/.ci/build.sh`. In the `main.tf` you can simply remove the location of the lambda zip files, the default location will work in this case.
-> The default example assumes local built lambda's available. Ensure you have built the lambda's. Alternativly you can downlowd the lambda's. The version needs to be set to a GitHub release version, see https://github.com/github-aws-runners/terraform-aws-github-runner/releases
+> The default example assumes local built lambda's available. Ensure you have built the lambda's. Alternatively you can download the lambda's. The version needs to be set to a GitHub release version, see https://github.com/github-aws-runners/terraform-aws-github-runner/releases
```bash
cd ../lambdas-download
diff --git a/main.tf b/main.tf
index e4e18000fd..b9456c0a52 100644
--- a/main.tf
+++ b/main.tf
@@ -4,8 +4,9 @@ locals {
})
github_app_parameters = {
- id = module.ssm.parameters.github_app_id
- key_base64 = module.ssm.parameters.github_app_key_base64
+ id = coalesce(var.github_app.id_ssm, module.ssm.parameters.github_app_id)
+ key_base64 = coalesce(var.github_app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+ webhook_secret = coalesce(var.github_app.webhook_secret_ssm, module.ssm.parameters.github_app_webhook_secret)
}
default_runner_labels = distinct(concat(["self-hosted", var.runner_os, var.runner_architecture]))
@@ -87,8 +88,7 @@ resource "aws_sqs_queue" "queued_builds_dlq" {
}
module "ssm" {
- source = "./modules/ssm"
-
+ source = "./modules/ssm"
kms_key_arn = var.kms_key_arn
path_prefix = "${local.ssm_root_path}/${var.ssm_paths.app}"
github_app = var.github_app
@@ -120,7 +120,7 @@ module "webhook" {
matcher_config_parameter_store_tier = var.matcher_config_parameter_store_tier
github_app_parameters = {
- webhook_secret = module.ssm.parameters.github_app_webhook_secret
+ webhook_secret = local.github_app_parameters.webhook_secret
}
lambda_s3_bucket = var.lambda_s3_bucket
diff --git a/mkdocs.yaml b/mkdocs.yaml
index 1fe9cb301f..d4bb359f42 100644
--- a/mkdocs.yaml
+++ b/mkdocs.yaml
@@ -70,6 +70,7 @@ nav:
- Default: examples/default.md
- Multi Runner: examples/multi-runner.md
- Ephemeral: examples/ephemeral.md
+ - External managed secrets: examples/external-managed-ssm-secrets.md
- Custom AMI: examples/prebuilt.md
- Termination watcher: examples/termination-watcher.md
- Lambda download: examples/lambda-download.md
diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md
index 771f7e1f98..dca32e2662 100644
--- a/modules/multi-runner/README.md
+++ b/modules/multi-runner/README.md
@@ -131,7 +131,7 @@ module "multi-runner" {
| [eventbridge](#input\_eventbridge) | Enable the use of EventBridge by the module. By enabling this feature events will be put on the EventBridge by the webhook instead of directly dispatching to queues for scaling. | object({
enable = optional(bool, true)
accept_events = optional(list(string), [])
}) | `{}` | no |
| [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify) | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
| [ghes\_url](#input\_ghes\_url) | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB. .However if you are using Github Enterprise Cloud with data-residency (ghe.com), set the endpoint here. Example - https://companyname.ghe.com\| | `string` | `null` | no |
-| [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | object({
key_base64 = string
id = string
webhook_secret = string
}) | n/a | yes |
+| [github\_app](#input\_github\_app) | GitHub app parameters, see your github app.
You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.
If you chose to provide the configuration values directly here,
please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).
Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | object({
key_base64 = optional(string)
key_base64_ssm = optional(object({
arn = string
name = string
}))
id = optional(string)
id_ssm = optional(object({
arn = string
name = string
}))
webhook_secret = optional(string)
webhook_secret_ssm = optional(object({
arn = string
name = string
}))
}) | n/a | yes |
| [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no |
| [instance\_termination\_watcher](#input\_instance\_termination\_watcher) | Configuration for the spot termination watcher lambda function. This feature is Beta, changes will not trigger a major release as long in beta.
`enable`: Enable or disable the spot termination watcher.
`memory_size`: Memory size linit in MB of the lambda.
`s3_key`: S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas.
`s3_object_version`: S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket.
`timeout`: Time out of the lambda in seconds.
