Skip to content

Commit 17a4ab0

Browse files
npalmnpalm
committed
Create infra code for runenrs
1 parent 8ebf0fb commit 17a4ab0

14 files changed

+414
-0
lines changed

‎examples/default/main.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
locals {
2+
environment = "test.default"
3+
aws_region = "eu-west-1"
4+
}
5+
6+
resource "random_string" "random" {
7+
length = 24
8+
special = false
9+
upper = false
10+
}
11+
12+
module "runners" {
13+
source = "../../modules/runners"
14+
15+
aws_region = local.aws_region
16+
vpc_id = module.vpc.vpc_id
17+
18+
environment = local.environment
19+
tags = {
20+
Project = "ProjectX"
21+
}
22+
distribution_bucket_name = random_string.random.result
23+
}
24+

‎examples/default/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
output "runners" {
2+
value = {
3+
launch_template_name = module.runners.launch_template.name
4+
launch_template_id = module.runners.launch_template.id
5+
launch_template_version = module.runners.launch_template.latest_version
6+
action_runner_distribution = module.runners.s3_location_runner_distribution
7+
}
8+
}

‎examples/default/providers.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
provider "aws" {
2+
region = local.aws_region
3+
version = "2.59"
4+
}
5+

‎examples/default/vpc.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
module "vpc" {
2+
source = "git::https://github.com/philips-software/terraform-aws-vpc.git?ref=2.1.0"
3+
4+
environment = local.environment
5+
aws_region = local.aws_region
6+
}
7+

‎modules/runners/main.tf

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
2+
resource "aws_resourcegroups_group" "resourcegroups_group" {
3+
name = "${var.environment}-group"
4+
5+
resource_query {
6+
query = <<-JSON
7+
{
8+
"ResourceTypeFilters": [
9+
"AWS::AllSupported"
10+
],
11+
"TagFilters": [
12+
{
13+
"Key": "ResourceGroup",
14+
"Values": ["${var.environment}"]
15+
}
16+
]
17+
}
18+
JSON
19+
}
20+
}
21+
22+
23+
locals {
24+
s3_location_runner_distribution = "s3://${aws_s3_bucket.action_dist.id}/${var.action_runner_dist_bucket_location}"
25+
}
26+
27+
data "aws_ami" "runner" {
28+
most_recent = "true"
29+
30+
dynamic "filter" {
31+
for_each = var.ami_filter
32+
content {
33+
name = filter.key
34+
values = filter.value
35+
}
36+
}
37+
38+
owners = var.ami_owners
39+
}
40+
41+
resource "aws_launch_template" "runner" {
42+
name = "${var.environment}-action-runner"
43+
44+
dynamic "block_device_mappings" {
45+
for_each = [var.block_device_mappings]
46+
content {
47+
device_name = "/dev/xvda"
48+
49+
ebs {
50+
delete_on_termination = lookup(block_device_mappings.value, "delete_on_termination", true)
51+
volume_type = lookup(block_device_mappings.value, "volume_type", "gp2")
52+
volume_size = lookup(block_device_mappings.value, "volume_size", 30)
53+
encrypted = lookup(block_device_mappings.value, "encrypted", true)
54+
iops = lookup(block_device_mappings.value, "iops", null)
55+
}
56+
}
57+
}
58+
59+
iam_instance_profile {
60+
name = aws_iam_instance_profile.runner.name
61+
}
62+
63+
instance_initiated_shutdown_behavior = "terminate"
64+
65+
instance_market_options {
66+
market_type = var.market_options
67+
}
68+
69+
image_id = data.aws_ami.runner.id
70+
instance_type = var.instance_type
71+
72+
vpc_security_group_ids = [aws_security_group.runner_sg.id]
73+
74+
tag_specifications {
75+
resource_type = "instance"
76+
tags = local.tags
77+
}
78+
79+
user_data = base64encode(templatefile("${path.module}/templates/user-data.sh", {
80+
environment = var.environment
81+
s3_location_runner_distribution = local.s3_location_runner_distribution
82+
}))
83+
}
84+
85+
resource "aws_security_group" "runner_sg" {
86+
name_prefix = "${var.environment}-github-actions-runner-sg"
87+
description = "Github Actions Runner security group"
88+
89+
vpc_id = var.vpc_id
90+
91+
egress {
92+
from_port = 0
93+
to_port = 0
94+
protocol = "-1"
95+
cidr_blocks = ["0.0.0.0/0"]
96+
}
97+
tags = merge(
98+
local.tags,
99+
{
100+
"Name" = format("%s", local.name_sg)
101+
},
102+
)
103+
}
104+
105+
locals {
106+
name_sg = var.overrides["name_sg"] == "" ? local.tags["Name"] : var.overrides["name_sg"]
107+
tags = merge(
108+
{
109+
"Name" = format("%s", var.environment)
110+
},
111+
{
112+
"Environment" = format("%s", var.environment)
113+
},
114+
var.tags,
115+
)
116+
}

