From 94779f8aa217edfebfba57da73a246f7497dc793 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kir=C3=A1ly=20=C3=81d=C3=A1m?= Date: Thu, 17 Feb 2022 09:43:57 +0100 Subject: [PATCH] feat(runner): Ability to disable default runner security group creation (#1718) * Implement optional disable for the managed security group creation. * Create security group disablement variable. * Fix launch template creation issue. * Fix formatting error. --- README.md | 1 + main.tf | 1 + modules/runners/README.md | 1 + modules/runners/main.tf | 3 ++- modules/runners/variables.tf | 6 ++++++ variables.tf | 6 ++++++ 6 files changed, 17 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 0bd51f6135..54d9d9257b 100644 --- a/README.md +++ b/README.md @@ -402,6 +402,7 @@ In case the setup does not work as intended follow the trace of events: | [delay\_webhook\_event](#input\_delay\_webhook\_event) | The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event. | `number` | `30` | no | | [enable\_cloudwatch\_agent](#input\_enable\_cloudwatch\_agent) | Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`. | `bool` | `true` | no | | [enable\_ephemeral\_runners](#input\_enable\_ephemeral\_runners) | Enable ephemeral runners, runners will only be used once. | `bool` | `false` | no | +| [enable\_managed\_runner\_security\_group](#inputenable\_managed\_runner\_security\_group) | Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`. | `bool` | `true` | no | | [enable\_organization\_runners](#input\_enable\_organization\_runners) | Register runners to organization, instead of repo level | `bool` | `false` | no | | [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners) | Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. | `bool` | `false` | no | | [enabled\_userdata](#input\_enabled\_userdata) | Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI | `bool` | `true` | no | diff --git a/main.tf b/main.tf index 292671811c..c71d73aa79 100644 --- a/main.tf +++ b/main.tf @@ -107,6 +107,7 @@ module "runners" { github_app_parameters = local.github_app_parameters enable_organization_runners = var.enable_organization_runners enable_ephemeral_runners = var.enable_ephemeral_runners + enable_managed_runner_security_group = var.enable_managed_runner_security_group scale_down_schedule_expression = var.scale_down_schedule_expression minimum_running_time_in_minutes = var.minimum_running_time_in_minutes runner_boot_time_in_minutes = var.runner_boot_time_in_minutes diff --git a/modules/runners/README.md b/modules/runners/README.md index 1cbbed6254..9150f51c6d 100644 --- a/modules/runners/README.md +++ b/modules/runners/README.md @@ -122,6 +122,7 @@ yarn run dist | [egress\_rules](#input\_egress\_rules) | List of egress rules for the GitHub runner instances. | 
list(object({
    cidr_blocks      = list(string)
    ipv6_cidr_blocks = list(string)
    prefix_list_ids  = list(string)
    from_port        = number
    protocol         = string
    security_groups  = list(string)
    self             = bool
    to_port          = number
    description      = string
  }))
| 
[
  {
    "cidr_blocks": [
      "0.0.0.0/0"
    ],
    "description": null,
    "from_port": 0,
    "ipv6_cidr_blocks": [
      "::/0"
    ],
    "prefix_list_ids": null,
    "protocol": "-1",
    "security_groups": null,
    "self": null,
    "to_port": 0
  }
]
| no | | [enable\_cloudwatch\_agent](#input\_enable\_cloudwatch\_agent) | Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`. | `bool` | `true` | no | | [enable\_ephemeral\_runners](#input\_enable\_ephemeral\_runners) | Enable ephemeral runners, runners will only be used once. | `bool` | `false` | no | +| [enable\_managed\_runner\_security\_group](#inputenable\_managed\_runner\_security\_group) | Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`. | `bool` | `true` | no | | [enable\_organization\_runners](#input\_enable\_organization\_runners) | n/a | `bool` | n/a | yes | | [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners) | Enable to allow access to the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. | `bool` | n/a | yes | | [enabled\_userdata](#input\_enabled\_userdata) | Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI | `bool` | `true` | no | diff --git a/modules/runners/main.tf b/modules/runners/main.tf index a5a61863b5..60826522b6 100644 --- a/modules/runners/main.tf +++ b/modules/runners/main.tf @@ -88,7 +88,7 @@ resource "aws_launch_template" "runner" { key_name = var.key_name vpc_security_group_ids = compact(concat( - [aws_security_group.runner_sg.id], + var.enable_managed_runner_security_group ? [aws_security_group.runner_sg[0].id] : [], var.runner_additional_security_group_ids, )) @@ -136,6 +136,7 @@ resource "aws_launch_template" "runner" { } resource "aws_security_group" "runner_sg" { + count = var.enable_managed_runner_security_group ? 1 : 0 name_prefix = "${var.environment}-github-actions-runner-sg" description = "Github Actions Runner security group" diff --git a/modules/runners/variables.tf b/modules/runners/variables.tf index 02515b519c..1a4802a44d 100644 --- a/modules/runners/variables.tf +++ b/modules/runners/variables.tf @@ -318,6 +318,12 @@ variable "enable_cloudwatch_agent" { default = true } +variable "enable_managed_runner_security_group" { + description = "Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`." + type = bool + default = true +} + variable "cloudwatch_config" { description = "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details." type = string diff --git a/variables.tf b/variables.tf index 33c1becea4..a6e635fe08 100644 --- a/variables.tf +++ b/variables.tf @@ -501,6 +501,12 @@ variable "enable_ephemeral_runners" { default = false } +variable "enable_managed_runner_security_group" { + description = "Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`." + type = bool + default = true +} + variable "runner_os" { description = "The EC2 Operating System type to use for action runner instances (linux,windows)." type = string