= { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."
}
redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
} | map(object({
# V1 contract
runner_config = optional(object({
runner_os = string
runner_architecture = string
runner_metadata_options = optional(map(any), {
instance_metadata_tags = "enabled"
http_endpoint = "enabled"
http_tokens = "required"
http_put_response_hop_limit = 1
})
ami = optional(object({
filter = optional(map(list(string)), { state = ["available"] })
owners = optional(list(string), ["amazon"])
id_ssm_parameter_arn = optional(string, null)
kms_key_arn = optional(string, null)
}), null)
create_service_linked_role_spot = optional(bool, false)
credit_specification = optional(string, null)
delay_webhook_event = optional(number, 30)
disable_runner_autoupdate = optional(bool, false)
ebs_optimized = optional(bool, false)
enable_ephemeral_runners = optional(bool, false)
enable_job_queued_check = optional(bool, null)
enable_on_demand_failover_for_errors = optional(list(string), [])
scale_errors = optional(list(string), [
"UnfulfillableCapacity",
"MaxSpotInstanceCountExceeded",
"TargetCapacityLimitExceededException",
"RequestLimitExceeded",
"ResourceLimitExceeded",
"MaxSpotInstanceCountExceeded",
"MaxSpotFleetRequestCountExceeded",
"InsufficientInstanceCapacity",
"InsufficientCapacityOnHost",
])
enable_organization_runners = optional(bool, false)
enable_runner_binaries_syncer = optional(bool, true)
enable_ssm_on_runners = optional(bool, false)
enable_userdata = optional(bool, true)
instance_allocation_strategy = optional(string, "lowest-price")
instance_type_priorities = optional(map(number), null)
instance_max_spot_price = optional(string, null)
instance_target_capacity_type = optional(string, "spot")
instance_types = list(string)
job_queue_retention_in_seconds = optional(number, 86400)
minimum_running_time_in_minutes = optional(number, null)
pool_runner_owner = optional(string, null)
runner_as_root = optional(bool, false)
runner_boot_time_in_minutes = optional(number, 5)
runner_disable_default_labels = optional(bool, false)
runner_extra_labels = optional(list(string), [])
runner_group_name = optional(string, "Default")
runner_name_prefix = optional(string, "")
runner_run_as = optional(string, "ec2-user")
runners_maximum_count = number
runner_additional_security_group_ids = optional(list(string), [])
scale_down_schedule_expression = optional(string, "cron(*/5 * * * ? *)")
scale_up_reserved_concurrent_executions = optional(number, 1)
lambda_event_source_mapping_batch_size = optional(number, null)
lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)
userdata_template = optional(string, null)
userdata_content = optional(string, null)
enable_jit_config = optional(bool, null)
enable_runner_detailed_monitoring = optional(bool, false)
enable_cloudwatch_agent = optional(bool, true)
cloudwatch_config = optional(string, null)
userdata_pre_install = optional(string, "")
userdata_post_install = optional(string, "")
runner_hook_job_started = optional(string, "")
runner_hook_job_completed = optional(string, "")
runner_ec2_tags = optional(map(string), {})
runner_iam_role_managed_policy_arns = optional(list(string), [])
vpc_id = optional(string, null)
subnet_ids = optional(list(string), null)
idle_config = optional(list(object({
cron = string
timeZone = string
idleCount = number
evictionStrategy = optional(string, "oldest_first")
})), [])
cpu_options = optional(object({
core_count = optional(number)
threads_per_core = optional(number)
amd_sev_snp = optional(string)
nested_virtualization = optional(string)
}), null)
placement = optional(object({
affinity = optional(string)
availability_zone = optional(string)
group_id = optional(string)
group_name = optional(string)
host_id = optional(string)
host_resource_group_arn = optional(string)
spread_domain = optional(string)
tenancy = optional(string)
partition_number = optional(number)
}), null)
license_specifications = optional(list(object({
license_configuration_arn = string
})), [])
use_dedicated_host = optional(bool, false)
runner_log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
block_device_mappings = optional(list(object({
delete_on_termination = optional(bool, true)
device_name = optional(string, "/dev/xvda")
encrypted = optional(bool, true)
iops = optional(number)
kms_key_id = optional(string)
snapshot_id = optional(string)
throughput = optional(number)
volume_initialization_rate = optional(number)
volume_size = number
volume_type = optional(string, "gp3")
})), [{
volume_size = 30
}])
pool_config = optional(list(object({
schedule_expression = string
schedule_expression_timezone = optional(string)
size = number
})), [])
job_retry = optional(object({
enable = optional(bool, false)
delay_in_seconds = optional(number, 300)
delay_backoff = optional(number, 2)
lambda_memory_size = optional(number, 256)
lambda_timeout = optional(number, 30)
max_attempts = optional(number, 1)
}), {})
iam_overrides = optional(object({
override_instance_profile = optional(bool, null)
instance_profile_name = optional(string, null)
override_runner_role = optional(bool, null)
runner_role_arn = optional(string, null)
}), {
override_instance_profile = false
instance_profile_name = null
override_runner_role = false
runner_role_arn = null
})
}), null)
matcherConfig = optional(object({
labelMatchers = list(list(string))
exactMatch = optional(bool, false)
bidirectionalLabelMatch = optional(bool, false)
priority = optional(number, 999)
enableDynamicLabels = optional(bool, false)
awsDynamicLabelsPolicy = optional(any, null)
}), null)
redrive_build_queue = optional(object({
enabled = bool
maxReceiveCount = number
}), {
enabled = false
maxReceiveCount = null
})
# V2 Contract
tags = optional(map(string), {})
runner = optional(object({
os = optional(string, null)
architecture = optional(string, null)
disable_default_labels = optional(bool, null)
extra_labels = optional(list(string), null)
group_name = optional(string, null)
name_prefix = optional(string, null)
run_as_root = optional(bool, null)
run_as = optional(string, null)
auto_update_disabled = optional(bool, null)
tags = optional(map(string), {})
