feat: support native SSM expiration policies for runner token parameters - #5265
Open
jvrplmlmn wants to merge 3 commits into
Open
feat: support native SSM expiration policies for runner token parameters#5265jvrplmlmn wants to merge 3 commits into
jvrplmlmn wants to merge 3 commits into
Conversation
Contributor
|
Nice idea. Just a small note, I am working ro refactor the module to make easier to maintain and add new features. @Brend-Smits @npalm @guicaulada what do you think? |
Contributor
|
@jvrplmlmn would mind rebasing and fixing conflicts on this one :) |
guicaulada
force-pushed
the
jvrplmlmn/ssm-token-ttl-expiration-policy
branch
from
September 8, 2026 13:11
1dd5618 to
c99bf0a
Compare
guicaulada
marked this pull request as ready for review
September 8, 2026 13:36
guicaulada
force-pushed
the
jvrplmlmn/ssm-token-ttl-expiration-policy
branch
3 times, most recently
from
September 8, 2026 18:51
9a0fbe6 to
1b78804
Compare
Registration tokens and JIT configs written to SSM are orphaned when an instance fails to boot or is terminated before registering. The only cleanup today is the scheduled SSM housekeeper lambda, which cannot delete parameters younger than a day, so orphaned parameters (billed hourly when on the Advanced tier) can live for up to ~2 days. The new opt-in `ssm_token_ttl_seconds` attaches a native SSM Expiration policy to the token / JIT config parameters so SSM deletes leftovers itself once the TTL passes. Parameter policies require the Advanced tier, which incurs additional cost per parameter, hence disabled by default. Expiration is enforced asynchronously by SSM and is a cleanup mechanism rather than a security boundary; the housekeeper lambda remains as a backstop.
guicaulada
force-pushed
the
jvrplmlmn/ssm-token-ttl-expiration-policy
branch
from
September 9, 2026 16:20
1b78804 to
3ecca00
Compare
| }), {}) | ||
|
|
||
| ssm = optional(object({ | ||
| token_ttl_seconds = optional(number, null) |
Contributor
There was a problem hiding this comment.
Here I would use ttl_seconds.tokens. This way opens space for extend ttl for other configs in the future
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Registration tokens and JIT configs written to SSM are orphaned when an instance fails to boot or is terminated before registering. The only cleanup today is the scheduled SSM housekeeper lambda, which cannot delete parameters younger than a day, so orphaned parameters (billed hourly when on the Advanced tier) can live for up to ~2 days.
The new opt-in
ssm_token_ttl_secondsattaches a native SSM Expiration policy to the token / JIT config parameters so SSM deletes leftovers itself once the TTL passes. Parameter policies require the Advanced tier, which incurs additional cost per parameter, hence disabled by default. Expiration is enforced asynchronously by SSM and is a cleanup mechanism rather than a security boundary; the housekeeper lambda remains as a backstop.Test Plan
Related Issues