/microvm-metadata`. Scale-up, scale-down, and pool use that non-secret prefix for MicroVM ownership and lifecycle state; the runner role can read only the lane's `*.tags` metadata records, the CloudWatch enablement parameter, and its lane-scoped one-time JIT parameter. It can also delete that JIT parameter and write to the provider-managed log groups. MicroVMs sharing the execution role can read the tag records for that lane, but not the ownership and cleanup records. When the runner role is supplied externally, its Lambda trust and these permissions remain caller-owned.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 1.4.0 |
+| [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 6.33 |
+| [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_log_group.gh_runners](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_cloudwatch_log_group.runtime](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_ssm_parameter.cloudwatch_agent_config_runner](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.runner_enable_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [terraform_data.validate_config](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_runner](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.runner_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.runner_metadata](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.runner_runtime_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.runner_ssm_jit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.scale_down](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.scale_up](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| [aws\_partition](#input\_aws\_partition) | AWS partition used to construct IAM ARNs. | `string` | `"aws"` | no |
+| [aws\_region](#input\_aws\_region) | AWS region used by compute-provider resources and policy documents. | `string` | n/a | yes |
+| [config](#input\_config) | Lambda MicroVM compute-provider configuration. Paths match `compute_provider.aws.microvm` in runner-config.
- `image_arn`: ARN of the MicroVM image used to run GitHub runners.
- `image_version`: Optional MicroVM image version.
- `ingress_network_connectors`: Up to 10 Lambda network-connector ARNs passed to RunMicrovm.
- `egress_network_connectors`: Up to 10 Lambda network-connector ARNs passed to RunMicrovm.
- `cloudwatch_agent.enabled`: Enables the image CloudWatch agent through the shared runner configuration path.
- `cloudwatch_agent.config`: Optional complete CloudWatch agent configuration. Null renders the provider default from `log_files`. Custom log destinations must also be declared in `log_files` so Terraform creates their groups and IAM permissions.
- `log_files`: Optional files collected by the CloudWatch agent. Null uses the MicroVM defaults.
- `log_files[].log_group_name`: CloudWatch log-group name before optional prefixing.
- `log_files[].prefix_log_group`: Prefixes the log-group name with the runner configuration path.
- `log_files[].file_path`: File or glob read by the CloudWatch agent.
- `log_files[].log_stream_name`: Log-stream template. The image replaces `{microvm_id}` with the current MicroVM identifier.
- `log_files[].log_class`: CloudWatch log-group class for the collected file.
- `environment_variables`: Additional provider-specific Lambda environment variables merged into scale-up, scale-down, and pool.
- `iam.resource_arns.images`: Optional MicroVM image ARN allowlist for RunMicrovm and TerminateMicrovm. Null restricts both actions to `image_arn`; set an explicit list when dynamic image overrides are enabled. Provider-required list and connector permissions remain separately scoped to `*`.
- `iam.additional_policy_json.scale_up`: Optional additional provider policy attached separately to the scale-up Lambda role.
- `iam.managed_policies.scale_up`: Optional managed-policy wrapper attached to the scale-up Lambda role. Wrapper presence controls resource creation during planning.
- `iam.managed_policies.scale_up.arn`: ARN of the scale-up managed policy. The ARN may remain unknown until apply.
- `iam.managed_policies.pool`: Optional managed-policy wrapper attached to the pool Lambda role. Wrapper presence controls resource creation during planning.
- `iam.managed_policies.pool.arn`: ARN of the pool managed policy. The ARN may remain unknown until apply. | object({
image_arn = string
image_version = optional(string, null)
ingress_network_connectors = optional(list(string), [])
egress_network_connectors = optional(list(string), [])
cloudwatch_agent = optional(object({
enabled = optional(bool, true)
config = optional(string, null)
}), {})
log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
environment_variables = optional(map(string), {})
iam = optional(object({
resource_arns = optional(object({
images = optional(list(string), null)
}), {})
additional_policy_json = optional(object({
scale_up = optional(string, null)
}), {})
managed_policies = optional(object({
scale_up = optional(object({
arn = string
}), null)
pool = optional(object({
arn = string
}), null)
}), {})
}), {})
}) | n/a | yes |
+| [github](#input\_github) | GitHub Enterprise Server settings available to compute-provider bootstrap data.
- `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.
- `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server. | object({
enterprise_server = optional(object({
url = optional(string, null)
ssl_verify = optional(bool, true)
}), {})
}) | `{}` | no |
+| [observability](#input\_observability) | Provider-neutral observability settings applied to the provider-managed MicroVM runtime log group.
- `logs.retention_in_days`: CloudWatch Logs retention period.
- `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt the log group.
- `logs.class`: CloudWatch log-group class.
- `logs.tags`: Tags merged after module-level tags on the log group. | object({
logs = optional(object({
retention_in_days = optional(number, 180)
kms_key_id = optional(string, null)
class = optional(string, "STANDARD")
tags = optional(map(string), {})
}), {})
}) | `{}` | no |
+| [prefix](#input\_prefix) | Prefix used to identify resources created for the runner configuration. | `string` | `"github-actions"` | no |
+| [runner](#input\_runner) | Resolved runner settings consumed by the Lambda MicroVM compute provider.
- `os`: Runner operating system. Lambda MicroVM requires `linux`.
- `architecture`: Runner distribution architecture. Lambda MicroVM requires `arm64`.
- `name_prefix`: Prefix added to registered runner names.
- `run_as_root`: Runs the runner service as root.
- `run_as`: Operating-system user used when `run_as_root` is false.
- `hooks.job_started`: Script installed as the runner job-started hook.
- `hooks.job_completed`: Script installed as the runner job-completed hook.
- `iam.role.arn`: Resolved runner-role ARN used as the MicroVM execution role and referenced by provider policies.
- `iam.role.name`: Resolved runner-role name used by provider resources.
- `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter` on the lane's `microvm-metadata/*.tags` and `enable_cloudwatch` parameters, `ssm:GetParameter` and `ssm:DeleteParameter` on the lane token path, plus `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group. When the CloudWatch agent is enabled, it also needs `ssm:GetParameter` on `cloudwatch_agent_config_runner` and stream access to the configured runner log groups.
- `iam.managed_policy_arns`: Common managed-policy ARNs returned with the provider-specific runner policies for attachment by runner-config.
- `iam.path`: IAM path available to provider-managed IAM resources. Null derives the path from `prefix`. | object({
os = optional(string, "linux")
architecture = optional(string, "arm64")
name_prefix = optional(string, "")
run_as_root = optional(bool, false)
run_as = optional(string, "ec2-user")
hooks = optional(object({
job_started = optional(string, "")
job_completed = optional(string, "")
}), {})
iam = object({
role = object({
arn = string
name = string
managed = optional(bool, true)
})
managed_policy_arns = optional(map(string), {})
path = optional(string, null)
})
}) | n/a | yes |
+| [ssm](#input\_ssm) | Parameter Store paths and tag scopes available to compute-provider bootstrap resources.
- `paths.root`: Root Parameter Store path for the runner configuration.
- `paths.tokens`: Path segment used for registration tokens and just-in-time configuration.
- `paths.config`: Path segment used for persistent runner and provider configuration. MicroVM control-plane metadata is stored under its `microvm-metadata` child prefix.
- `tags`: Shared SSM tags that override module-level `tags`.
