feat(runner): Ability to disable default runner security group creation #1718

krlydm · 2022-02-10T12:43:42Z

Closes: #1717

It can restricted who has access to create/modify VPCs or Security groups in AWS, so implicit security group creating in runner modul can be a problem in these cases. Removing VPC creation is easy, but there is no option to do it for the default security group. This change adds option to disable the security group creation of the runner module.

npalm

@krlydm Tested and is not working due to dependency of the security group.

modules/runners/main.tf

npalm · 2022-02-11T21:52:08Z

@krlydm can you rebase with the develop branch, I hope that will fix the build failures

krlydm · 2022-02-14T08:01:32Z

@krlydm can you rebase with the develop branch, I hope that will fix the build failures

@npalm Rebased.

krlydm · 2022-02-15T09:57:40Z

@npalm Is there anything that I need to do to resolve the change request?

npalm · 2022-02-15T15:30:05Z

@krlydm no I only need a bit of time. WIll do my best to merge asap. Thx!

npalm

@krlydm LGTM, thanks!

## [0.35.0](v0.34.2...v0.35.0) (2022-02-18) ### Features * Parameterise delete_on_termination ([#1758](#1758)) ([6282351](6282351)), closes [#1745](#1745) * **runner:** Ability to disable default runner security group creation ([#1718](#1718)) ([94779f8](94779f8))