‎modules/runners/outputs.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "s3_location_runner_distribution" {
2+
value = local.s3_location_runner_distribution
3+
}
4+
5+
output "launch_template" {
6+
value = aws_launch_template.runner
7+
}

‎modules/runners/policies.tf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
data "aws_caller_identity" "current" {}
2+
3+
resource "aws_iam_role" "runner" {
4+
name = "${var.environment}-github-action-runners-runner-role"
5+
assume_role_policy = templatefile("${path.module}/policies/instance-role-trust-policy.json", {})
6+
tags = local.tags
7+
}
8+
9+
resource "aws_iam_instance_profile" "runner" {
10+
name = "${var.environment}-github-action-runners-profile"
11+
role = aws_iam_role.runner.name
12+
}
13+
14+
resource "aws_iam_policy" "runner_session_manager_policy" {
15+
name = "${var.environment}-github-action-runners-session-manager"
16+
path = "/"
17+
description = "Policy session manager."
18+
19+
policy = templatefile("${path.module}/policies/instance-session-manager-policy.json", {})
20+
}
21+
22+
resource "aws_iam_role_policy_attachment" "runner_session_manager_policy" {
23+
role = aws_iam_role.runner.name
24+
policy_arn = aws_iam_policy.runner_session_manager_policy.arn
25+
}
26+
27+
resource "aws_iam_role_policy_attachment" "runner_session_manager_aws_managed" {
28+
role = aws_iam_role.runner.name
29+
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
30+
}
31+
32+
resource "aws_iam_policy" "dist_bucket" {
33+
name = "${var.environment}-gh-distribution-bucket"
34+
path = "/"
35+
description = "Policy for the runner to download the github action runner."
36+
37+
policy = templatefile("${path.module}/policies/instance-runner-s3-policy.json",
38+
{
39+
s3_arn = aws_s3_bucket.action_dist.arn
40+
}
41+
)
42+
}
43+
44+
resource "aws_iam_role_policy_attachment" "dist_bucket" {
45+
role = aws_iam_role.runner.name
46+
policy_arn = aws_iam_policy.dist_bucket.arn
47+
}
48+
49+
resource "aws_iam_policy" "ssm_parameters" {
50+
name = "${var.environment}-runner-ssm-parameters"
51+
path = "/"
52+
description = "Policy for the runner to download the github action runner."
53+
54+
policy = templatefile("${path.module}/policies/instance-ssm-parameters-policy.json",
55+
{
56+
arn_ssm_parameters = "arn:aws:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}-*"
57+
}
58+
)
59+
}
60+
61+
resource "aws_iam_role_policy_attachment" "ssm_parameters" {
62+
role = aws_iam_role.runner.name
63+
policy_arn = aws_iam_policy.ssm_parameters.arn
64+
}

‎modules/runners/policies/instance-role-trust-policy.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "",
6+
"Effect": "Allow",
7+
"Principal": {
8+
"Service": "ec2.amazonaws.com"
9+
},
10+
"Action": "sts:AssumeRole"
11+
}
12+
]
13+
}

‎modules/runners/policies/instance-runner-s3-policy.json

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "githubActionDist",
6+
"Effect": "Allow",
7+
"Action": ["s3:GetObject", "s3:GetObjectAcl"],
8+
"Resource": ["${s3_arn}/*"]
9+
}
10+
]
11+
}

‎modules/runners/policies/instance-session-manager-policy.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"ssmmessages:CreateControlChannel",
8+
"ssmmessages:CreateDataChannel",
9+
"ssmmessages:OpenControlChannel",
10+
"ssmmessages:OpenDataChannel"
11+
],
12+
"Resource": "*"
13+
}
14+
]
15+
}

0 commit comments

Comments
 (0)