- `parameters.tags`: Parameter-specific tags that override module-level and shared SSM tags. | object({
paths = object({
root = string
tokens = string
config = string
})
tags = optional(map(string), {})
parameters = optional(object({
tags = optional(map(string), {})
}), {})
}) | n/a | yes |
+| [tags](#input\_tags) | Base tags available to taggable compute-provider resources. Provider-specific tags override this map within their documented scopes. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [environment\_variables](#output\_environment\_variables) | Provider-specific Lambda environment variable fragments consumed by runner-config. |
+| [policies](#output\_policies) | Provider-specific IAM policy fragments consumed by runner-config. |
+| [provider](#output\_provider) | Nested Lambda MicroVM compute-provider contract consumed by runner-config. |
+| [resources](#output\_resources) | Provider-specific MicroVM resources exposed by runner-config. |
+
diff --git a/modules/compute-providers/aws/microvm/control-plane.tf b/modules/compute-providers/aws/microvm/control-plane.tf
new file mode 100644
index 0000000000..832a90df04
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/control-plane.tf
@@ -0,0 +1,118 @@
+data "aws_iam_policy_document" "scale_up" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "lambda:ListMicrovms",
+ "lambda:PassNetworkConnector",
+ ]
+ resources = ["*"]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = [
+ "lambda:RunMicrovm",
+ "lambda:TerminateMicrovm",
+ ]
+ resources = local.microvm_image_resource_arns
+ }
+
+ statement {
+ effect = "Allow"
+ actions = [
+ "ssm:AddTagsToResource",
+ "ssm:DeleteParameter",
+ "ssm:PutParameter",
+ ]
+ resources = [local.microvm_metadata_parameter_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:GetParametersByPath"]
+ resources = [local.microvm_metadata_path_arn, local.microvm_metadata_parameter_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:GetParameters"]
+ resources = [local.microvm_metadata_parameter_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["iam:PassRole"]
+ resources = [var.runner.iam.role.arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:DeleteParameter"]
+ resources = [local.runner_token_path_arn]
+ }
+}
+
+data "aws_iam_policy_document" "scale_down" {
+ statement {
+ effect = "Allow"
+ actions = ["lambda:ListMicrovms"]
+ resources = ["*"]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["lambda:TerminateMicrovm"]
+ resources = local.microvm_image_resource_arns
+ }
+
+ statement {
+ effect = "Allow"
+ actions = [
+ "ssm:DeleteParameter",
+ "ssm:PutParameter",
+ ]
+ resources = [local.microvm_metadata_parameter_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:GetParametersByPath"]
+ resources = [local.microvm_metadata_path_arn, local.microvm_metadata_parameter_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:DeleteParameter"]
+ resources = [local.runner_token_path_arn]
+ }
+}
+
+locals {
+ microvm_metadata_ssm_path = "${local.ssm_config_ssm_path}/microvm-metadata"
+ microvm_metadata_path_arn = "${local.ssm_parameter_arn_prefix}${local.microvm_metadata_ssm_path}"
+ microvm_metadata_parameter_arn = "${local.microvm_metadata_path_arn}/*"
+ microvm_image_resource_arns = coalesce(
+ var.config.iam.resource_arns.images,
+ [var.config.image_arn],
+ )
+ runner_jit_ssm_path = "/${trim(var.ssm.paths.root, "/")}/${trim(var.ssm.paths.tokens, "/")}"
+
+ microvm_custom_environment_variables = {
+ for key, value in var.config.environment_variables : key => value
+ if !contains(["MICROVM_METADATA_TAGS", "MICROVM_RUNNER_CONFIG_SSM_ARN"], key)
+ }
+ microvm_environment_variables = merge(local.microvm_custom_environment_variables, {
+ MICROVM_EGRESS_NETWORK_CONNECTORS = length(var.config.egress_network_connectors) == 0 ? "" : jsonencode(var.config.egress_network_connectors)
+ MICROVM_EXECUTION_ROLE_ARN = var.runner.iam.role.arn
+ MICROVM_IMAGE_ARN = var.config.image_arn
+ MICROVM_IMAGE_VERSION = var.config.image_version == null ? "" : var.config.image_version
+ MICROVM_INGRESS_NETWORK_CONNECTORS = length(var.config.ingress_network_connectors) == 0 ? "" : jsonencode(var.config.ingress_network_connectors)
+ MICROVM_LOG_GROUP = aws_cloudwatch_log_group.runtime.name
+ MICROVM_METADATA_SSM_PATH = local.microvm_metadata_ssm_path
+ SSM_TOKEN_PATH = local.runner_jit_ssm_path
+ })
+
+ scale_up_environment_variables = local.microvm_environment_variables
+ scale_down_environment_variables = local.microvm_environment_variables
+ pool_environment_variables = local.microvm_environment_variables
+}
diff --git a/modules/compute-providers/aws/microvm/logging.tf b/modules/compute-providers/aws/microvm/logging.tf
new file mode 100644
index 0000000000..18f87ffeed
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/logging.tf
@@ -0,0 +1,86 @@
+locals {
+ provider_tags = merge(
+ {
+ "Name" = format("%s-action-runner", var.prefix)
+ },
+ var.tags,
+ )
+
+ log_group_tags = merge(
+ local.provider_tags,
+ var.observability.logs.tags,
+ )
+
+ ssm_config_ssm_path = "/${trim(var.ssm.paths.root, "/")}/${trim(var.ssm.paths.config, "/")}"
+ ssm_parameter_tags = merge(
+ local.provider_tags,
+ var.ssm.tags,
+ var.ssm.parameters.tags,
+ )
+
+ runner_log_files = var.config.log_files != null ? var.config.log_files : [
+ {
+ log_group_name = "internal_service"
+ prefix_log_group = true
+ file_path = "/var/log/microvm/internal-services.log"
+ log_stream_name = "{microvm_id}"
+ log_class = "STANDARD"
+ },
+ {
+ log_group_name = "run"
+ prefix_log_group = true
+ file_path = "/var/log/microvm/run.log"
+ log_stream_name = "{microvm_id}"
+ log_class = "STANDARD"
+ },
+ {
+ log_group_name = "runner"
+ prefix_log_group = true
+ file_path = "/opt/actions-runner/_diag/Runner_**.log"
+ log_stream_name = "{microvm_id}"
+ log_class = "STANDARD"
+ },
+ ]
+
+ logfiles = var.config.cloudwatch_agent.enabled ? [for log_file in local.runner_log_files : {
+ log_group_name = log_file.prefix_log_group ? "/github-self-hosted-runners/${var.prefix}/${log_file.log_group_name}" : "/${log_file.log_group_name}"
+ log_stream_name = log_file.log_stream_name
+ file_path = log_file.file_path
+ log_group_class = log_file.log_class
+ }] : []
+ runner_log_group_names = distinct([for log_file in local.logfiles : log_file.log_group_name])
+ runner_log_group_classes = [for name in local.runner_log_group_names : [
+ for log_file in local.logfiles : log_file.log_group_class
+ if log_file.log_group_name == name
+ ][0]]
+}
+
+resource "aws_cloudwatch_log_group" "runtime" {
+ name = "/github-self-hosted-runners/${var.prefix}/microvm"
+ retention_in_days = var.observability.logs.retention_in_days
+ kms_key_id = var.observability.logs.kms_key_id
+ log_group_class = var.observability.logs.class
+ tags = local.log_group_tags
+}
+
+resource "aws_ssm_parameter" "cloudwatch_agent_config_runner" {
+ count = var.config.cloudwatch_agent.enabled ? 1 : 0
+
+ name = "${local.ssm_config_ssm_path}/cloudwatch_agent_config_runner"
+ type = "String"
+ value = var.config.cloudwatch_agent.config != null ? var.config.cloudwatch_agent.config : templatefile(
+ "${path.module}/templates/cloudwatch_config.json",
+ { logfiles = jsonencode(local.logfiles) },
+ )
+ tags = local.ssm_parameter_tags
+}
+
+resource "aws_cloudwatch_log_group" "gh_runners" {
+ count = length(local.runner_log_group_names)
+
+ name = local.runner_log_group_names[count.index]
+ retention_in_days = var.observability.logs.retention_in_days
+ kms_key_id = var.observability.logs.kms_key_id
+ log_group_class = local.runner_log_group_classes[count.index]
+ tags = local.log_group_tags
+}
diff --git a/modules/compute-providers/aws/microvm/outputs.tf b/modules/compute-providers/aws/microvm/outputs.tf
new file mode 100644
index 0000000000..6200a8f54e
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/outputs.tf
@@ -0,0 +1,23 @@
+output "environment_variables" {
+ description = "Provider-specific Lambda environment variable fragments consumed by runner-config."
+ value = local.provider_environment_variables
+}
+
+output "policies" {
+ description = "Provider-specific IAM policy fragments consumed by runner-config."
+ value = local.provider_policies
+}
+
+output "resources" {
+ description = "Provider-specific MicroVM resources exposed by runner-config."