* chore(release): 0.17.0 [skip ci] * Adding support for new workflow_job event. ([#1019](#1019)) ([a74e10b](a74e10b)) * chore(release): 0.18.0 [skip ci] * add format checking for lambdas in CI ([#899](#899)) ([#1080](#1080)) ([ae9c277](ae9c277)) * add option to overwrite / disable egress [#748](#748) ([#1112](#1112)) ([9c2548d](9c2548d)) * replace depcrated 'request' dependency by 'node-fetch' ([#903](#903)) ([#1082](#1082)) ([fb51756](fb51756)) * chore(release): 0.18.1 [skip ci] * webhook labels for `workflow_job` ([#1133](#1133)) ([4b39fb9](4b39fb9)) * chore(release): 0.19.0 [skip ci] * **scale-down:** Update Owner Logic ([#1065](#1065)) ([ba2536b](ba2536b)), closes [#2](#2) * explicit set region for downloading runner distribution from S3 ([#1204](#1204)) ([439fb1b](439fb1b)) * upgrade jest ([#1219](#1219)) ([c8b8139](c8b8139)) * use dynamic block to ignore null market opts ([#1202](#1202)) ([df9bd78](df9bd78)) * use dynamic block to ignore null market opts ([#1202](#1202)) ([06a5598](06a5598)) * **logging:** Additional Logging ([#1135](#1135)) ([f7f194d](f7f194d)) * **scale-down:** Clearing cache between runs ([#1164](#1164)) ([e72227b](e72227b)) * chore(release): 0.19.1 [skip ci] * `instance_types` from a Set to a List, so instance order preference is preserved ([#1154](#1154)) ([150d227](150d227)) * chore(release): 0.20.0 [skip ci] * Add option to disable SSL verification support for GitHub Enterprise Server ([#1216](#1216)) ([3c3ef19](3c3ef19)), closes [#1207](#1207) * chore(release): 0.20.1 [skip ci] * Upgrade lambda runtime to node 14.x ([#1203](#1203)) ([570949a](570949a)) * **webhook:** remove node fetch ([ca14ac5](ca14ac5)) * **webhook:** replace node-fetch by axios [#1247](#1247) ([80fff4b](80fff4b)) * added more detailed logging for scaling up and down ([#1222](#1222)) ([9aa7456](9aa7456)) * chore(release): 0.21.0 [skip ci] * Ignore github managed labels and add check disable option ([#1244](#1244)) ([859fa38](859fa38)) * remove unused app client since SSH key is used to secure app authorization ([#1223](#1223)) ([4cb5cf1](4cb5cf1)) * upgrade Terraform version of module 1.0.x ([#1254](#1254)) ([2a817dc](2a817dc)) * chore(release): 0.21.1 [skip ci] * **logging:** Adjusting scale logging messages and levels ([#1286](#1286)) ([665e1a6](665e1a6)) * **logging:** Adjusting webhook logs and levels ([#1287](#1287)) ([9df5fb8](9df5fb8)) * Update launch template to use metadata service v2 ([#1278](#1278)) ([ef16287](ef16287)) * chore(release): 0.22.0 [skip ci] * adding message retention seconds ([#1354](#1354)) ([a19929f](a19929f)) * adding var for tags for ec2s ([#1357](#1357)) ([31cf02d](31cf02d)) * add validation to distribution_bucket_name variable ([#1356](#1356)) ([6522317](6522317)) * chore(release): 0.23.0 [skip ci] * add option to format logging in JSON for lambdas ([#1228](#1228)) ([a250b96](a250b96)) * add option to specify SSE config for dist bucket ([#1324](#1324)) ([ae84302](ae84302)) * reducing verbosity of role and profile ([#1358](#1358)) ([922ef99](922ef99)) * chore(release): 0.23.1 [skip ci] * configurable metadata options for runners ([#1377](#1377)) ([f37df23](f37df23)) * chore(release): 0.24.0 [skip ci] * support single line for app private key ([#1368](#1368)) ([14183ac](14183ac)) * update return codes, no error code for job that are ignored ([#1381](#1381)) ([f9f705f](f9f705f)) * chore(release): 0.25.0 [skip ci] * Add option to configure concurrent running scale up lambda ([#1415](#1415)) ([23ee630](23ee630)) * clean up non used variables in examples ([#1416](#1416)) ([fe65a5f](fe65a5f)) * chore(release): 0.25.1 [skip ci] * Add required providers to module ssm ([#1423](#1423)) ([5b68b7b](5b68b7b)) * chore(release): 0.25.2 [skip ci] * add logging context to runner lambda ([#1399](#1399)) ([0ba0930](0ba0930)) * **logging:** Add context to webhook logs ([#1401](#1401)) ([8094576](8094576)) * chore(release): 0.26.0 [skip ci] * Add hooks for prebuilt images (AMI), including amazon linux packer example ([#1444](#1444)) ([060daac](060daac)) * add runners binaries bucket as terraform output ([5809fee](5809fee)) * chore(release): 0.26.1 [skip ci] * Download lambda ([#1480](#1480)) ([f1b99d9](f1b99d9)) * **syncer:** Add tests, coverage report, and refactor lambda / naming ([#1478](#1478)) ([8266442](8266442)) * install_config_runner -> install_runner ([#1479](#1479)) ([de5b93f](de5b93f)) * chore(release): 0.27.0 [skip ci] * add windows support ([#1476](#1476)) ([dbba705](dbba705)) * chore(release): 0.27.1 [skip ci] * add --preserve-env to start-runner.sh to enable RUNNER_ALLOW_RUNASROOT ([#1537](#1537)) ([1cd9cd3](1cd9cd3)) * remove