feat(compute-providers): add AWS EC2 provider modules - #5343
Open
edersonbrilhante wants to merge 3 commits into
Open
feat(compute-providers): add AWS EC2 provider modules#5343edersonbrilhante wants to merge 3 commits into
edersonbrilhante wants to merge 3 commits into
Conversation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
edersonbrilhante
force-pushed
the
refactor-compute-provider-modules
branch
from
September 3, 2026 20:14
bf422c7 to
9d01b81
Compare
edersonbrilhante
force-pushed
the
refactor-compute-provider-modules
branch
3 times, most recently
from
September 3, 2026 21:51
6c1cb2e to
ef7ef08
Compare
edersonbrilhante
force-pushed
the
refactor-compute-provider-modules
branch
from
September 4, 2026 17:59
ef7ef08 to
8375dad
Compare
edersonbrilhante
force-pushed
the
refactor-compute-provider-modules
branch
from
September 7, 2026 15:00
8375dad to
938612c
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Bootstrap failures, incorrect CloudWatch permissions, and overly broad termination grants must be addressed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds the internal AWS EC2 compute-provider module and its provider contract.
Changes:
- Adds EC2 resources, IAM policies, validation, logging, and bootstrap configuration.
- Adds Linux, Windows, and macOS runner templates.
- Adds trust-policy support and Terraform tests.
File summaries
| File | Description |
|---|---|
modules/compute-providers/aws/ec2/versions.tf |
Defines provider requirements. |
modules/compute-providers/aws/ec2/variables.tf |
Defines module inputs. |
modules/compute-providers/aws/ec2/validations.tf |
Validates provider configuration. |
modules/compute-providers/aws/ec2/trust-policy/versions.tf |
Defines trust-module requirements. |
modules/compute-providers/aws/ec2/trust-policy/variables.tf |
Defines trust-policy input. |
modules/compute-providers/aws/ec2/trust-policy/validations.tf |
Validates additional policy JSON. |
modules/compute-providers/aws/ec2/trust-policy/tests/trust-policy.tftest.hcl |
Tests trust-policy behavior. |
modules/compute-providers/aws/ec2/trust-policy/README.md |
Documents the trust module. |
modules/compute-providers/aws/ec2/trust-policy/outputs.tf |
Exports the merged policy. |
modules/compute-providers/aws/ec2/trust-policy/assume-role.tf |
Builds EC2 trust policies. |
modules/compute-providers/aws/ec2/tests/provider.tftest.hcl |
Tests the provider contract. |
modules/compute-providers/aws/ec2/templates/user-data.sh |
Bootstraps Linux runners. |
modules/compute-providers/aws/ec2/templates/user-data.ps1 |
Bootstraps Windows runners. |
modules/compute-providers/aws/ec2/templates/user-data-osx.sh |
Bootstraps macOS runners. |
modules/compute-providers/aws/ec2/templates/start-runner.sh |
Starts Linux runners. |
modules/compute-providers/aws/ec2/templates/start-runner.ps1 |
Starts Windows runners. |
modules/compute-providers/aws/ec2/templates/start-runner-osx.sh |
Starts macOS runners. |
modules/compute-providers/aws/ec2/templates/install-runner.sh |
Installs Linux runner binaries. |
modules/compute-providers/aws/ec2/templates/install-runner.ps1 |
Installs Windows runner binaries. |
modules/compute-providers/aws/ec2/templates/install-runner-osx.sh |
Installs macOS runner binaries. |
modules/compute-providers/aws/ec2/templates/cloudwatch_config.json |
Defines CloudWatch collection. |
modules/compute-providers/aws/ec2/runner-instances.tf |
Creates EC2 runner resources. |
modules/compute-providers/aws/ec2/runner-config.tf |
Stores bootstrap configuration. |
modules/compute-providers/aws/ec2/README.md |
Documents the provider module. |
modules/compute-providers/aws/ec2/provider-contract.tf |
Assembles the provider contract. |
modules/compute-providers/aws/ec2/policies-runner.tf |
Defines runner permissions. |
modules/compute-providers/aws/ec2/outputs.tf |
Exports provider artifacts. |
modules/compute-providers/aws/ec2/logging.tf |
Creates logging resources. |
modules/compute-providers/aws/ec2/instance-profile.tf |
Creates the instance profile. |
modules/compute-providers/aws/ec2/control-plane.tf |
Defines control-plane integration. |
Review details
Suppressed comments (2)
modules/compute-providers/aws/ec2/templates/user-data.sh:40
- With the
-eshebang, a failed upgrade terminates user data at this command, so the retry branch is unreachable. Test the command as theifcondition instead.