+ value = local.provider_resources
+}
+
+output "provider" {
+ description = "Nested Lambda MicroVM compute-provider contract consumed by runner-config."
+ value = {
+ environment_variables = local.provider_environment_variables
+ policies = local.provider_policies
+ resources = local.provider_resources
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/policies-runner.tf b/modules/compute-providers/aws/microvm/policies-runner.tf
new file mode 100644
index 0000000000..9b514e396a
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/policies-runner.tf
@@ -0,0 +1,81 @@
+data "aws_caller_identity" "current" {}
+
+locals {
+ ssm_parameter_arn_prefix = "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter"
+ runner_token_path_arn = "${local.ssm_parameter_arn_prefix}/${trim(var.ssm.paths.root, "/")}/${trim(var.ssm.paths.tokens, "/")}/*"
+ runner_metadata_tags_arn = "${local.microvm_metadata_path_arn}/*.tags"
+ runner_enable_cloudwatch_arn = "${local.ssm_parameter_arn_prefix}${local.ssm_config_ssm_path}/enable_cloudwatch"
+ runner_cloudwatch_config_arn = "${local.ssm_parameter_arn_prefix}${local.ssm_config_ssm_path}/cloudwatch_agent_config_runner"
+ runner_cloudwatch_log_group_arns = [for name in local.runner_log_group_names :
+ "arn:${var.aws_partition}:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${name}"
+ ]
+ runner_inline_policies = merge({
+ ssm_jit = {
+ name = "runner-microvm-ssm-jit"
+ policy_json = data.aws_iam_policy_document.runner_ssm_jit.json
+ }
+ runtime_logs = {
+ name = "runner-microvm-runtime-logs"
+ policy_json = data.aws_iam_policy_document.runner_runtime_logs.json
+ }
+ runner_metadata = {
+ name = "runner-microvm-metadata"
+ policy_json = data.aws_iam_policy_document.runner_metadata.json
+ }
+ }, var.config.cloudwatch_agent.enabled ? {
+ cloudwatch = {
+ name = "runner-microvm-cloudwatch"
+ policy_json = data.aws_iam_policy_document.runner_cloudwatch[0].json
+ }
+ } : {})
+}
+
+data "aws_iam_policy_document" "runner_ssm_jit" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "ssm:DeleteParameter",
+ "ssm:GetParameter",
+ ]
+ resources = [local.runner_token_path_arn]
+ }
+}
+
+data "aws_iam_policy_document" "runner_metadata" {
+ statement {
+ effect = "Allow"
+ actions = ["ssm:GetParameter"]
+ resources = [local.runner_metadata_tags_arn, local.runner_enable_cloudwatch_arn]
+ }
+}
+
+data "aws_iam_policy_document" "runner_cloudwatch" {
+ count = var.config.cloudwatch_agent.enabled ? 1 : 0
+
+ statement {
+ effect = "Allow"
+ actions = ["ssm:GetParameter"]
+ resources = [local.runner_cloudwatch_config_arn]
+ }
+
+ statement {
+ effect = "Allow"
+ actions = [
+ "logs:CreateLogStream",
+ "logs:DescribeLogStreams",
+ "logs:PutLogEvents",
+ ]
+ resources = [for arn in local.runner_cloudwatch_log_group_arns : "${arn}:*"]
+ }
+}
+
+data "aws_iam_policy_document" "runner_runtime_logs" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "logs:CreateLogStream",
+ "logs:PutLogEvents",
+ ]
+ resources = ["${aws_cloudwatch_log_group.runtime.arn}:*"]
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/provider-contract.tf b/modules/compute-providers/aws/microvm/provider-contract.tf
new file mode 100644
index 0000000000..2f487a01d7
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/provider-contract.tf
@@ -0,0 +1,36 @@
+locals {
+ provider_environment_variables = {
+ scale_up = local.scale_up_environment_variables
+ scale_down = local.scale_down_environment_variables
+ pool = local.pool_environment_variables
+ }
+
+ provider_policies = {
+ runner = {
+ inline_policies = local.runner_inline_policies
+ managed_policy_arns = var.runner.iam.managed_policy_arns
+ }
+ scale_up = {
+ iam_policy_json = data.aws_iam_policy_document.scale_up.json
+ additional_iam_policy_json = var.config.iam.additional_policy_json.scale_up
+ managed_policy_enabled = var.config.iam.managed_policies.scale_up != null
+ managed_policy_arn = try(var.config.iam.managed_policies.scale_up.arn, null)
+ }
+ scale_down = {
+ iam_policy_json = data.aws_iam_policy_document.scale_down.json
+ }
+ pool = {
+ iam_policy_json = data.aws_iam_policy_document.scale_up.json
+ managed_policy_enabled = var.config.iam.managed_policies.pool != null
+ managed_policy_arn = try(var.config.iam.managed_policies.pool.arn, null)
+ }
+ }
+
+ provider_resources = {
+ image_arn = var.config.image_arn
+ image_version = var.config.image_version
+ execution_role_arn = var.runner.iam.role.arn
+ runners_log_groups = concat([aws_cloudwatch_log_group.runtime], aws_cloudwatch_log_group.gh_runners)
+ logfiles = local.logfiles
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/runner-config.tf b/modules/compute-providers/aws/microvm/runner-config.tf
new file mode 100644
index 0000000000..de3b775106
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/runner-config.tf
@@ -0,0 +1,6 @@
+resource "aws_ssm_parameter" "runner_enable_cloudwatch" {
+ name = "${local.ssm_config_ssm_path}/enable_cloudwatch"
+ type = "String"
+ value = var.config.cloudwatch_agent.enabled
+ tags = local.ssm_parameter_tags
+}
diff --git a/modules/compute-providers/aws/microvm/templates/cloudwatch_config.json b/modules/compute-providers/aws/microvm/templates/cloudwatch_config.json
new file mode 100644
index 0000000000..554de026e5
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/templates/cloudwatch_config.json
@@ -0,0 +1,12 @@
+{
+ "agent": {
+ "metrics_collection_interval": 5
+ },
+ "logs": {
+ "logs_collected": {
+ "files": {
+ "collect_list": ${logfiles}
+ }
+ }
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/tests/provider.tftest.hcl b/modules/compute-providers/aws/microvm/tests/provider.tftest.hcl
new file mode 100644
index 0000000000..de167845f2
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/tests/provider.tftest.hcl
@@ -0,0 +1,633 @@
+mock_provider "aws" {
+ mock_data "aws_caller_identity" {
+ defaults = {
+ account_id = "123456789012"
+ }
+ }
+
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{}"
+ }
+ }
+
+ mock_resource "aws_cloudwatch_log_group" {
+ defaults = {
+ arn = "arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/microvm"
+ }
+ }
+}
+
+variables {
+ aws_region = "eu-west-1"
+ prefix = "microvm-test"
+
+ tags = {
+ Module = "runner"
+ Name = "module"
+ }
+
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ image_version = "3"
+ ingress_network_connectors = [
+ "arn:aws:lambda:eu-west-1:123456789012:network-connector:ingress",
+ ]
+ egress_network_connectors = [
+ "arn:aws:lambda:eu-west-1:123456789012:network-connector:egress",
+ ]
+ environment_variables = {
+ MICROVM_CLUSTER = "runner-cluster"
+ MICROVM_IMAGE_ARN = "caller-cannot-override-provider-contract"
+ MICROVM_METADATA_SSM_PATH = "/caller/cannot/override/provider-contract"
+ MICROVM_METADATA_TAGS = "retired-provider-contract"
+ MICROVM_RUNNER_CONFIG_SSM_ARN = "retired-provider-contract"
+ SSM_TOKEN_PATH = "/caller/cannot/override/token-path"
+ }
+ }
+
+ runner = {
+ name_prefix = "microvm-"
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/microvm-test-runner"
+ name = "microvm-test-runner"
+ }
+ managed_policy_arns = {
+ readonly = "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ }
+ }
+ }
+
+ ssm = {
+ paths = {
+ root = "/github-action-runners"
+ tokens = "tokens"
+ config = "config"
+ }
+ tags = {
+ Name = "ssm"
+ Precedence = "ssm"
+ Ssm = "shared"
+ }
+ parameters = {
+ tags = {
+ Name = "parameter"
+ Parameter = "metadata"
+ Precedence = "parameter"
+ "ghr:environment" = "caller-cannot-override"
+ "ghr:runner_name_prefix" = "caller-cannot-override"
+ "ghr:ssm_config_path" = "caller-cannot-override"
+ }
+ }
+ }
+
+ observability = {
+ logs = {
+ retention_in_days = 30
+ kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/runtime-logs"
+ class = "INFREQUENT_ACCESS"
+ tags = {
+ Name = "microvm-runtime-logs"
+ LogOnly = "runtime"
+ }
+ }
+ }
+}
+
+run "exposes_microvm_control_plane_contract" {
+ command = apply
+
+ assert {
+ condition = toset(keys(output.provider)) == toset(["environment_variables", "policies", "resources"])
+ error_message = "The MicroVM provider contract must expose only integration and resource data."