hooks = optional(object({
job_started = optional(string, null)
job_completed = optional(string, null)
}), {})
iam = optional(object({
role = optional(object({
arn = string
}), null)
managed_policy_arns = optional(map(string), null)
additional_trust_policy_json = optional(string, null)
path = optional(string, null)
permissions_boundary = optional(string, null)
}), {})
}), {})
lambda = optional(object({
runtime = optional(string, null)
architecture = optional(string, null)
subnet_ids = optional(list(string), null)
security_group_ids = optional(list(string), null)
tags = optional(map(string), {})
role = optional(object({
path = optional(string, null)
permissions_boundary = optional(string, null)
}), {})
}), {})
orchestration_provider = optional(object({
webhook = optional(object({
runner = optional(object({
boot_time_in_minutes = optional(number, null)
ephemeral = optional(bool, null)
jit_config_enabled = optional(bool, null)
maximum_count = optional(number, null)
}), {})
github = optional(object({
organization_runners = optional(bool, false)
}), {})
matcherConfig = optional(object({
labelMatchers = list(list(string))
exactMatch = optional(bool, false)
bidirectionalLabelMatch = optional(bool, false)
priority = optional(number, 999)
dynamic_labels_enabled = optional(bool, false)
awsDynamicLabelsPolicy = optional(object({
blocked_keys = optional(list(string), [])
restricted_keys = optional(map(object({
allowed = optional(list(string), [])
denied = optional(list(string), [])
max = optional(string, null)
})), {})
}), null)
}), null)
queue = optional(object({
delay_webhook_event = optional(number, null)
job_queue_retention_in_seconds = optional(number, null)
visibility_timeout_seconds = optional(number, null)
redrive_build_queue = optional(object({
enabled = optional(bool, null)
maxReceiveCount = optional(number, null)
}), null)
tags = optional(map(string), {})
}), {})
lambda = optional(object({
scale = optional(object({
up = optional(object({
memory_size = optional(number, null)
timeout = optional(number, null)
reserved_concurrent_executions = optional(number, null)
job_queued_check_enabled = optional(bool, null)
event_source_mapping = optional(object({
batch_size = optional(number, null)
maximum_batching_window_in_seconds = optional(number, null)
}), {})
tags = optional(map(string), {})
}), {})
down = optional(object({
memory_size = optional(number, null)
timeout = optional(number, null)
schedule_expression = optional(string, null)
minimum_running_time_in_minutes = optional(number, null)
idle_config = optional(list(object({
cron = string
timeZone = string
idleCount = number
evictionStrategy = optional(string, "oldest_first")
})), null)
tags = optional(map(string), {})
}), {})
}), {})
pool = optional(object({
memory_size = optional(number, null)
timeout = optional(number, null)
reserved_concurrent_executions = optional(number, null)
config = optional(list(object({
schedule_expression = string
schedule_expression_timezone = optional(string)
size = number
})), null)
include_busy_runners = optional(bool, null)
runner_owner = optional(string, null)
tags = optional(map(string), {})
}), {})
}), {})
job_retry = optional(object({
enabled = optional(bool, false)
delay_in_seconds = optional(number, 300)
delay_backoff = optional(number, 2)
max_attempts = optional(number, 1)
tags = optional(map(string), {})
lambda = optional(object({
memory_size = optional(number, 256)
reserved_concurrent_executions = optional(number, 1)
timeout = optional(number, 30)
}), {})
}), {})
}), null)
}), {})
ssm = optional(object({
paths = optional(object({
root = optional(string, null)
tokens = optional(string, null)
config = optional(string, null)
}), {})
tags = optional(map(string), {})
parameters = optional(object({
tags = optional(map(string), {})
}), {})
housekeeper = optional(object({
schedule_expression = optional(string, null)
state = optional(string, null)
tags = optional(map(string), {})
lambda = optional(object({
artifact = optional(object({
zip = optional(string, null)
s3 = optional(object({
key = string
object_version = optional(string, null)
}), null)
}), {})
memory_size = optional(number, null)
timeout = optional(number, null)
}), {})
config = optional(object({
tokenPath = optional(string, null)
minimumDaysOld = optional(number, null)
dryRun = optional(bool, null)
}), {})
}), {})
}), {})
observability = optional(object({
logs = optional(object({
level = optional(string, null)
retention_in_days = optional(number, null)
kms_key_id = optional(string, null)
class = optional(string, null)
tags = optional(map(string), {})
}), {})
tracing = optional(object({
mode = optional(string, null)
capture_http_requests = optional(bool, null)
capture_error = optional(bool, null)
}), {})
metrics = optional(object({
enabled = optional(bool, null)
namespace = optional(string, null)
metric = optional(object({
github_app_rate_limit = optional(object({
enabled = optional(bool, null)
}), {})
job_retry = optional(object({
enabled = optional(bool, null)
}), {})
spot_termination_warning = optional(object({
enabled = optional(bool, null)
}), {})
}), {})
}), {})
}), {})
compute_provider = optional(object({
aws = optional(object({
ec2 = optional(object({
metadata_options = optional(object({
instance_metadata_tags = optional(string, "enabled")
http_endpoint = optional(string, "enabled")
http_tokens = optional(string, "required")
http_put_response_hop_limit = optional(number, 1)
}), {})
ami = optional(object({
filter = optional(map(list(string)), { state = ["available"] })
owners = optional(list(string), ["amazon"])
id_ssm_parameter = optional(object({
arn = string
}), null)
kms_key = optional(object({
arn = string
}), null)
}), null)
block_device_mappings = optional(list(object({
delete_on_termination = optional(bool, true)
device_name = optional(string, "/dev/xvda")
encrypted = optional(bool, true)
iops = optional(number)
kms_key_id = optional(string)
snapshot_id = optional(string)
throughput = optional(number)
volume_initialization_rate = optional(number)
volume_size = number
volume_type = optional(string, "gp3")
})), [{ volume_size = 30 }])
create_service_linked_role_spot = optional(bool, false)