`zip`: File location of the lambda zip file. | object({
enable = optional(bool, false)
features = optional(object({
enable_spot_termination_handler = optional(bool, true)
enable_spot_termination_notification_watcher = optional(bool, true)
}), {})
memory_size = optional(number, null)
s3_key = optional(string, null)
s3_object_version = optional(string, null)
timeout = optional(number, null)
zip = optional(string, null)
}) | `{}` | no |
| [key\_name](#input\_key\_name) | Key pair name | `string` | `null` | no |
diff --git a/modules/multi-runner/main.tf b/modules/multi-runner/main.tf
index 22ec0df3ba..905cc7f793 100644
--- a/modules/multi-runner/main.tf
+++ b/modules/multi-runner/main.tf
@@ -4,8 +4,9 @@ locals {
})
github_app_parameters = {
- id = module.ssm.parameters.github_app_id
- key_base64 = module.ssm.parameters.github_app_key_base64
+ id = coalesce(var.github_app.id_ssm, module.ssm.parameters.github_app_id)
+ key_base64 = coalesce(var.github_app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+ webhook_secret = coalesce(var.github_app.webhook_secret_ssm, module.ssm.parameters.github_app_webhook_secret)
}
runner_extra_labels = { for k, v in var.multi_runner_config : k => sort(setunion(flatten(v.matcherConfig.labelMatchers), compact(v.runner_config.runner_extra_labels))) }
diff --git a/modules/multi-runner/outputs.tf b/modules/multi-runner/outputs.tf
index 42758c0652..7ce7171faf 100644
--- a/modules/multi-runner/outputs.tf
+++ b/modules/multi-runner/outputs.tf
@@ -45,7 +45,11 @@ output "webhook" {
}
output "ssm_parameters" {
- value = module.ssm.parameters
+ value = { for k, v in local.github_app_parameters : k => {
+ name = v.name
+ arn = v.arn
+ }
+ }
}
output "instance_termination_watcher" {
diff --git a/modules/multi-runner/ssm.tf b/modules/multi-runner/ssm.tf
index 6b2591f465..6a3a234e6f 100644
--- a/modules/multi-runner/ssm.tf
+++ b/modules/multi-runner/ssm.tf
@@ -1,6 +1,5 @@
module "ssm" {
- source = "../ssm"
-
+ source = "../ssm"
kms_key_arn = var.kms_key_arn
path_prefix = "${local.ssm_root_path}/${var.ssm_paths.app}"
github_app = var.github_app
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
index bc45ee4057..ff4419d4d9 100644
--- a/modules/multi-runner/variables.tf
+++ b/modules/multi-runner/variables.tf
@@ -1,12 +1,41 @@
variable "github_app" {
- description = "GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`)."
+ description = < [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | object({
key_base64 = string
id = string
webhook_secret = string
}) | n/a | yes |
+| [github\_app](#input\_github\_app) | GitHub app parameters, see your github app.
You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.
If you chose to provide the configuration values directly here,
please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).
Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | object({
key_base64 = optional(string)
key_base64_ssm = optional(object({
arn = string
name = string
}))
id = optional(string)
id_ssm = optional(object({
arn = string
name = string
}))
webhook_secret = optional(string)
webhook_secret_ssm = optional(object({
arn = string
name = string
}))
}) | n/a | yes |
| [kms\_key\_arn](#input\_kms\_key\_arn) | Optional CMK Key ARN to be used for Parameter Store. | `string` | `null` | no |
| [path\_prefix](#input\_path\_prefix) | The path prefix used for naming resources | `string` | n/a | yes |
| [tags](#input\_tags) | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no |
diff --git a/modules/ssm/outputs.tf b/modules/ssm/outputs.tf
index 3545a839c3..4017f6ab3d 100644
--- a/modules/ssm/outputs.tf
+++ b/modules/ssm/outputs.tf
@@ -1,16 +1,16 @@
output "parameters" {
value = {
github_app_id = {
- name = aws_ssm_parameter.github_app_id.name
- arn = aws_ssm_parameter.github_app_id.arn
+ name = var.github_app.id_ssm != null ? var.github_app.id_ssm.name : aws_ssm_parameter.github_app_id[0].name
+ arn = var.github_app.id_ssm != null ? var.github_app.id_ssm.arn : aws_ssm_parameter.github_app_id[0].arn
}
github_app_key_base64 = {
- name = aws_ssm_parameter.github_app_key_base64.name
- arn = aws_ssm_parameter.github_app_key_base64.arn
+ name = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.name : aws_ssm_parameter.github_app_key_base64[0].name
+ arn = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.arn : aws_ssm_parameter.github_app_key_base64[0].arn
}
github_app_webhook_secret = {
- name = aws_ssm_parameter.github_app_webhook_secret.name
- arn = aws_ssm_parameter.github_app_webhook_secret.arn
+ name = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.name : aws_ssm_parameter.github_app_webhook_secret[0].name
+ arn = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.arn : aws_ssm_parameter.github_app_webhook_secret[0].arn
}
}
}
diff --git a/modules/ssm/ssm.tf b/modules/ssm/ssm.tf
index 6bf3291e37..3f13333e68 100644
--- a/modules/ssm/ssm.tf
+++ b/modules/ssm/ssm.tf
@@ -1,4 +1,5 @@
resource "aws_ssm_parameter" "github_app_id" {
+ count = var.github_app.id_ssm != null ? 0 : 1
name = "${var.path_prefix}/github_app_id"
type = "SecureString"
value = var.github_app.id
@@ -7,6 +8,7 @@ resource "aws_ssm_parameter" "github_app_id" {
}
resource "aws_ssm_parameter" "github_app_key_base64" {
+ count = var.github_app.key_base64_ssm != null ? 0 : 1
name = "${var.path_prefix}/github_app_key_base64"
type = "SecureString"
value = var.github_app.key_base64
@@ -15,6 +17,7 @@ resource "aws_ssm_parameter" "github_app_key_base64" {
}
resource "aws_ssm_parameter" "github_app_webhook_secret" {
+ count = var.github_app.webhook_secret_ssm != null ? 0 : 1
name = "${var.path_prefix}/github_app_webhook_secret"
type = "SecureString"
value = var.github_app.webhook_secret
diff --git a/modules/ssm/variables.tf b/modules/ssm/variables.tf
index 310f3a8d89..1eb796aea7 100644
--- a/modules/ssm/variables.tf
+++ b/modules/ssm/variables.tf
@@ -1,10 +1,37 @@
variable "github_app" {
- description = "GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`)."
+ description = < {
+ name = v.name
+ arn = v.arn
+ }
+ }
}
diff --git a/variables.tf b/variables.tf
index eb3fbb7604..cb30dcef5d 100644
--- a/variables.tf
+++ b/variables.tf
@@ -32,12 +32,39 @@ variable "enable_organization_runners" {
}
variable "github_app" {
- description = "GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`)."
+ description = <