+ }
+
+ assert {
+ condition = (
+ output.provider.environment_variables.scale_up["MICROVM_CLUSTER"] == "runner-cluster"
+ && output.provider.environment_variables.scale_up["MICROVM_IMAGE_ARN"] == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ && output.provider.environment_variables.scale_up["MICROVM_IMAGE_VERSION"] == "3"
+ && output.provider.environment_variables.scale_up["MICROVM_EXECUTION_ROLE_ARN"] == "arn:aws:iam::123456789012:role/microvm-test-runner"
+ && jsondecode(output.provider.environment_variables.scale_up["MICROVM_INGRESS_NETWORK_CONNECTORS"])[0] == "arn:aws:lambda:eu-west-1:123456789012:network-connector:ingress"
+ && jsondecode(output.provider.environment_variables.scale_up["MICROVM_EGRESS_NETWORK_CONNECTORS"])[0] == "arn:aws:lambda:eu-west-1:123456789012:network-connector:egress"
+ && output.provider.environment_variables.scale_up["MICROVM_LOG_GROUP"] == "/github-self-hosted-runners/microvm-test/microvm"
+ && output.provider.environment_variables.scale_up["MICROVM_METADATA_SSM_PATH"] == "/github-action-runners/config/microvm-metadata"
+ && output.provider.environment_variables.scale_up["SSM_TOKEN_PATH"] == "/github-action-runners/tokens"
+ )
+ error_message = "The MicroVM provider must map every configured runtime input to the canonical Lambda environment contract."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.provider.environment_variables.scale_up)) == toset([
+ "MICROVM_CLUSTER",
+ "MICROVM_EGRESS_NETWORK_CONNECTORS",
+ "MICROVM_EXECUTION_ROLE_ARN",
+ "MICROVM_IMAGE_ARN",
+ "MICROVM_IMAGE_VERSION",
+ "MICROVM_INGRESS_NETWORK_CONNECTORS",
+ "MICROVM_LOG_GROUP",
+ "MICROVM_METADATA_SSM_PATH",
+ "SSM_TOKEN_PATH",
+ ])
+ && output.provider.environment_variables.scale_up == output.provider.environment_variables.scale_down
+ && output.provider.environment_variables.scale_up == output.provider.environment_variables.pool
+ && !contains(keys(output.provider.environment_variables.scale_up), "RUNNER_BOOT_TIME_IN_MINUTES")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_IMAGE_IDENTIFIER")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_MAXIMUM_DURATION_IN_SECONDS")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_RUN_CONFIG")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_TAGS")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_METADATA_TAGS")
+ && !contains(keys(output.provider.environment_variables.scale_up), "MICROVM_RUNNER_CONFIG_SSM_ARN")
+ )
+ error_message = "All three control-plane fragments must match the runtime key inventory and omit stale or webhook-owned keys."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.scale_up.statement[0].actions == toset(["lambda:ListMicrovms", "lambda:PassNetworkConnector"])
+ && data.aws_iam_policy_document.scale_up.statement[0].resources == toset(["*"])
+ && data.aws_iam_policy_document.scale_up.statement[1].actions == toset(["lambda:RunMicrovm", "lambda:TerminateMicrovm"])
+ && data.aws_iam_policy_document.scale_up.statement[1].resources == toset(["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"])
+ )
+ error_message = "Scale-up and pool must receive the MicroVM inventory, connector, launch, and cleanup permissions."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.scale_up.statement[2].actions == toset(["ssm:AddTagsToResource", "ssm:DeleteParameter", "ssm:PutParameter"])
+ && data.aws_iam_policy_document.scale_up.statement[2].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ && data.aws_iam_policy_document.scale_up.statement[3].actions == toset(["ssm:GetParametersByPath"])
+ && data.aws_iam_policy_document.scale_up.statement[3].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*",
+ ])
+ && data.aws_iam_policy_document.scale_up.statement[4].actions == toset(["ssm:GetParameters"])
+ && data.aws_iam_policy_document.scale_up.statement[4].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ )
+ error_message = "Scale-up and pool must read the metadata hierarchy and exact JIT fence records while keeping metadata writes child-scoped."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.scale_up.statement[5].actions == toset(["iam:PassRole"])
+ && data.aws_iam_policy_document.scale_up.statement[5].resources == toset(["arn:aws:iam::123456789012:role/microvm-test-runner"])
+ && length(data.aws_iam_policy_document.scale_up.statement[5].condition) == 0
+ && data.aws_iam_policy_document.scale_up.statement[6].actions == toset(["ssm:DeleteParameter"])
+ && data.aws_iam_policy_document.scale_up.statement[6].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ )
+ error_message = "Scale-up and pool must receive exact runner-role PassRole and lane-token cleanup grants."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.scale_down.statement[0].actions == toset(["lambda:ListMicrovms"])
+ && data.aws_iam_policy_document.scale_down.statement[0].resources == toset(["*"])
+ && data.aws_iam_policy_document.scale_down.statement[1].actions == toset(["lambda:TerminateMicrovm"])
+ && data.aws_iam_policy_document.scale_down.statement[1].resources == toset(["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"])
+ && data.aws_iam_policy_document.scale_down.statement[2].actions == toset(["ssm:DeleteParameter", "ssm:PutParameter"])
+ && data.aws_iam_policy_document.scale_down.statement[2].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ && data.aws_iam_policy_document.scale_down.statement[3].actions == toset(["ssm:GetParametersByPath"])
+ && data.aws_iam_policy_document.scale_down.statement[3].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*",
+ ])
+ && data.aws_iam_policy_document.scale_down.statement[4].actions == toset(["ssm:DeleteParameter"])
+ && data.aws_iam_policy_document.scale_down.statement[4].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ )
+ error_message = "Scale-down must receive lifecycle, metadata, and exact lane-token cleanup permissions."