dnf upgrade-minimal -y
modules/compute-providers/aws/ec2/control-plane.tf:115
- This standalone legacy-tag statement grants terminate and tag operations across all runner configurations; the later
ghr:environmentstatement is an alternative grant, not an additional restriction. Scope this statement by environment or remove it so one lane's scale-down role cannot modify runners belonging to another lane.
condition {
test = "StringEquals"
variable = "ec2:ResourceTag/ghr:Application"
values = ["github-action-runner"]
}
- Files reviewed: 30/30 changed files
- Comments generated: 11
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+41
to
+45
| condition { | ||
| test = "StringEquals" | ||
| variable = "ec2:ResourceTag/ghr:Application" | ||
| values = ["github-action-runner"] | ||
| } |
Comment on lines
+29
to
+31
| precondition { | ||
| condition = !var.config.binaries_syncer.enabled || var.config.binaries_syncer.s3 != null | ||
| error_message = "compute_provider.aws.ec2.binaries_syncer.s3 must be set when compute_provider.aws.ec2.binaries_syncer.enabled is true." |
Comment on lines
+160
to
+164
| statement { | ||
| effect = "Allow" | ||
| actions = ["ssm:GetParameter"] | ||
| resources = ["${local.cloudwatch_config_arn}/*"] | ||
| } |
| ) | ||
| } | ||
|
|
||
| data "aws_ami" "runner" { |
Comment on lines
+7
to
+10
| s3_location=${S3_LOCATION_RUNNER_DISTRIBUTION} | ||
| architecture=${RUNNER_ARCHITECTURE} | ||
|
|
||
| if [ -z "$RUNNER_TARBALL_URL" ] && [ -z "$s3_location" ]; then |
Comment on lines
+80
to
+85
| environment=$(curl -f -H "X-aws-ec2-metadata-token: $token" \ | ||
| http://169.254.169.254/latest/meta-data/tags/instance/ghr:environment || echo "") | ||
| ssm_config_path=$(curl -f -H "X-aws-ec2-metadata-token: $token" \ | ||
| http://169.254.169.254/latest/meta-data/tags/instance/ghr:ssm_config_path || echo "") | ||
| runner_name_prefix=$(curl -f -H "X-aws-ec2-metadata-token: $token" \ | ||
| http://169.254.169.254/latest/meta-data/tags/instance/ghr:runner_name_prefix || echo "") |
Comment on lines
+91
to
+94
| parameters=$(aws ssm get-parameters-by-path \ | ||
| --path "$ssm_config_path" \ | ||
| --region "$region" \ | ||
| --query "Parameters[*].{Name:Name,Value:Value}") |
| } | ||
| Write-Host "Runner has finished" | ||
|
|
||
| if ($enable_cloudwatch_agent) |
Comment on lines
+42
to
+44
| ${install_runner} | ||
| ${post_install} | ||
| ${start_runner} |
Comment on lines
+9
to
+16
| dnf install -y $* | ||
| if [ $? -eq 0 ]; then | ||
| success=true | ||
| else | ||
| echo "Failed to install $1 - retrying" | ||
| attempt_count=$(( attempt_count + 1 )) | ||
| sleep 5 | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the internal AWS EC2 compute-provider module used by provider-oriented runner configuration. It owns the EC2 launch template, runner security group, instance profile or external-profile integration, AMI selection, bootstrap SSM parameters, runner log groups, and EC2-specific IAM policy documents for runner creation, scale-up, scale-down, and pool operations.
The module returns a nested provider contract containing EC2 Lambda environment variables, policy fragments, launch-template/log-group resources, and runner file metadata for
runner-configto consume. It validates supported runner operating systems, name-prefix limits, instance allocation settings, binary-sync prerequisites, and incompatible external IAM selections while leaving common runner roles and orchestration resources to the parent modules.Test Plan
terraform testcould not complete in this environment because the downloaded AWS provider failed its plugin handshake on macOS arm64.Related Issues
Depends on #5342
Part of the three-PR provider-boundary split from #5251.