credit_specification = optional(string, null)
ebs_optimized = optional(bool, false)
cloudwatch_agent = optional(object({
enabled = optional(bool, true)
config = optional(string, null)
}), {})
binaries_syncer = optional(object({
enabled = optional(bool, null)
}), {})
detailed_monitoring_enabled = optional(bool, false)
ssm_enabled = optional(bool, false)
user_data = optional(object({
enabled = optional(bool, true)
template = optional(string, null)
content = optional(string, null)
pre_install = optional(string, "")
post_install = optional(string, "")
debug_logging_enabled = optional(bool, false)
}), {})
instance_allocation_strategy = optional(string, "lowest-price")
instance_max_spot_price = optional(string, null)
instance_target_capacity_type = optional(string, "spot")
instance_type_priorities = optional(map(number), null)
instance_types = optional(list(string), [])
additional_security_group_ids = optional(list(string), null)
managed_security_group_enabled = optional(bool, null)
egress_rules = optional(list(object({
cidr_blocks = list(string)
ipv6_cidr_blocks = list(string)
prefix_list_ids = list(string)
from_port = number
protocol = string
security_groups = list(string)
self = bool
to_port = number
description = string
})), null)
instance_profile_path = optional(string, null)
key_name = optional(string, null)
associate_public_ipv4_address = optional(bool, null)
instance_profile = optional(object({
name = string
}), null)
on_demand_failover_for_errors = optional(list(string), [])
scale_errors = optional(list(string), [
"UnfulfillableCapacity",
"MaxSpotInstanceCountExceeded",
"TargetCapacityLimitExceededException",
"RequestLimitExceeded",
"ResourceLimitExceeded",
"MaxSpotInstanceCountExceeded",
"MaxSpotFleetRequestCountExceeded",
"InsufficientInstanceCapacity",
"InsufficientCapacityOnHost",
])
subnet_ids = optional(list(string), null)
vpc_id = optional(string, null)
cpu_options = optional(object({
core_count = optional(number)
threads_per_core = optional(number)
amd_sev_snp = optional(string)
nested_virtualization = optional(string)
}), null)
placement = optional(object({
affinity = optional(string)
availability_zone = optional(string)
group_id = optional(string)
group_name = optional(string)
host_id = optional(string)
host_resource_group_arn = optional(string)
spread_domain = optional(string)
tenancy = optional(string)
partition_number = optional(number)
}), null)
license_specifications = optional(list(object({
license_configuration_arn = string
})), [])
use_dedicated_host = optional(bool, false)
log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
tags = optional(map(string), {})
}), null)
microvm = optional(object({
image_arn = optional(string, null)
image_version = optional(string, null)
ingress_network_connectors = optional(list(string), null)
egress_network_connectors = optional(list(string), null)
cloudwatch_agent = optional(object({
enabled = optional(bool, null)
config = optional(string, null)
}), {})
log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
environment_variables = optional(map(string), {})
iam = optional(object({
resource_arns = optional(object({
images = optional(list(string), null)
}), {})
additional_policy_json = optional(object({
scale_up = optional(string, null)
}), {})
managed_policies = optional(object({
scale_up = optional(object({
arn = string
}), null)
pool = optional(object({
arn = string
}), null)
}), {})
}), {})
}), null)
}), {})
}), {})
})) | `{}` | no |
| [parameter\_store\_tags](#input\_parameter\_store\_tags) | Map of tags that will be added to all the SSM Parameter Store parameters created by the Lambda function. | `map(string)` | `{}` | no |
| [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions) | Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | `1` | no |
| [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout) | Time out for the pool lambda in seconds. | `number` | `60` | no |
@@ -248,13 +218,13 @@ multi_runner_config = {
| [scale\_up\_lambda\_memory\_size](#input\_scale\_up\_lambda\_memory\_size) | Memory size limit in MB for scale\_up lambda. | `number` | `512` | no |
| [ssm\_paths](#input\_ssm\_paths) | The root path used in SSM to store configuration and secrets. | object({
root = optional(string, "github-action-runners")
app = optional(string, "app")
runners = optional(string, "runners")
webhook = optional(string, "webhook")
}) | `{}` | no |
| [state\_event\_rule\_binaries\_syncer](#input\_state\_event\_rule\_binaries\_syncer) | Option to disable EventBridge Lambda trigger for the binary syncer, useful to stop automatic updates of binary distribution | `string` | `"ENABLED"` | no |
-| [subnet\_ids](#input\_subnet\_ids) | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | n/a | yes |
+| [subnet\_ids](#input\_subnet\_ids) | List of subnets in which stable v1 action runners will be launched. Omit when using the experimental v2 interface. | `list(string)` | `null` | no |
| [syncer\_lambda\_s3\_key](#input\_syncer\_lambda\_s3\_key) | S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas. | `string` | `null` | no |
| [syncer\_lambda\_s3\_object\_version](#input\_syncer\_lambda\_s3\_object\_version) | S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket. | `string` | `null` | no |
| [tags](#input\_tags) | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no |
| [tracing\_config](#input\_tracing\_config) | Configuration for lambda tracing. | object({
mode = optional(string, null)
capture_http_requests = optional(bool, false)
capture_error = optional(bool, false)
}) | `{}` | no |
| [user\_agent](#input\_user\_agent) | User agent used for API calls by lambda functions. | `string` | `"github-aws-runners"` | no |
-| [vpc\_id](#input\_vpc\_id) | The VPC for security groups of the action runners. | `string` | n/a | yes |
+| [vpc\_id](#input\_vpc\_id) | The VPC for security groups of stable v1 action runners. Omit when using the experimental v2 interface. | `string` | `null` | no |
| [webhook\_lambda\_apigateway\_access\_log\_settings](#input\_webhook\_lambda\_apigateway\_access\_log\_settings) | Access log settings for webhook API gateway. | object({
destination_arn = string