+ }
+
+ assert {
+ condition = (
+ length(setintersection(toset(flatten(data.aws_iam_policy_document.scale_up.statement[*].actions)), toset(["lambda:ListTags", "lambda:TagResource", "lambda:UntagResource"]))) == 0
+ && length(setintersection(toset(flatten(data.aws_iam_policy_document.scale_down.statement[*].actions)), toset(["lambda:ListTags", "lambda:TagResource", "lambda:UntagResource"]))) == 0
+ )
+ error_message = "The MicroVM provider must not grant unsupported runtime tagging actions."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.provider.policies)) == toset(["runner", "scale_up", "scale_down", "pool"])
+ && toset(keys(output.provider.policies.runner.inline_policies)) == toset(["cloudwatch", "runner_metadata", "runtime_logs", "ssm_jit"])
+ && output.provider.policies.runner.inline_policies.cloudwatch.name == "runner-microvm-cloudwatch"
+ && output.provider.policies.runner.inline_policies.runner_metadata.name == "runner-microvm-metadata"
+ && output.provider.policies.runner.inline_policies.ssm_jit.name == "runner-microvm-ssm-jit"
+ && output.provider.policies.runner.inline_policies.runtime_logs.name == "runner-microvm-runtime-logs"
+ && output.provider.policies.runner.managed_policy_arns["readonly"] == "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ && !output.provider.policies.scale_up.managed_policy_enabled
+ && !output.provider.policies.pool.managed_policy_enabled
+ )
+ error_message = "The MicroVM provider must return policy fragments grouped by common component."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.runner_ssm_jit.statement[0].actions == toset(["ssm:DeleteParameter", "ssm:GetParameter"])
+ && data.aws_iam_policy_document.runner_ssm_jit.statement[0].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ && data.aws_iam_policy_document.runner_metadata.statement[0].actions == toset(["ssm:GetParameter"])
+ && data.aws_iam_policy_document.runner_metadata.statement[0].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/enable_cloudwatch",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*.tags",
+ ])
+ && data.aws_iam_policy_document.runner_cloudwatch[0].statement[0].actions == toset(["ssm:GetParameter"])
+ && data.aws_iam_policy_document.runner_cloudwatch[0].statement[0].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/cloudwatch_agent_config_runner"])
+ && data.aws_iam_policy_document.runner_cloudwatch[0].statement[1].actions == toset(["logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents"])
+ && data.aws_iam_policy_document.runner_cloudwatch[0].statement[1].resources == toset([
+ "arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/internal_service:*",
+ "arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/run:*",
+ "arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/runner:*",
+ ])
+ && length(data.aws_iam_policy_document.runner_runtime_logs.statement) == 1
+ && data.aws_iam_policy_document.runner_runtime_logs.statement[0].actions == toset(["logs:CreateLogStream", "logs:PutLogEvents"])
+ && data.aws_iam_policy_document.runner_runtime_logs.statement[0].resources == toset(["arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/microvm:*"])
+ )
+ error_message = "Managed MicroVM runners must receive exact lane configuration, metadata, JIT, native-runtime, and CloudWatch-agent permissions."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.provider.resources)) == toset(["execution_role_arn", "image_arn", "image_version", "logfiles", "runners_log_groups"])
+ && output.provider.resources.image_arn == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ && output.provider.resources.image_version == "3"
+ && output.provider.resources.execution_role_arn == "arn:aws:iam::123456789012:role/microvm-test-runner"
+ && length(output.provider.resources.runners_log_groups) == 4
+ && output.provider.resources.runners_log_groups[0].name == "/github-self-hosted-runners/microvm-test/microvm"
+ && toset(slice(output.provider.resources.runners_log_groups[*].name, 1, 4)) == toset([
+ "/github-self-hosted-runners/microvm-test/internal_service",
+ "/github-self-hosted-runners/microvm-test/run",
+ "/github-self-hosted-runners/microvm-test/runner",
+ ])
+ && output.provider.resources.logfiles == local.logfiles
+ )
+ error_message = "The MicroVM provider must expose its selected image, execution role, native runtime group, and CloudWatch-agent resources."
+ }
+
+ assert {
+ condition = (
+ aws_cloudwatch_log_group.runtime.name == "/github-self-hosted-runners/microvm-test/microvm"
+ && aws_cloudwatch_log_group.runtime.retention_in_days == 30
+ && aws_cloudwatch_log_group.runtime.kms_key_id == "arn:aws:kms:eu-west-1:123456789012:key/runtime-logs"
+ && aws_cloudwatch_log_group.runtime.log_group_class == "INFREQUENT_ACCESS"
+ && aws_cloudwatch_log_group.runtime.tags == tomap({
+ Name = "microvm-runtime-logs"
+ Module = "runner"
+ LogOnly = "runtime"
+ })
+ )
+ error_message = "The MicroVM provider must own its lane-scoped log group and apply the common observability lifecycle and tag scopes."
+ }
+
+ assert {
+ condition = (
+ aws_ssm_parameter.runner_enable_cloudwatch.name == "/github-action-runners/config/enable_cloudwatch"
+ && aws_ssm_parameter.runner_enable_cloudwatch.value == "true"
+ && length(aws_ssm_parameter.cloudwatch_agent_config_runner) == 1
+ && aws_ssm_parameter.cloudwatch_agent_config_runner[0].name == "/github-action-runners/config/cloudwatch_agent_config_runner"
+ && aws_ssm_parameter.runner_enable_cloudwatch.tags["Name"] == "parameter"
+ && aws_ssm_parameter.runner_enable_cloudwatch.tags["Module"] == "runner"
+ && aws_ssm_parameter.runner_enable_cloudwatch.tags["Ssm"] == "shared"
+ && aws_ssm_parameter.runner_enable_cloudwatch.tags["Parameter"] == "metadata"
+ && aws_ssm_parameter.runner_enable_cloudwatch.tags["Precedence"] == "parameter"
+ && aws_ssm_parameter.cloudwatch_agent_config_runner[0].tags == aws_ssm_parameter.runner_enable_cloudwatch.tags
+ )
+ error_message = "The MicroVM provider must publish the EC2-compatible CloudWatch enablement and agent-config parameters with standard SSM tag precedence."
+ }
+
+ assert {
+ condition = (
+ length(local.logfiles) == 3
+ && local.logfiles[0].file_path == "/var/log/microvm/internal-services.log"
+ && local.logfiles[0].log_group_name == "/github-self-hosted-runners/microvm-test/internal_service"
+ && local.logfiles[1].file_path == "/var/log/microvm/run.log"
+ && local.logfiles[1].log_group_name == "/github-self-hosted-runners/microvm-test/run"
+ && local.logfiles[2].file_path == "/opt/actions-runner/_diag/Runner_**.log"
+ && local.logfiles[2].log_group_name == "/github-self-hosted-runners/microvm-test/runner"
+ && alltrue([for log_file in local.logfiles : (
+ log_file.log_group_class == "STANDARD"
+ && log_file.log_stream_name == "{microvm_id}"
+ )])
+ && length(jsondecode(aws_ssm_parameter.cloudwatch_agent_config_runner[0].value).logs.logs_collected.files.collect_list) == 3
+ && toset(aws_cloudwatch_log_group.gh_runners[*].name) == toset(local.runner_log_group_names)
+ && alltrue([for log_group in aws_cloudwatch_log_group.gh_runners : (
+ log_group.retention_in_days == 30
+ && log_group.kms_key_id == "arn:aws:kms:eu-west-1:123456789012:key/runtime-logs"
+ && log_group.tags == aws_cloudwatch_log_group.runtime.tags
+ )])
+ )
+ error_message = "The default MicroVM agent configuration must route internal-service, run, and runner files to separately managed log groups."
+ }
+}
+
+run "normalizes_ssm_paths_and_arns" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-action-runners/"
+ tokens = "/tokens/"
+ config = "/config/"
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ output.provider.environment_variables.scale_up["MICROVM_METADATA_SSM_PATH"] == "/github-action-runners/config/microvm-metadata"
+ && output.provider.environment_variables.scale_up["SSM_TOKEN_PATH"] == "/github-action-runners/tokens"
+ && data.aws_iam_policy_document.scale_up.statement[6].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ && data.aws_iam_policy_document.scale_down.statement[4].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ && data.aws_iam_policy_document.runner_ssm_jit.statement[0].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ && data.aws_iam_policy_document.runner_metadata.statement[0].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/enable_cloudwatch",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*.tags",
+ ])
+ )
+ error_message = "The MicroVM provider must normalize SSM path segments before exposing hook values or IAM resources."