export from install script. ([#1538](#1538)) ([d32ca1b](d32ca1b)) * chore(release): 0.27.2 [skip ci] * Dowload lambda see [#1541](#1541) for details. ([#1542](#1542)) ([7cb73c8](7cb73c8)) * chore(release): 0.28.0 [skip ci] * add option ephemeral runners ([#1374](#1374)) ([2f323d6](2f323d6)), closes [#1399](#1399) [#1444](#1444) * Change default location of runner to `/opt` and fix Ubuntu example ([#1572](#1572)) ([77f350b](77f350b)) * Replace run instance API by create fleet API ([#1556](#1556)) ([27e974d](27e974d)) * Support t4g Graviton instance type ([#1561](#1561)) ([3fa5896](3fa5896)) * Add config for windows ami ([#1525](#1525)) ([7907984](7907984)) * chore(release): 0.29.0 [skip ci] * Strict label check and replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check ([#1591](#1591)) ([405b11d](405b11d)) * chore(release): 0.30.0 [skip ci] * Add scheduled / pull based scaling for org level runners ([#1577](#1577)) ([8197432](8197432)) * chore(release): 0.30.1 [skip ci] * **runnrs:** Pool runners to allow multiple pool_config objects ([#1621](#1621)) ([c9c7c69](c9c7c69)) * chore(release): 0.31.0 [skip ci] * **packer:** add vars and minor clean up ([#1611](#1611)) ([1c897a4](1c897a4)) * **webhook:** depcrated warning on ts-jest mocked ([#1615](#1615)) ([56c1ece](56c1ece)) * chore(release): 0.32.0 [skip ci] * **runner:** Replace patch by install ICU package for ARM runners ([#1624](#1624)) ([74cfa51](74cfa51)) * **images:** use new runner install location ([#1628](#1628)) ([36c1bf5](36c1bf5)) * **packer:** Add missing RUNNER_ARCHITECTURE for amazn-linux2 ([#1647](#1647)) ([ec497a2](ec497a2)) * chore(release): 0.33.0 [skip ci] * **images:** Added ubuntu-focual example packer configuration ([#1644](#1644)) ([997b171](997b171)) * **examples:** Update AMI filter ([#1673](#1673)) ([39c019c](39c019c)) * chore(release): 0.34.0 [skip ci] * Add output image id used in launch template ([#1676](#1676)) ([a49fab4](a49fab4)) * chore(release): 0.34.1 [skip ci] * **syncer:** Fix for windows binaries in action runner syncer ([#1716](#1716)) ([63e0e27](63e0e27)) * chore(release): 0.34.2 [skip ci] * Limit AWS Terraform Provider to 3.* ([#1741](#1741)) ([0cf2b5d](0cf2b5d)) * **runner:** Cannot disable cloudwatch agent ([#1738](#1738)) ([0f798ca](0f798ca)) * chore(release): 0.35.0 [skip ci] * Parameterise delete_on_termination ([#1758](#1758)) ([6282351](6282351)), closes [#1745](#1745) * **runner:** Ability to disable default runner security group creation ([#1718](#1718)) ([94779f8](94779f8)) * chore(release): 0.36.0 [skip ci] * **runner:** Add option to disable auto update ([#1791](#1791)) ([c2a834f](c2a834f)) * chore(release): 0.37.0 [skip ci] * Add associate_public_ip_address variable to windows AMI too ([#1819](#1819)) ([0b8e1fc](0b8e1fc)), closes [/github.com//pull/1816#issuecomment-1060650668](https://github.com/philips-labs//github.com/philips-labs/terraform-aws-github-runner/pull/1816/issues/issuecomment-1060650668) * Add associate_public_ip_address variable ([#1816](#1816)) ([052e9f8](052e9f8)) * Add option for KMS encryption for cloudwatch log groups ([#1833](#1833)) ([3f1a67f](3f1a67f)) * Add SQS queue resource policy to improve security ([#1798](#1798)) ([96def9a](96def9a)) * Add Support for Alternative Partitions in ARNs (like govcloud) ([#1815](#1815)) ([0ba06c8](0ba06c8)) * Add variable to specify custom commands while building the AMI ([#1838](#1838)) ([8f9c342](8f9c342)) * Autoupdate should be disabled by default ([#1797](#1797)) ([828bed6](828bed6)) * Create SQS DLQ policy only if DLQ is created ([#1839](#1839)) ([c88a005](c88a005)) * Upgrade Amazon base AMI to Amazon Linux 2 kernel 5x ([#1812](#1812)) ([9aa5532](9aa5532)) * chore(release): 0.38.0 [skip ci] * Add option for ephemeral to check builds status before scaling ([#1854](#1854)) ([7eb0bda](7eb0bda)) * Retention days was used instead of kms key id for pool ([#1855](#1855)) ([aa29d93](aa29d93)) * chore(release): 0.39.0 [skip ci] * Add possibility to create multiple ebs ([#1845](#1845)) ([7a2ca0d](7a2ca0d)) * Don't delete busy runners ([#1832](#1832)) ([0e9b083](0e9b083)) * chore(release): 0.40.0 [skip ci] * Support multi runner process support for runner scale down. ([#1859](#1859)) ([3658d6a](3658d6a)) * Set the minimal AWS provider to 3.50 ([#1937](#1937)) ([16095d8](16095d8)) * chore(release): 0.40.1 [skip ci] * Avoid non semantic commontes can be merged. ([#1969](#1969)) ([ad1c872](ad1c872)) * chore(release): 0.40.2 [skip ci] * Outputs for pool need to account for complexity ([#1970](#1970)) ([2d92906](2d92906)) * chore(release): 0.40.3 [skip ci] * Volume size is