format = string
}) | `null` | no |
| [webhook\_lambda\_memory\_size](#input\_webhook\_lambda\_memory\_size) | Memory size limit in MB for webhook lambda. | `number` | `256` | no |
| [webhook\_lambda\_s3\_key](#input\_webhook\_lambda\_s3\_key) | S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. | `string` | `null` | no |
@@ -270,6 +240,7 @@ multi_runner_config = {
| [instance\_termination\_handler](#output\_instance\_termination\_handler) | n/a |
| [instance\_termination\_watcher](#output\_instance\_termination\_watcher) | n/a |
| [runners\_map](#output\_runners\_map) | n/a |
+| [runners\_map\_v2](#output\_runners\_map\_v2) | n/a |
| [ssm\_parameters](#output\_ssm\_parameters) | n/a |
| [webhook](#output\_webhook) | n/a |
diff --git a/modules/multi-runner/config.experimental.resolved.tf b/modules/multi-runner/config.experimental.resolved.tf
index b7e2e26ab0..ac6f482970 100644
--- a/modules/multi-runner/config.experimental.resolved.tf
+++ b/modules/multi-runner/config.experimental.resolved.tf
@@ -480,6 +480,54 @@ locals {
}
tags = merge(local.normalized_config.compute_provider.aws.ec2.tags, v.compute_provider.aws.ec2.tags)
})
+ microvm = v.compute_provider.aws.microvm == null ? null : merge(v.compute_provider.aws.microvm, {
+ image_arn = try(coalesce(v.compute_provider.aws.microvm.image_arn, local.normalized_config.compute_provider.aws.microvm.image_arn), null)
+ image_version = try(coalesce(v.compute_provider.aws.microvm.image_version, local.normalized_config.compute_provider.aws.microvm.image_version), null)
+ ingress_network_connectors = v.compute_provider.aws.microvm.ingress_network_connectors != null ? (
+ v.compute_provider.aws.microvm.ingress_network_connectors
+ ) : local.normalized_config.compute_provider.aws.microvm.ingress_network_connectors
+ egress_network_connectors = v.compute_provider.aws.microvm.egress_network_connectors != null ? (
+ v.compute_provider.aws.microvm.egress_network_connectors
+ ) : local.normalized_config.compute_provider.aws.microvm.egress_network_connectors
+ cloudwatch_agent = {
+ enabled = coalesce(
+ v.compute_provider.aws.microvm.cloudwatch_agent.enabled,
+ local.normalized_config.compute_provider.aws.microvm.cloudwatch_agent.enabled,
+ )
+ config = try(coalesce(
+ v.compute_provider.aws.microvm.cloudwatch_agent.config,
+ local.normalized_config.compute_provider.aws.microvm.cloudwatch_agent.config,
+ ), null)
+ }
+ log_files = v.compute_provider.aws.microvm.log_files != null ? (
+ v.compute_provider.aws.microvm.log_files
+ ) : local.normalized_config.compute_provider.aws.microvm.log_files
+ environment_variables = merge(
+ local.normalized_config.compute_provider.aws.microvm.environment_variables,
+ v.compute_provider.aws.microvm.environment_variables,
+ )
+ iam = {
+ resource_arns = {
+ images = v.compute_provider.aws.microvm.iam.resource_arns.images != null ? (
+ v.compute_provider.aws.microvm.iam.resource_arns.images
+ ) : local.normalized_config.compute_provider.aws.microvm.iam.resource_arns.images
+ }
+ additional_policy_json = {
+ scale_up = try(coalesce(
+ v.compute_provider.aws.microvm.iam.additional_policy_json.scale_up,
+ local.normalized_config.compute_provider.aws.microvm.iam.additional_policy_json.scale_up,
+ ), null)
+ }
+ managed_policies = {
+ scale_up = v.compute_provider.aws.microvm.iam.managed_policies.scale_up != null ? (
+ v.compute_provider.aws.microvm.iam.managed_policies.scale_up
+ ) : local.normalized_config.compute_provider.aws.microvm.iam.managed_policies.scale_up
+ pool = v.compute_provider.aws.microvm.iam.managed_policies.pool != null ? (
+ v.compute_provider.aws.microvm.iam.managed_policies.pool
+ ) : local.normalized_config.compute_provider.aws.microvm.iam.managed_policies.pool
+ }
+ }
+ })
}
}
})
diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf
index 07df28e2e7..16b6f45d4e 100644
--- a/modules/multi-runner/config.experimental.translation.tf
+++ b/modules/multi-runner/config.experimental.translation.tf
@@ -301,6 +301,30 @@ locals {
}
}
}
+ microvm = {
+ image_arn = null
+ image_version = null
+ ingress_network_connectors = []
+ egress_network_connectors = []
+ cloudwatch_agent = {
+ enabled = true
+ config = null
+ }
+ log_files = null
+ environment_variables = {}
+ iam = {
+ resource_arns = {
+ images = null
+ }
+ additional_policy_json = {
+ scale_up = null
+ }
+ managed_policies = {
+ scale_up = null
+ pool = null
+ }
+ }
+ }
}
}
@@ -552,6 +576,30 @@ locals {
log_files = v.runner_config.runner_log_files
tags = v.runner_config.runner_ec2_tags
}
+ microvm = {
+ image_arn = null
+ image_version = null
+ ingress_network_connectors = []
+ egress_network_connectors = []
+ cloudwatch_agent = {
+ enabled = true
+ config = null
+ }
+ log_files = null
+ environment_variables = {}
+ iam = {
+ resource_arns = {
+ images = null
+ }
+ additional_policy_json = {
+ scale_up = null
+ }
+ managed_policies = {
+ scale_up = null
+ pool = null
+ }
+ }
+ }
}
}
}
diff --git a/modules/multi-runner/outputs.tf b/modules/multi-runner/outputs.tf
index 7c4a9807d1..4c7d4a6cd3 100644
--- a/modules/multi-runner/outputs.tf
+++ b/modules/multi-runner/outputs.tf
@@ -21,6 +21,18 @@ output "runners_map" {
}
}
+output "runners_map_v2" {
+ value = { for runner_key, runner in module.runner_configs : runner_key => {
+ runner = runner.runner
+ orchestration_provider = runner.orchestration_provider
+ scale_up = runner.scale_up
+ scale_down = runner.scale_down
+ pool = runner.pool
+ provider = runner.provider
+ }
+ }
+}
+
output "binaries_syncer_map" {
value = { for runner_binary_key, runner_binary in module.runner_binaries : runner_binary_key => {
lambda = runner_binary.lambda
diff --git a/modules/multi-runner/runners.experimental.tf b/modules/multi-runner/runners.experimental.tf
new file mode 100644
index 0000000000..4e8652aa00
--- /dev/null
+++ b/modules/multi-runner/runners.experimental.tf
@@ -0,0 +1,38 @@
+module "runner_configs" {
+ source = "../runner-config"
+ for_each = {
+ for runner_key, runner_config in local.effective_config.multi_runner_config :
+ runner_key => runner_config if local.use_v2_config
+ }
+
+ aws_region = var.aws_region
+ aws_partition = var.aws_partition