+ }
+}
+
+run "accepts_external_runner_role_and_policy_overrides" {
+ command = plan
+
+ variables {
+ runner = {
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external-microvm-runner"
+ name = "external-microvm-runner"
+ managed = false
+ }
+ }
+ }
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-override"
+ iam = {
+ resource_arns = {
+ images = ["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-*"]
+ }
+ additional_policy_json = {
+ scale_up = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ }
+ managed_policies = {
+ scale_up = {
+ arn = "arn:aws:iam::123456789012:policy/microvm-scale-up"
+ }
+ pool = {
+ arn = "arn:aws:iam::123456789012:policy/microvm-pool"
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ output.provider.environment_variables.scale_up["MICROVM_EXECUTION_ROLE_ARN"] == "arn:aws:iam::123456789012:role/external-microvm-runner"
+ && output.provider.environment_variables.scale_up["MICROVM_INGRESS_NETWORK_CONNECTORS"] == ""
+ && output.provider.environment_variables.scale_up["MICROVM_EGRESS_NETWORK_CONNECTORS"] == ""
+ && output.provider.environment_variables.scale_up["MICROVM_LOG_GROUP"] == "/github-self-hosted-runners/microvm-test/microvm"
+ && data.aws_iam_policy_document.scale_up.statement[0].resources == toset(["*"])
+ && data.aws_iam_policy_document.scale_up.statement[1].resources == toset(["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-*"])
+ && data.aws_iam_policy_document.scale_up.statement[2].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ && data.aws_iam_policy_document.scale_up.statement[3].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*",
+ ])
+ && data.aws_iam_policy_document.scale_up.statement[4].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ && data.aws_iam_policy_document.scale_up.statement[5].resources == toset(["arn:aws:iam::123456789012:role/external-microvm-runner"])
+ && data.aws_iam_policy_document.scale_up.statement[6].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ && data.aws_iam_policy_document.scale_down.statement[0].resources == toset(["*"])
+ && data.aws_iam_policy_document.scale_down.statement[1].resources == toset(["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-*"])
+ && data.aws_iam_policy_document.scale_down.statement[2].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*"])
+ && data.aws_iam_policy_document.scale_down.statement[3].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*",
+ ])
+ && data.aws_iam_policy_document.scale_down.statement[4].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
+ )
+ error_message = "The provider-neutral external runner role and image allowlist must reach their scoped statements without narrowing required list, connector, or metadata permissions."
+ }
+
+ assert {
+ condition = (
+ output.provider.policies.scale_up.additional_iam_policy_json == "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ && output.provider.policies.scale_up.managed_policy_enabled
+ && output.provider.policies.scale_up.managed_policy_arn == "arn:aws:iam::123456789012:policy/microvm-scale-up"
+ && output.provider.policies.pool.managed_policy_enabled
+ && output.provider.policies.pool.managed_policy_arn == "arn:aws:iam::123456789012:policy/microvm-pool"
+ )
+ error_message = "Optional MicroVM policy attachments must stay controlled by wrapper presence."
+ }
+
+
+ assert {
+ condition = (
+ toset(keys(output.provider.policies.runner.inline_policies)) == toset(["cloudwatch", "runner_metadata", "runtime_logs", "ssm_jit"])
+ && data.aws_iam_policy_document.runner_metadata.statement[0].resources == toset([
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/enable_cloudwatch",
+ "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/config/microvm-metadata/*.tags",
+ ])
+ && length(data.aws_iam_policy_document.runner_runtime_logs.statement) == 1
+ && data.aws_iam_policy_document.runner_runtime_logs.statement[0].resources == toset(["arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/microvm:*"])
+ )
+ error_message = "The provider contract must keep plan-known runner-policy keys and scope runtime logging to its provider-managed group."
+ }
+}
+
+run "disables_cloudwatch_agent_without_disabling_native_runtime_logging" {
+ command = apply
+
+ variables {
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ cloudwatch_agent = {
+ enabled = false
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ tostring(aws_ssm_parameter.runner_enable_cloudwatch.value) == "false"
+ && length(aws_ssm_parameter.cloudwatch_agent_config_runner) == 0
+ && length(aws_cloudwatch_log_group.gh_runners) == 0
+ && length(local.logfiles) == 0
+ && !contains(keys(output.provider.policies.runner.inline_policies), "cloudwatch")
+ && length(output.provider.resources.runners_log_groups) == 1
+ && output.provider.resources.runners_log_groups[0].name == aws_cloudwatch_log_group.runtime.name
+ && output.provider.environment_variables.scale_up["MICROVM_LOG_GROUP"] == aws_cloudwatch_log_group.runtime.name
+ )
+ error_message = "Disabling the image CloudWatch agent must retain the explicit false flag and native RunMicrovm logging while removing only agent-owned resources and permissions."
+ }
+}
+
+run "accepts_custom_cloudwatch_agent_config_and_log_group" {
+ command = apply
+
+ variables {
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ cloudwatch_agent = {
+ enabled = true
+ config = "{\"agent\":{\"region\":\"eu-west-1\"}}"
+ }
+ log_files = [{
+ log_group_name = "custom-microvm"
+ prefix_log_group = false
+ file_path = "/var/log/custom.log"
+ log_stream_name = "{microvm_id}/custom"
+ log_class = "INFREQUENT_ACCESS"
+ }]
+ }
+ }
+
+ assert {
+ condition = (
+ aws_ssm_parameter.cloudwatch_agent_config_runner[0].value == "{\"agent\":{\"region\":\"eu-west-1\"}}"
+ && length(local.logfiles) == 1
+ && local.logfiles[0].file_path == "/var/log/custom.log"
+ && local.logfiles[0].log_group_class == "INFREQUENT_ACCESS"
+ && local.logfiles[0].log_group_name == "/custom-microvm"
+ && local.logfiles[0].log_stream_name == "{microvm_id}/custom"
+ && aws_cloudwatch_log_group.gh_runners[0].name == "/custom-microvm"
+ && aws_cloudwatch_log_group.gh_runners[0].log_group_class == "INFREQUENT_ACCESS"
+ && data.aws_iam_policy_document.runner_cloudwatch[0].statement[1].resources == toset([
+ "arn:aws:logs:eu-west-1:123456789012:log-group:/custom-microvm:*",
+ ])
+ )
+ error_message = "Custom MicroVM agent configuration and log-file routing must replace the generated defaults without widening IAM."
+ }
+}
+
+run "rejects_invalid_image_arn" {
+ command = plan
+
+ variables {
+ config = {
+ image_arn = "not-a-microvm-image-arn"
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_metadata_path_overlapping_jit_path" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-action-runners"
+ tokens = "config/microvm-metadata"
+ config = "config"
+ }
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_invalid_metadata_path" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-action-runners"
+ tokens = "tokens"
+ config = "invalid config"
+ }
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_invalid_image_resource_allowlist" {
+ command = plan
+
+ variables {
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ iam = {
+ resource_arns = {
+ images = []
+ }
+ }
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_invalid_network_connector" {
+ command = plan
+
+ variables {
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ ingress_network_connectors = [
+ " ",
+ ]
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_more_than_ten_network_connectors" {
+ command = plan
+
+ variables {
+ config = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ egress_network_connectors = [
+ for index in range(11) :
+ "arn:aws:lambda:eu-west-1:123456789012:network-connector:egress-${index}"
+ ]
+ }
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_unsupported_runner_architecture" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "linux"
+ architecture = "x64"
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/microvm-test-runner"
+ name = "microvm-test-runner"
+ }
+ }
+ }
+ }
+
+ expect_failures = [terraform_data.validate_runner]
+}
+
+run "rejects_unsupported_runner_os" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "windows"
+ architecture = "arm64"
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/microvm-test-runner"
+ name = "microvm-test-runner"
+ }
+ }
+ }
+ }
+
+ expect_failures = [terraform_data.validate_runner]
+}
diff --git a/modules/compute-providers/aws/microvm/trust-policy/README.md b/modules/compute-providers/aws/microvm/trust-policy/README.md
new file mode 100644
index 0000000000..43302d1055
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/README.md
@@ -0,0 +1,41 @@
+# AWS Lambda MicroVM runner trust policy
+
+This internal submodule builds the MicroVM runner-role trust policy independently from the runtime module that consumes the role. It preserves the default Lambda service trust and optionally merges an additional IAM trust policy document supplied by the common runner configuration.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 1.4.0 |
+| [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 6.33 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| [additional\_trust\_policy\_json](#input\_additional\_trust\_policy\_json) | Optional IAM policy document merged with the MicroVM provider's default runner-role trust policy. | `string` | `null` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [assume\_role\_policy](#output\_assume\_role\_policy) | MicroVM runner-role trust policy including any additional trust statements. |
+
diff --git a/modules/compute-providers/aws/microvm/trust-policy/assume-role.tf b/modules/compute-providers/aws/microvm/trust-policy/assume-role.tf
new file mode 100644
index 0000000000..3654bce8bf
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/assume-role.tf
@@ -0,0 +1,21 @@
+data "aws_iam_policy_document" "default" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "sts:AssumeRole",
+ "sts:TagSession",
+ ]
+
+ principals {
+ type = "Service"
+ identifiers = ["lambda.amazonaws.com"]
+ }
+ }
+}
+
+data "aws_iam_policy_document" "assume_role" {
+ source_policy_documents = compact([
+ data.aws_iam_policy_document.default.json,
+ var.additional_trust_policy_json,
+ ])
+}
diff --git a/modules/compute-providers/aws/microvm/trust-policy/outputs.tf b/modules/compute-providers/aws/microvm/trust-policy/outputs.tf
new file mode 100644
index 0000000000..8564675873
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/outputs.tf
@@ -0,0 +1,4 @@
+output "assume_role_policy" {
+ description = "MicroVM runner-role trust policy including any additional trust statements."