ingored ([#2014](#2014)) ([b733248](b733248)), closes [#1954](#1954) * chore(release): 0.40.4 [skip ci] * Wrong block device mapping ([#2019](#2019)) ([c42a467](c42a467)) * chore(release): 1.0.0 [skip ci] * var.volume_size replaced by var.block_device_mappings * The module is upgraded to AWS Terraform provider 4.x * Improve syncer s3 kms encryption ([38ed5be](38ed5be)) * Remove var.volume_size in favour of var.block_device_mappings ([4e97048](4e97048)) * Support AWS 4.x Terraform provider ([#1739](#1739)) ([cfb6da2](cfb6da2)) * Wrong block device mapping ([#2019](#2019)) ([185ef20](185ef20)) * chore(release): 1.1.0 [skip ci] * Add option to enable detailed monitoring for runner launch template ([#2024](#2024)) ([e73a267](e73a267)) * chore(release): 1.1.1 [skip ci] * **runner:** Don't treat the string "false" as true. ([#2051](#2051)) ([b67c7dc](b67c7dc)) * chore(release): 1.2.0 [skip ci] * Replace environment variable by prefix ([#1858](#1858)) ([e2f9a27](e2f9a27)) * docs: fix hyperlinks in the Terraform Registry documentation (#2085) This makes the hyperlink correct in the Terraform Registry documentation * chore(release): 1.3.0 [skip ci] * Support arm64 lambda functions ([#2121](#2121)) ([9e2a7b6](9e2a7b6)) * Support Node16 for AWS Lambda ([#2073](#2073)) ([68a2014](68a2014)) * replaced old environment variable ([#2146](#2146)) ([f2072f7](f2072f7)) * set explicit permissions on s3 for syncer lambda ([#2145](#2145)) ([aa7edd1](aa7edd1)) * set kms key on aws_s3_object when encryption is enabled ([#2147](#2147)) ([b4dc706](b4dc706)) * chore(release): 1.4.0 [skip ci] * Add option to match some of the labes instead of all [#2122](#2122) ([#2123](#2123)) ([c5e3c21](c5e3c21)) * don't apply extra labels unless defined ([#2181](#2181)) ([c0b11bb](c0b11bb)) * Remove asterik in permission for runner lambda to describe instances ([9b9da03](9b9da03)) * chore(release): 1.4.1 [skip ci] * added server_side_encryption key to download trigger for distribution ([#2207](#2207)) ([404e3b6](404e3b6)) * chore(release): 1.5.0 [skip ci] * Add ubuntu-jammy example image based on existing ubuntu-focal ([#2102](#2102)) ([486ae91](486ae91)) * **images:** avoid wrong AMI could be selected for ubuntu focal ([#2214](#2214)) ([76be94b](76be94b)) * chore(release): 1.6.0 [skip ci] * Add options extra option to ebs block device mapping ([#2052](#2052)) ([7cd2524](7cd2524)) * Enable node16 default ([#2074](#2074)) ([58aa5ed](58aa5ed)) * Incorrect path of Runner logs ([#2233](#2233)) ([98eff98](98eff98)) * Preventing that lambda webhook fails when it tries to process an installation_repositories event ([#2288](#2288)) ([8656c83](8656c83)) * Update ubuntu example to fix /opt/hostedtoolcache ([#2302](#2302)) ([8eea748](8eea748)) * Webhook lambda misleading log ([#2291](#2291)) ([c6275f9](c6275f9)) * chore(release): 1.7.0 [skip ci] * Webhook accept jobs where not all labels are provided in job. ([#2209](#2209)) ([6d9116f](6d9116f)) * Ignore case for runner labels. ([#2315](#2315)) ([014985a](014985a)) * chore(release): 1.8.0 [skip ci] * Add option to disable lambda to sync runner binaries ([#2314](#2314)) ([9f7d32d](9f7d32d)) * **examples:** Upgrading ubuntu example to 22.04 ([#2250](#2250)) ([d4b7650](d4b7650)), closes [#2103](#2103) * chore(release): 1.8.1 [skip ci] * **runners:** Pass allocation strategy ([#2345](#2345)) ([68d3445](68d3445)) * chore(release): 1.9.0 [skip ci] * Add option to enable access log for API gateway ([#2387](#2387)) ([fcd9fba](fcd9fba)) * add s3_location_runner_distribution var as expandable for userdata ([#2371](#2371)) ([05fe737](05fe737)) * Encrypted data at REST on SQS by default ([#2431](#2431)) ([7f3f4bf](7f3f4bf)) * **images:** Allow passing instance type when building windows image ([#2369](#2369)) ([eca23bf](eca23bf)) * **runners:** Fetch instance environment tag though metadata ([#2346](#2346)) ([27db290](27db290)) * **runners:** Set the default Windows AMI to Server 2022 ([#2325](#2325)) ([78e99d1](78e99d1)) * chore(release): 1.9.1 [skip ci] * **webhook:** Use `x-hub-signature-256` header as default ([#2434](#2434)) ([9c3e495](9c3e495)) * chore(release): 1.10.0 [skip ci] * Download runner release via latest release API ([#2455](#2455)) ([e75e092](e75e092)) * fix: Execute runner in own process, mask token in logs * Add option to disable user_data logging * Enforcing debug is disabled, and introduce option to enable debug logging. * add section related to security considerations * add section related to security considerations Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net> Co-authored-by: Derek Crosson <derekcrosson18@gmail.com>