+ prefix = "${var.prefix}-${each.key}"
+
+ tags = merge(
+ each.value.tags,
+ { "ghr:environment" = var.prefix },
+ )
+ runner = each.value.runner
+ github = merge(each.value.github, {
+ app_parameters = local.github_app_parameters
+ })
+ lambda = each.value.lambda
+ orchestration_provider = {
+ webhook = each.value.orchestration_provider.webhook == null ? null : {
+ runner = each.value.orchestration_provider.webhook.runner
+ github = each.value.orchestration_provider.webhook.github
+ queue = merge(each.value.orchestration_provider.webhook.queue, {
+ build = {
+ arn = aws_sqs_queue.queued_builds[each.key].arn
+ url = aws_sqs_queue.queued_builds[each.key].url
+ }
+ })
+ lambda = each.value.orchestration_provider.webhook.lambda
+ job_retry = each.value.orchestration_provider.webhook.job_retry
+ }
+ }
+ ssm = each.value.ssm
+ observability = each.value.observability
+ compute_provider = each.value.compute_provider
+}
diff --git a/modules/multi-runner/runners.tf b/modules/multi-runner/runners.tf
index 61c5f57583..5e0bc44022 100644
--- a/modules/multi-runner/runners.tf
+++ b/modules/multi-runner/runners.tf
@@ -1,6 +1,9 @@
module "runners" {
- source = "../runners"
- for_each = local.effective_config.multi_runner_config
+ source = "../runners"
+ for_each = {
+ for runner_key, runner_config in local.effective_config.multi_runner_config :
+ runner_key => runner_config if !local.use_v2_config
+ }
aws_region = var.aws_region
aws_partition = var.aws_partition
vpc_id = each.value.compute_provider.aws.ec2.vpc_id
diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index efb117ed7f..a4a6f2af00 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -59,30 +59,9 @@ mock_provider "random" {}
mock_provider "null" {}
variables {
- aws_region = "eu-west-1"
- vpc_id = "vpc-stable"
- subnet_ids = ["subnet-stable"]
-
- github_app = {
- key_base64_ssm = {
- arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/key"
- name = "/tests/github-app/key"
- }
- id_ssm = {
- arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/id"
- name = "/tests/github-app/id"
- }
- webhook_secret_ssm = {
- arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/webhook-secret"
- name = "/tests/github-app/webhook-secret"
- }
- }
-
- lambda_s3_bucket = "test-lambda-artifacts"
- runners_lambda_zip = "README.md"
- runners_lambda_s3_key = "runners.zip"
- webhook_lambda_s3_key = "webhook.zip"
- syncer_lambda_s3_key = "runner-binaries-syncer.zip"
+ aws_region = "eu-west-1"
+ prefix = "test"
+ aws_partition = "aws"
global_config_github = {
app = {
@@ -152,6 +131,30 @@ run "v1_stable_inputs_translate_into_effective_base" {
command = plan
variables {
+ vpc_id = "vpc-stable"
+ subnet_ids = ["subnet-stable"]
+
+ github_app = {
+ key_base64_ssm = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/key"
+ name = "/tests/github-app/key"
+ }
+ id_ssm = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/id"
+ name = "/tests/github-app/id"
+ }
+ webhook_secret_ssm = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/webhook-secret"
+ name = "/tests/github-app/webhook-secret"
+ }
+ }
+
+ lambda_s3_bucket = "test-lambda-artifacts"
+ runners_lambda_zip = "README.md"
+ runners_lambda_s3_key = "runners.zip"
+ webhook_lambda_s3_key = "webhook.zip"
+ syncer_lambda_s3_key = "runner-binaries-syncer.zip"
+
tags = {
source = "v1"
}
@@ -189,18 +192,29 @@ run "v1_stable_inputs_translate_into_effective_base" {
&& local.resolved_config.multi_runner_config["stable"].runner.group_name == "v1-lane"
&& local.resolved_config.multi_runner_config["stable"].orchestration_provider.webhook.runner.maximum_count == 2
&& toset(local.resolved_config.multi_runner_config["stable"].compute_provider.aws.ec2.instance_types) == toset(["m5.large"])
+ && local.resolved_config.multi_runner_config["stable"].compute_provider.aws.microvm.image_arn == null
+ && local.resolved_config.multi_runner_config["stable"].compute_provider.aws.microvm.cloudwatch_agent.enabled
+ && length(local.resolved_config.multi_runner_config["stable"].compute_provider.aws.microvm.environment_variables) == 0
&& toset(local.effective_config.multi_runner_config["stable"].runner.labels) == toset(["linux", "self-hosted", "x64"])
)
error_message = "Stable v1 inputs must translate into the effective experimental base without leaking v2 globals."
}
+
+ assert {
+ condition = (
+ keys(module.runners) == ["stable"]
+ && length(module.runner_configs) == 0
+ && keys(output.runners_map) == ["stable"]
+ && length(output.runners_map_v2) == 0
+ )
+ error_message = "Stable v1 configurations must route through module.runners and not the experimental runner-config module."
+ }
}
run "v2_inputs_resolve_lane_over_global" {
command = plan
variables {
- experimental_features = ["multi-runner-v2"]
-
tags = {
source = "v1-must-not-leak"
}
@@ -372,4 +386,186 @@ run "v2_inputs_resolve_lane_over_global" {
)
error_message = "v2 inputs must resolve lane overrides before v2 global defaults."
}
+
+ assert {
+ condition = (
+ length(module.runners) == 0
+ && keys(module.runner_configs) == ["lane"]
+ && length(output.runners_map) == 0
+ && keys(output.runners_map_v2) == ["lane"]
+ )
+ error_message = "Experimental v2 configurations must route through module.runner_configs and skip the legacy runners module."
+ }
+}
+
+run "v2_inputs_do_not_require_legacy_arguments" {
+ command = plan
+
+ variables {
+ global_config_compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-v2"
+ subnet_ids = ["subnet-v2"]
+ runner_binaries = {
+ enabled = false
+ }
+ }
+ }
+ }
+ multi_runner_config = {
+ lane = {
+ orchestration_provider = {
+ webhook = {
+ matcherConfig = {
+ labelMatchers = [["self-hosted", "linux", "x64"]]
+ }
+ }
+ }
+ compute_provider = {
+ aws = {
+ ec2 = {
+ instance_types = ["m5.large"]
+ binaries_syncer = {
+ enabled = false
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ local.use_v2_config
+ && keys(module.runner_configs) == ["lane"]
+ && length(module.runners) == 0
+ && local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.vpc_id == "vpc-v2"
+ )
+ error_message = "The v2 interface must work without the stable v1 GitHub App, VPC, subnet, or runner configuration inputs."
