ## [5.11.0](v5.10.4...v5.11.0) (2024-05-22) ### Features * add variable to configure ebs optimization for runner instances ([#3901](#3901)) ([479b779](479b779)) @AlexShemeshWix * Restrict instance SSM permissions ([#3918](#3918)) ([9399cf2](9399cf2)) @bburky ### Bug Fixes * adding missing permissions to boundaries ([#3873](#3873)) ([93e8d27](93e8d27)) @gnawhleinad * **lambda:** bump the aws group across 1 directory with 6 updates ([#3907](#3907)) ([50dda9a](50dda9a)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: forest-releaser[bot] <80285352+forest-releaser[bot]@users.noreply.github.com> Co-authored-by: forest-pr|bot <forest-pr[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Restrict instance SSM permissions
Previously, EC2 instances could read other instances' tokens (via path .../tokens/...) from SSM parameters. This PR restricts access to only read / delete tokens owned by the instances