## [1.12.0](v1.11.0...v1.12.0) (2022-10-12) ### Features * Added the AMI to machine setup info to runner workflows. ([#2451](#2451)) ([e197cbd](e197cbd)) * **images:** add ami for windows core 2022 ([#2390](#2390)) ([97707c2](97707c2)) * Log workflow id in webhook ([#2511](#2511)) ([204acf1](204acf1)) * Security improvements, add option to disable userdata logging ([9a9e2ee](9a9e2ee)), closes [#1019](#1019) [#899](#899) [#1080](#1080) [#748](#748) [#1112](#1112) [#903](#903) [#1082](#1082) [#1133](#1133) [#2](#2) [#1204](#1204) [#1219](#1219) [#1202](#1202) [#1202](#1202) [#1135](#1135) [#1164](#1164) [#1154](#1154) [#1207](#1207) [#1203](#1203) [#1247](#1247) [#1222](#1222) [#1244](#1244) [#1223](#1223) [#1254](#1254) [#1286](#1286) [#1287](#1287) [#1278](#1278) [#1354](#1354) [#1357](#1357) [#1356](#1356) [#1228](#1228) [#1324](#1324) [#1358](#1358) [#1377](#1377) [#1368](#1368) [#1381](#1381) [#1415](#1415) [#1416](#1416) [#1423](#1423) [#1399](#1399) [#1401](#1401) [#1444](#1444) [#1480](#1480) [#1478](#1478) [#1479](#1479) [#1476](#1476) [#1537](#1537) [#1538](#1538) [#1541](#1541) [#1542](#1542) [#1399](#1399) [#1444](#1444) [#1572](#1572) [#1556](#1556) [#1561](#1561) [#1525](#1525) [#1591](#1591) [#1577](#1577) [#1621](#1621) [#1611](#1611) [#1615](#1615) [#1624](#1624) [#1628](#1628) [#1647](#1647) [#1644](#1644) [#1673](#1673) [#1676](#1676) [#1716](#1716) [#1741](#1741) [#1738](#1738) [#1745](#1745) [#1718](#1718) [#1791](#1791) [github.com//pull/1816#issuecomment-1060650668](https://github.com/philips-labs/github.com/philips-labs/terraform-aws-github-runner/pull/1816/issues/issuecomment-1060650668) [#1816](#1816) [#1833](#1833) [#1798](#1798) [#1815](#1815) [#1838](#1838) [#1797](#1797) [#1839](#1839) [#1812](#1812) [#1854](#1854) [#1855](#1855) [#1845](#1845) [#1832](#1832) [#1859](#1859) [#1937](#1937) [#1969](#1969) [#1970](#1970) [#1954](#1954) [#2019](#2019) [#1739](#1739) [#2019](#2019) [#2024](#2024) [#2051](#2051) [#1858](#1858) [#2085](#2085) [#2121](#2121) [#2073](#2073) [#2146](#2146) [#2145](#2145) [#2147](#2147) [#2122](#2122) [#2123](#2123) [#2181](#2181) [#2207](#2207) [#2102](#2102) [#2214](#2214) [#2052](#2052) [#2074](#2074) [#2233](#2233) [#2288](#2288) [#2302](#2302) [#2291](#2291) [#2209](#2209) [#2315](#2315) [#2314](#2314) [#2103](#2103) [#2345](#2345) [#2387](#2387) [#2371](#2371) [#2431](#2431) [#2369](#2369) [#2346](#2346) [#2325](#2325) [#2434](#2434) [#2455](#2455) ### Bug Fixes * Remove resource group from module ([#2512](#2512)) ([2628352](2628352))