+ }
+}
+
+run "v2_microvm_inputs_route_to_microvm_provider" {
+ command = plan
+
+ variables {
+ global_config = {
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ }
+ }
+
+ global_config_github = {
+ app = {
+ key_base64 = "experimental-app-key"
+ id = "experimental-app-id"
+ webhook_secret = "experimental-webhook-secret"
+ }
+ }
+
+ global_config_lambda = {
+ artifact = {
+ s3 = {
+ bucket = "global-lambda-artifacts"
+ }
+ }
+ }
+
+ global_config_orchestration_provider = {
+ webhook = {
+ eventbridge = {
+ enabled = false
+ }
+ runner = {
+ ephemeral = true
+ jit_config_enabled = true
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "global-runners.zip"
+ }
+ }
+ webhook = {
+ artifact = {
+ s3 = {
+ key = "global-webhook.zip"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ global_config_ssm = {
+ housekeeper = {
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "global-housekeeper.zip"
+ }
+ }
+ }
+ }
+ }
+
+ global_config_compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:global"
+ image_version = "7"
+ }
+ }
+ }
+
+ multi_runner_config = {
+ microvm = {
+ runner = {
+ name_prefix = "microvm-"
+ }
+ orchestration_provider = {
+ webhook = {
+ matcherConfig = {
+ labelMatchers = [["microvm"]]
+ }
+ }
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_version = "8"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ local.use_v2_config
+ && keys(local.resolved_config.multi_runner_config) == ["microvm"]
+ && local.resolved_config.multi_runner_config["microvm"].runner.os == "linux"
+ && local.resolved_config.multi_runner_config["microvm"].runner.architecture == "arm64"
+ && local.resolved_config.multi_runner_config["microvm"].compute_provider.aws.ec2 == null
+ && local.resolved_config.multi_runner_config["microvm"].compute_provider.aws.microvm.image_arn == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:global"
+ && local.resolved_config.multi_runner_config["microvm"].compute_provider.aws.microvm.image_version == "8"
+ && local.effective_config.orchestration_provider.webhook.lambda.webhook.artifact.s3.key == "global-webhook.zip"
+ )
+ error_message = "Experimental MicroVM lanes must resolve Linux ARM64 settings, inherit global provider values, and place the webhook artifact key under lambda.webhook.artifact."
+ }
+
+ assert {
+ condition = (
+ length(module.runners) == 0
+ && keys(module.runner_configs) == ["microvm"]
+ && output.runners_map_v2["microvm"].provider.aws.ec2 == null
+ && output.runners_map_v2["microvm"].provider.aws.microvm.image_arn == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:global"
+ && output.runners_map_v2["microvm"].provider.aws.microvm.image_version == "8"
+ )
+ error_message = "Experimental MicroVM lanes must route through module.runner_configs and expose the MicroVM provider contract without an EC2 provider."
+ }
}
diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
new file mode 100644
index 0000000000..4be542eb59
--- /dev/null
+++ b/modules/multi-runner/validations.tf
@@ -0,0 +1,112 @@
+locals {
+ common_validation_errors = concat(
+ alltrue([
+ for app in var.additional_github_apps :
+ (app.key_base64 != null || app.key_base64_ssm != null) &&
+ (app.id != null || app.id_ssm != null)
+ ]) ? [] : ["Each additional GitHub app must provide either key_base64 or key_base64_ssm, and either id or id_ssm."],
+ contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class) ? [] : ["`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."],
+ contains(["first", "random", "all"], var.queue_selection_strategy) ? [] : ["`queue_selection_strategy` value not valid. Valid values are 'first', 'random', 'all'."],
+ contains(["silly", "trace", "debug", "info", "warn", "error", "fatal"], var.log_level) ? [] : ["`log_level` value not valid. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'."],
+ contains(["arm64", "x86_64"], var.lambda_architecture) ? [] : ["`lambda_architecture` value is not valid, valid values are: `arm64` and `x86_64`."],
+ contains(["ENABLED", "DISABLED", "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"], var.state_event_rule_binaries_syncer) ? [] : ["`state_event_rule_binaries_syncer` value is not valid, valid values are: `ENABLED`, `DISABLED`, `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS`."],
+ var.queue_encryption == null || var.queue_encryption.sqs_managed_sse_enabled != null && var.queue_encryption.kms_master_key_id == null && var.queue_encryption.kms_data_key_reuse_period_seconds == null || var.queue_encryption.sqs_managed_sse_enabled == null && var.queue_encryption.kms_master_key_id != null ? [] : ["Invalid configuration for `queue_encryption`. Valid configurations are encryption disabled, enabled via SSE. Or encryption via KMS."],
+ contains(["Standard", "Advanced"], var.matcher_config_parameter_store_tier) ? [] : ["`matcher_config_parameter_store_tier` value is not valid, valid values are: `Standard`, and `Advanced`."],
+ !var.iam_overrides.override_instance_profile || var.iam_overrides.instance_profile_name != null ? [] : ["instance_profile_name must be provided when override_instance_profile is true."],
+ !var.iam_overrides.override_runner_role || var.iam_overrides.runner_role_arn != null ? [] : ["runner_role_arn must be provided when override_runner_role is true."]
+ )
+}
+
+resource "terraform_data" "validate_v1" {
+ count = local.use_v2_config ? 0 : 1
+
+ lifecycle {
+ precondition {
+ condition = length(local.common_validation_errors) == 0
+ error_message = join("\n", local.common_validation_errors)
+ }
+
+ precondition {
+ condition = (
+ (var.github_app.key_base64 != null || var.github_app.key_base64_ssm != null) &&
+ (var.github_app.id != null || var.github_app.id_ssm != null) &&
+ (var.github_app.webhook_secret != null || var.github_app.webhook_secret_ssm != null) &&
+ var.vpc_id != null &&
+ var.subnet_ids != null &&
+ length(var.multi_runner_config) > 0
+ )
+ error_message = "Stable v1 configuration requires github_app, vpc_id, subnet_ids, and multi_runner_config."
+ }
+ }
+}
+
+resource "terraform_data" "validate_v2" {
+ count = local.use_v2_config ? 1 : 0
+
+ lifecycle {
+ precondition {
+ condition = length(local.common_validation_errors) == 0
+ error_message = join("\n", local.common_validation_errors)
+ }
+
+ precondition {
+ condition = (
+ (
+ try(var.global_config_github.app.key_base64, null) != null ||
+ try(var.global_config_github.app.key_base64_ssm, null) != null
+ ) && (
+ try(var.global_config_github.app.id, null) != null ||
+ try(var.global_config_github.app.id_ssm, null) != null
+ ) && (
+ try(var.global_config_github.app.webhook_secret, null) != null ||
+ try(var.global_config_github.app.webhook_secret_ssm, null) != null
+ )
+ )
+ error_message = "Experimental v2 configuration requires a complete GitHub App under global_config_github.app."
+ }
+
+ precondition {
+ condition = alltrue([
+ for config in local.resolved_config.multi_runner_config : (
+ try(config.orchestration_provider.webhook != null, false)
+ )
+ ])
+ error_message = "Each experimental v2 runner lane requires a webhook provider."
+ }
+
+ precondition {
+ condition = alltrue([
+ for config in local.resolved_config.multi_runner_config : length([
+ for provider_config in [
+ try(config.compute_provider.aws.ec2, null),
+ try(config.compute_provider.aws.microvm, null),
+ ] : provider_config if provider_config != null
+ ]) == 1
+ ])
+ error_message = "Each experimental v2 runner lane requires exactly one compute provider. Supported providers: aws.ec2, aws.microvm."