+ value = data.aws_iam_policy_document.assume_role.json
+}
diff --git a/modules/compute-providers/aws/microvm/trust-policy/tests/trust-policy.tftest.hcl b/modules/compute-providers/aws/microvm/trust-policy/tests/trust-policy.tftest.hcl
new file mode 100644
index 0000000000..5f0173ebc1
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/tests/trust-policy.tftest.hcl
@@ -0,0 +1,59 @@
+mock_provider "aws" {
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{}"
+ }
+ }
+}
+
+run "returns_default_microvm_trust_policy" {
+ command = plan
+
+ assert {
+ condition = toset(data.aws_iam_policy_document.default.statement[0].actions) == toset(["sts:AssumeRole", "sts:TagSession"])
+ error_message = "The MicroVM runner role must allow assume-role and tagged sessions."
+ }
+
+ assert {
+ condition = anytrue([
+ for principal in data.aws_iam_policy_document.default.statement[0].principals :
+ principal.type == "Service" && toset(principal.identifiers) == toset(["lambda.amazonaws.com"])
+ ])
+ error_message = "The MicroVM runner role must trust the Lambda service principal required by the provider."
+ }
+
+ assert {
+ condition = (
+ length(data.aws_iam_policy_document.assume_role.source_policy_documents) == 1
+ && output.assume_role_policy == data.aws_iam_policy_document.assume_role.json
+ )
+ error_message = "The MicroVM trust-policy module must return the default trust document as assume_role_policy."
+ }
+}
+
+run "merges_additional_trust_policy" {
+ command = plan
+
+ variables {
+ additional_trust_policy_json = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"TrustDeploymentRole\",\"Effect\":\"Allow\",\"Action\":\"sts:AssumeRole\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:role/deployer\"}}]}"
+ }
+
+ assert {
+ condition = (
+ length(data.aws_iam_policy_document.assume_role.source_policy_documents) == 2
+ && contains(data.aws_iam_policy_document.assume_role.source_policy_documents, var.additional_trust_policy_json)
+ && output.assume_role_policy == data.aws_iam_policy_document.assume_role.json
+ )
+ error_message = "The MicroVM trust-policy module must merge and return the additional trust policy document."
+ }
+}
+
+run "rejects_invalid_additional_trust_policy" {
+ command = plan
+
+ variables {
+ additional_trust_policy_json = "{"
+ }
+
+ expect_failures = [var.additional_trust_policy_json]
+}
diff --git a/modules/compute-providers/aws/microvm/trust-policy/variables.tf b/modules/compute-providers/aws/microvm/trust-policy/variables.tf
new file mode 100644
index 0000000000..1af67309d2
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/variables.tf
@@ -0,0 +1,10 @@
+variable "additional_trust_policy_json" {
+ description = "Optional IAM policy document merged with the MicroVM provider's default runner-role trust policy."
+ type = string
+ default = null
+
+ validation {
+ condition = var.additional_trust_policy_json == null ? true : can(jsondecode(var.additional_trust_policy_json))
+ error_message = "additional_trust_policy_json must be valid JSON when set."
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/trust-policy/versions.tf b/modules/compute-providers/aws/microvm/trust-policy/versions.tf
new file mode 100644
index 0000000000..3ef011ea0a
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/trust-policy/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.4.0"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 6.33"
+ }
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/validations.tf b/modules/compute-providers/aws/microvm/validations.tf
new file mode 100644
index 0000000000..75c2aeb33b
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/validations.tf
@@ -0,0 +1,80 @@
+resource "terraform_data" "validate_config" {
+ lifecycle {
+ precondition {
+ condition = can(regex("^arn:[^:]+:lambda:[^:]+:[0-9]{12}:microvm-image:.+$", var.config.image_arn))
+ error_message = "compute_provider.aws.microvm.image_arn must be a Lambda MicroVM image ARN."
+ }
+
+ precondition {
+ condition = var.config.iam.resource_arns.images == null ? true : (
+ length(var.config.iam.resource_arns.images) > 0 &&
+ alltrue([
+ for image_arn in var.config.iam.resource_arns.images :
+ image_arn == "*" || can(regex("^arn:[^:]+:lambda:[^:]+:[0-9]{12}:microvm-image:.+$", image_arn))
+ ])
+ )
+ error_message = "compute_provider.aws.microvm.iam.resource_arns.images must be null or a non-empty list containing only * or Lambda MicroVM image ARN patterns."
+ }
+
+ precondition {
+ condition = (
+ length(var.config.ingress_network_connectors) <= 10 &&
+ alltrue([
+ for connector in var.config.ingress_network_connectors :
+ can(regex("^arn:[^:]+:lambda:[^:]+:([0-9]{12}|aws):network-connector:[^[:space:]]+$", connector))
+ ])
+ )
+ error_message = "compute_provider.aws.microvm.ingress_network_connectors must contain at most 10 Lambda network-connector ARNs."
+ }
+
+ precondition {
+ condition = (
+ length(var.config.egress_network_connectors) <= 10 &&
+ alltrue([
+ for connector in var.config.egress_network_connectors :
+ can(regex("^arn:[^:]+:lambda:[^:]+:([0-9]{12}|aws):network-connector:[^[:space:]]+$", connector))
+ ])
+ )
+ error_message = "compute_provider.aws.microvm.egress_network_connectors must contain at most 10 Lambda network-connector ARNs."
+ }
+
+ precondition {
+ condition = try(var.config.iam.additional_policy_json.scale_up, null) == null ? true : can(jsondecode(var.config.iam.additional_policy_json.scale_up))
+ error_message = "compute_provider.aws.microvm.iam.additional_policy_json.scale_up must be valid JSON when set."
+ }
+
+ precondition {
+ condition = !(
+ local.microvm_metadata_ssm_path == local.runner_jit_ssm_path ||
+ startswith(local.microvm_metadata_ssm_path, "${local.runner_jit_ssm_path}/") ||
+ startswith(local.runner_jit_ssm_path, "${local.microvm_metadata_ssm_path}/")
+ )
+ error_message = "The MicroVM metadata Parameter Store path must be separate from the runner JIT configuration path."
+ }
+
+ precondition {
+ condition = (
+ startswith(var.ssm.paths.root, "/") &&
+ trim(var.ssm.paths.root, "/") != "" &&
+ trim(var.ssm.paths.config, "/") != "" &&
+ can(regex("^/[A-Za-z0-9_./-]+$", local.microvm_metadata_ssm_path)) &&
+ !strcontains(local.microvm_metadata_ssm_path, "//")
+ )
+ error_message = "The derived MicroVM metadata Parameter Store path must be an absolute path containing only letters, numbers, dot, underscore, hyphen, and slash."
+ }
+ }
+}
+
+resource "terraform_data" "validate_runner" {
+ lifecycle {
+ precondition {
+ condition = var.runner.os == "linux" && var.runner.architecture == "arm64"
+ error_message = "Lambda MicroVM runners require runner.os = linux and runner.architecture = arm64."
+ }
+
+ precondition {
+ condition = length(var.runner.name_prefix) <= 45
+ error_message = "runner.name_prefix must be at most 45 characters."
+ }
+ }
+}
diff --git a/modules/compute-providers/aws/microvm/variables.tf b/modules/compute-providers/aws/microvm/variables.tf
new file mode 100644
index 0000000000..388b06135a
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/variables.tf
@@ -0,0 +1,195 @@
+# tflint-ignore: terraform_unused_declarations
+variable "aws_partition" {
+ description = "AWS partition used to construct IAM ARNs."