krlydm added 2 commits February 10, 2022 13:23

Implement optional disable for the managed security group creation.

57ab88a

Create security group disablement variable.

825efb2

krlydm changed the title ~~Ability to disable default security group creation step~~ Ability to disable default security group creation Feb 10, 2022

krlydm changed the title ~~Ability to disable default security group creation~~ Ability to disable default runner security group creation Feb 10, 2022

krlydm mentioned this pull request Feb 10, 2022

Making security group creation step optional #1717

Closed

npalm self-requested a review February 10, 2022 13:31

npalm changed the title ~~Ability to disable default runner security group creation~~ feat(runner): Ability to disable default runner security group creation Feb 10, 2022

npalm requested changes Feb 11, 2022

View reviewed changes

modules/runners/main.tf Outdated Show resolved Hide resolved

krlydm added 2 commits February 11, 2022 13:37

Fix launch template creation issue.

bac9b57

Fix formatting error.

8c88b24

Merge branch 'philips-labs:develop' into disable_security_group

69e3a1a

npalm approved these changes Feb 17, 2022

View reviewed changes

npalm merged commit 94779f8 into philips-labs:develop Feb 17, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(runner): Ability to disable default runner security group creation #1718

feat(runner): Ability to disable default runner security group creation #1718

krlydm commented Feb 10, 2022

npalm left a comment

npalm commented Feb 11, 2022

krlydm commented Feb 14, 2022

krlydm commented Feb 15, 2022

npalm commented Feb 15, 2022

npalm left a comment

feat(runner): Ability to disable default runner security group creation #1718

feat(runner): Ability to disable default runner security group creation #1718

Conversation

krlydm commented Feb 10, 2022

npalm left a comment

Choose a reason for hiding this comment

npalm commented Feb 11, 2022

krlydm commented Feb 14, 2022

krlydm commented Feb 15, 2022

npalm commented Feb 15, 2022

npalm left a comment

Choose a reason for hiding this comment