+ }
+
+ precondition {
+ condition = alltrue([
+ for config in local.resolved_config.multi_runner_config : (
+ !try(config.compute_provider.aws.ec2 != null, false) || (
+ try(length(config.compute_provider.aws.ec2.instance_types) > 0, false) &&
+ try(config.compute_provider.aws.ec2.vpc_id != null, false) &&
+ try(length(config.compute_provider.aws.ec2.subnet_ids) > 0, false)
+ )
+ )
+ ])
+ error_message = "Each experimental v2 EC2 runner lane requires instance_types, vpc_id, and at least one subnet."
+ }
+
+ precondition {
+ condition = alltrue([
+ for config in local.resolved_config.multi_runner_config : (
+ !try(config.compute_provider.aws.microvm != null, false) ||
+ try(config.compute_provider.aws.microvm.image_arn != null, false)
+ )
+ ])
+ error_message = "Each experimental v2 MicroVM runner lane requires image_arn."
+ }
+ }
+}
diff --git a/modules/multi-runner/variables.experimental.compute-provider.tf b/modules/multi-runner/variables.experimental.compute-provider.tf
index 4780a156c3..1684ef8e74 100644
--- a/modules/multi-runner/variables.experimental.compute-provider.tf
+++ b/modules/multi-runner/variables.experimental.compute-provider.tf
@@ -199,6 +199,40 @@ variable "global_config_compute_provider" {
}), {})
}), {})
}), {})
+ microvm = optional(object({
+ image_arn = optional(string, null)
+ image_version = optional(string, null)
+ ingress_network_connectors = optional(list(string), [])
+ egress_network_connectors = optional(list(string), [])
+ cloudwatch_agent = optional(object({
+ enabled = optional(bool, true)
+ config = optional(string, null)
+ }), {})
+ log_files = optional(list(object({
+ log_group_name = string
+ prefix_log_group = bool
+ file_path = string
+ log_stream_name = string
+ log_class = optional(string, "STANDARD")
+ })), null)
+ environment_variables = optional(map(string), {})
+ iam = optional(object({
+ resource_arns = optional(object({
+ images = optional(list(string), null)
+ }), {})
+ additional_policy_json = optional(object({
+ scale_up = optional(string, null)
+ }), {})
+ managed_policies = optional(object({
+ scale_up = optional(object({
+ arn = string
+ }), null)
+ pool = optional(object({
+ arn = string
+ }), null)
+ }), {})
+ }), {})
+ }), {})
}), {})
})
default = {}
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
index bddc0873b4..4f08bc8a8a 100644
--- a/modules/multi-runner/variables.tf
+++ b/modules/multi-runner/variables.tf
@@ -1,6 +1,8 @@
variable "github_app" {
description = < This module is treated as an internal module; breaking changes do not trigger a major release bump.
+
+This internal module implements the experimental provider-neutral runner configuration selected by `experimental.multi_runner_config`. It is composed by `multi-runner` and is not intended as a standalone public entry point. Its direct contract may change while v2 remains experimental.
+
+The module selects the [`webhook` orchestration provider](../orchestration-providers/webhook), which owns its [`scale-runners`](../orchestration-providers/webhook/scale-runners), [`pool`](../orchestration-providers/webhook/pool), and [`job-retry`](../orchestration-providers/webhook/job-retry) leaves. The configuration module retains the common [`ssm-housekeeper`](./ssm-housekeeper), creates or selects the runner IAM role, manages shared runner configuration in SSM, and dispatches the selected compute provider.
+
+Runner demand orchestration is selected independently through `orchestration_provider`. `orchestration_provider.webhook` is the currently supported provider and owns the build queue reference; runner lifecycle, boot time, and capacity under `orchestration_provider.webhook.runner`; runner registration scope; scaling controls; scheduled pool; and job retry. Common `runner` contains no webhook lifecycle or capacity settings. The provider resolves its lifecycle contract before runner-config serializes the existing bootstrap parameters. The provider wrapper is nullable so a future sibling provider can be added without moving this webhook contract again, while validation requires exactly one provider to be selected.
+
+Common `lambda` contains only shared execution substrate and the optional shared artifact bucket. The webhook provider owns the runner-control archive shared by scale, pool, and job-retry at `orchestration_provider.webhook.lambda.artifact` and combines its zip or S3 key/version with that common substrate. The common SSM housekeeper independently owns `ssm.housekeeper.lambda.artifact`: an S3 selection combines its component key/version with the common bucket, a local zip is used otherwise when configured, and the packaged runner control-plane archive is the final fallback. It never inherits the webhook runner-control archive.
+
+Provider-owned settings remain nested under a typed namespace and provider leaf. EC2 settings live under `compute_provider.aws.ec2`, while Lambda MicroVM settings live under `compute_provider.aws.microvm`. `multi-runner` resolves experimental globals and runner-configuration overrides first, then preserves the wrapped `{ aws = { ec2 = ..., microvm = ... } }` object expected by this module. Exactly one provider leaf must be non-null. Runner-config flattens the selected namespace and type only for Terraform dispatch: `aws_ec2` maps to runtime type `ec2`, and `aws_microvm` maps to runtime type `microvm`.
+
+The EC2 leaf reaches runner-config with `compute_provider.aws.ec2.binaries_syncer = { enabled, s3 }`; the S3 object is null when synchronization is disabled. Binary discovery and this shape adaptation happen in `multi-runner`, not inside runner-config. Runner-config calls [`compute-providers/aws/ec2/trust-policy`](../compute-providers/aws/ec2/trust-policy) as `module.compute_aws_ec2_trust_policy[0]`, then dispatches the full [`compute-providers/aws/ec2`](../compute-providers/aws/ec2) module at `module.compute_aws_ec2[0]`. Declarative moved blocks preserve state from the earlier experimental `module.compute_ec2_trust_policy[0]` and `module.compute_ec2[0]` labels.
+
+The MicroVM leaf similarly uses [`compute-providers/aws/microvm/trust-policy`](../compute-providers/aws/microvm/trust-policy) at `module.compute_aws_microvm_trust_policy[0]` and the full [`compute-providers/aws/microvm`](../compute-providers/aws/microvm) module at `module.compute_aws_microvm[0]`. It uses the resolved common `runner.iam.role` as the MicroVM execution role and exports the IAM and runtime-environment fragments required by the webhook control plane. MicroVM lanes require Linux on ARM64 and ephemeral webhook orchestration with JIT configuration enabled. MicroVM is introduced directly at its namespaced labels, so the EC2 moved blocks do not apply to it.