+ type = string
+ default = "aws"
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "aws_region" {
+ description = "AWS region used by compute-provider resources and policy documents."
+ type = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "prefix" {
+ description = "Prefix used to identify resources created for the runner configuration."
+ type = string
+ default = "github-actions"
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "tags" {
+ description = "Base tags available to taggable compute-provider resources. Provider-specific tags override this map within their documented scopes."
+ type = map(string)
+ default = {}
+}
+
+variable "config" {
+ description = <<-EOT
+ Lambda MicroVM compute-provider configuration. Paths match `compute_provider.aws.microvm` in runner-config.
+
+ - `image_arn`: ARN of the MicroVM image used to run GitHub runners.
+ - `image_version`: Optional MicroVM image version.
+ - `ingress_network_connectors`: Up to 10 Lambda network-connector ARNs passed to RunMicrovm.
+ - `egress_network_connectors`: Up to 10 Lambda network-connector ARNs passed to RunMicrovm.
+ - `cloudwatch_agent.enabled`: Enables the image CloudWatch agent through the shared runner configuration path.
+ - `cloudwatch_agent.config`: Optional complete CloudWatch agent configuration. Null renders the provider default from `log_files`. Custom log destinations must also be declared in `log_files` so Terraform creates their groups and IAM permissions.
+ - `log_files`: Optional files collected by the CloudWatch agent. Null uses the MicroVM defaults.
+ - `log_files[].log_group_name`: CloudWatch log-group name before optional prefixing.
+ - `log_files[].prefix_log_group`: Prefixes the log-group name with the runner configuration path.
+ - `log_files[].file_path`: File or glob read by the CloudWatch agent.
+ - `log_files[].log_stream_name`: Log-stream template. The image replaces `{microvm_id}` with the current MicroVM identifier.
+ - `log_files[].log_class`: CloudWatch log-group class for the collected file.
+ - `environment_variables`: Additional provider-specific Lambda environment variables merged into scale-up, scale-down, and pool.
+ - `iam.resource_arns.images`: Optional MicroVM image ARN allowlist for RunMicrovm and TerminateMicrovm. Null restricts both actions to `image_arn`; set an explicit list when dynamic image overrides are enabled. Provider-required list and connector permissions remain separately scoped to `*`.
+ - `iam.additional_policy_json.scale_up`: Optional additional provider policy attached separately to the scale-up Lambda role.
+ - `iam.managed_policies.scale_up`: Optional managed-policy wrapper attached to the scale-up Lambda role. Wrapper presence controls resource creation during planning.
+ - `iam.managed_policies.scale_up.arn`: ARN of the scale-up managed policy. The ARN may remain unknown until apply.
+ - `iam.managed_policies.pool`: Optional managed-policy wrapper attached to the pool Lambda role. Wrapper presence controls resource creation during planning.
+ - `iam.managed_policies.pool.arn`: ARN of the pool managed policy. The ARN may remain unknown until apply.
+ EOT
+
+ type = object({
+ image_arn = string
+ image_version = optional(string, null)
+ ingress_network_connectors = optional(list(string), [])
+ egress_network_connectors = optional(list(string), [])
+ cloudwatch_agent = optional(object({
+ enabled = optional(bool, true)
+ config = optional(string, null)
+ }), {})
+ log_files = optional(list(object({
+ log_group_name = string
+ prefix_log_group = bool
+ file_path = string
+ log_stream_name = string
+ log_class = optional(string, "STANDARD")
+ })), null)
+ environment_variables = optional(map(string), {})
+ iam = optional(object({
+ resource_arns = optional(object({
+ images = optional(list(string), null)
+ }), {})
+ additional_policy_json = optional(object({
+ scale_up = optional(string, null)
+ }), {})
+ managed_policies = optional(object({
+ scale_up = optional(object({
+ arn = string
+ }), null)
+ pool = optional(object({
+ arn = string
+ }), null)
+ }), {})
+ }), {})
+ })
+
+ nullable = false
+}
+
+variable "runner" {
+ description = <<-EOT
+ Resolved runner settings consumed by the Lambda MicroVM compute provider.
+
+ - `os`: Runner operating system. Lambda MicroVM requires `linux`.
+ - `architecture`: Runner distribution architecture. Lambda MicroVM requires `arm64`.
+ - `name_prefix`: Prefix added to registered runner names.
+ - `run_as_root`: Runs the runner service as root.
+ - `run_as`: Operating-system user used when `run_as_root` is false.
+ - `hooks.job_started`: Script installed as the runner job-started hook.
+ - `hooks.job_completed`: Script installed as the runner job-completed hook.
+ - `iam.role.arn`: Resolved runner-role ARN used as the MicroVM execution role and referenced by provider policies.
+ - `iam.role.name`: Resolved runner-role name used by provider resources.
+ - `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter` on the lane's `microvm-metadata/*.tags` and `enable_cloudwatch` parameters, `ssm:GetParameter` and `ssm:DeleteParameter` on the lane token path, plus `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group. When the CloudWatch agent is enabled, it also needs `ssm:GetParameter` on `cloudwatch_agent_config_runner` and stream access to the configured runner log groups.
+ - `iam.managed_policy_arns`: Common managed-policy ARNs returned with the provider-specific runner policies for attachment by runner-config.
+ - `iam.path`: IAM path available to provider-managed IAM resources. Null derives the path from `prefix`.
+ EOT
+ type = object({
+ os = optional(string, "linux")
+ architecture = optional(string, "arm64")
+ name_prefix = optional(string, "")
+ run_as_root = optional(bool, false)
+ run_as = optional(string, "ec2-user")
+ hooks = optional(object({
+ job_started = optional(string, "")
+ job_completed = optional(string, "")
+ }), {})
+ iam = object({
+ role = object({
+ arn = string
+ name = string
+ managed = optional(bool, true)
+ })
+ managed_policy_arns = optional(map(string), {})
+ path = optional(string, null)
+ })
+ })
+
+ nullable = false
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "github" {
+ description = <<-EOT
+ GitHub Enterprise Server settings available to compute-provider bootstrap data.
+
+ - `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.
+ - `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server.
+ EOT
+ type = object({
+ enterprise_server = optional(object({
+ url = optional(string, null)
+ ssl_verify = optional(bool, true)
+ }), {})
+ })
+ default = {}
+ nullable = false
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "ssm" {
+ description = <<-EOT
+ Parameter Store paths and tag scopes available to compute-provider bootstrap resources.
+
+ - `paths.root`: Root Parameter Store path for the runner configuration.
+ - `paths.tokens`: Path segment used for registration tokens and just-in-time configuration.
+ - `paths.config`: Path segment used for persistent runner and provider configuration. MicroVM control-plane metadata is stored under its `microvm-metadata` child prefix.
+ - `tags`: Shared SSM tags that override module-level `tags`.
+ - `parameters.tags`: Parameter-specific tags that override module-level and shared SSM tags.
+ EOT
+ type = object({
+ paths = object({
+ root = string
+ tokens = string
+ config = string
+ })
+ tags = optional(map(string), {})
+ parameters = optional(object({
+ tags = optional(map(string), {})
+ }), {})
+ })
+
+ nullable = false
+}
+
+variable "observability" {
+ description = <<-EOT
+ Provider-neutral observability settings applied to the provider-managed MicroVM runtime log group.
+
+ - `logs.retention_in_days`: CloudWatch Logs retention period.
+ - `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt the log group.
+ - `logs.class`: CloudWatch log-group class.
+ - `logs.tags`: Tags merged after module-level tags on the log group.
+ EOT
+ type = object({
+ logs = optional(object({
+ retention_in_days = optional(number, 180)
+ kms_key_id = optional(string, null)
+ class = optional(string, "STANDARD")
+ tags = optional(map(string), {})
+ }), {})
+ })
+ default = {}
+ nullable = false
+}
diff --git a/modules/compute-providers/aws/microvm/versions.tf b/modules/compute-providers/aws/microvm/versions.tf
new file mode 100644
index 0000000000..3ef011ea0a
--- /dev/null
+++ b/modules/compute-providers/aws/microvm/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.4.0"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 6.33"
+ }
+ }
+}