+
+The common configuration module attaches each selected provider's returned policy groups to its managed runner or webhook-provider roles. Provider-specific outputs remain grouped under the matching path: `provider.aws.ec2` or `provider.aws.microvm`. Moved blocks do not rewrite output references, so consumers of the former experimental `provider.ec2` path must update their expressions.
+
+## Tagging
+
+`tags` supplies module-wide defaults. Shared resource tags are set with `lambda.tags`, `orchestration_provider.webhook.queue.tags`, and `observability.logs.tags`. Component tags under `runner`, `orchestration_provider.webhook.lambda.scale.up`, `orchestration_provider.webhook.lambda.scale.down`, `orchestration_provider.webhook.lambda.pool`, `orchestration_provider.webhook.job_retry`, and `ssm` apply to the taggable resources owned by that component. `ssm.parameters.tags` and `ssm.housekeeper.tags` provide narrower SSM scopes.
+
+Tags are merged from broadest to narrowest: module tags, shared resource tags, component tags, and then subcomponent tags. The narrowest value wins when a key is repeated. For example, a scale-up Lambda receives `tags`, `lambda.tags`, and `orchestration_provider.webhook.lambda.scale.up.tags`, while its log group receives `tags`, `observability.logs.tags`, and `orchestration_provider.webhook.lambda.scale.up.tags`.
+
+Provider-specific runner tags remain inside the provider boundary. `compute_provider.aws.ec2.tags` applies to runtime EC2 instance, volume, network-interface, and spot-request tag specifications. `multi-runner` derives that map from global and runner-configuration `compute_provider.aws.ec2.tags` values. The EC2 provider applies the bootstrap tags `ghr:environment`, `ghr:ssm_config_path`, and `ghr:runner_name_prefix` last so they cannot be overridden; those tags are not added to common Lambda, IAM, queue, log-group, or SSM resources.
+
+## Provider behavior
+
+### EC2 runners
+
+The EC2 provider creates runners from a launch template. Bootstrap is handled by user data, and the runner retrieves its configuration from Parameter Store.
+
+### Lambda MicroVM runners
+
+The MicroVM provider starts Linux ARM64 capacity with `RunMicrovm`. The control plane generates the ephemeral runner's JIT payload, and the MicroVM image retrieves that payload from Parameter Store through its `/run` hook. The resolved common runner role is the MicroVM execution role.
+
+### Lambda scale up
+
+The scale-up Lambda is triggered by events on the runner configuration's SQS queue. It verifies that the workflow remains queued and that capacity limits permit another runner, then delegates creation to the selected compute provider: EC2 launches from the provider launch template, while MicroVM calls `RunMicrovm` with the resolved image, execution role, connector, duration, and logging settings.
+
+### Lambda scale down
+
+The scale-down Lambda runs on the schedule configured by `orchestration_provider.webhook.lambda.scale.down.schedule_expression`. It lists capacity through the selected compute provider, correlates it with GitHub runner state, and terminates removable EC2 instances or MicroVMs through that provider's API.
+
+--8<-- "modules/orchestration-providers/webhook/scale-down-state-diagram.md:mkdocs_scale_down_state_diagram"
+
+## Lambda Function
+
+The Lambda function is written in [TypeScript](https://www.typescriptlang.org/) and requires Node 12.x and yarn. Sources are located in [./lambdas/runners]. Two lambda functions share the same sources, there is one entry point for `scaleDown` and another one for `scaleUp`.
+
+### Install
+
+```bash
+cd lambdas/runners
+yarn install
+```
+
+### Test
+
+Test are implemented with [vitest][https://vitest.dev/]), calls to AWS and GitHub are mocked.
+
+```bash
+yarn run test
+```
+
+### Package
+
+To compile all TypeScript/JavaScript sources in a single file [ncc](https://github.com/zeit/ncc) is used.
+
+```bash
+yarn run dist
+```
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 1.4.0 |
+| [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 6.33 |
+| [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| [compute\_aws\_ec2](#module\_compute\_aws\_ec2) | ../compute-providers/aws/ec2 | n/a |
+| [compute\_aws\_ec2\_trust\_policy](#module\_compute\_aws\_ec2\_trust\_policy) | ../compute-providers/aws/ec2/trust-policy | n/a |
+| [compute\_aws\_microvm](#module\_compute\_aws\_microvm) | ../compute-providers/aws/microvm | n/a |
+| [compute\_aws\_microvm\_trust\_policy](#module\_compute\_aws\_microvm\_trust\_policy) | ../compute-providers/aws/microvm/trust-policy | n/a |
+| [orchestration\_webhook](#module\_orchestration\_webhook) | ../orchestration-providers/webhook | n/a |
+| [ssm\_housekeeper](#module\_ssm\_housekeeper) | ./ssm-housekeeper | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_role.runner](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.runner_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy_attachment.runner](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_ssm_parameter.disable_default_labels](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.jit_config_enabled](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.runner_agent_mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.token_path](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [terraform_data.validate_config](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| [aws\_partition](#input\_aws\_partition) | AWS partition used to construct ARNs. | `string` | `"aws"` | no |
+| [aws\_region](#input\_aws\_region) | AWS region. | `string` | n/a | yes |
+| [compute\_provider](#input\_compute\_provider) | Typed compute-provider configuration. Provider-owned settings remain inside the selected compute-provider block.
Exactly one compute-provider block must be non-null. The populated block selects the provider, and its presence must be known during planning. Values inside the selected block may remain unknown until apply.
- `aws`: AWS compute-provider configurations.
- `aws.ec2`: EC2 compute-provider configuration.
- `aws.ec2.ami`: Optional AMI discovery or external AMI-parameter configuration. Null uses the operating-system and architecture defaults.
- `aws.ec2.ami.filter`: EC2 AMI filters combined with the provider's default AMI-name filter.
- `aws.ec2.ami.owners`: AWS account IDs or aliases allowed to own the selected AMI.
- `aws.ec2.ami.id_ssm_parameter`: Optional externally managed SSM parameter containing the AMI ID. Null creates a provider-managed AMI-ID parameter. The wrapper's presence is the plan-time ownership discriminator, so keep the object literal even when its ARN comes from another resource.
- `aws.ec2.ami.id_ssm_parameter.arn`: ARN of the externally managed SSM parameter. The ARN may be unknown until apply.
- `aws.ec2.ami.kms_key`: Optional KMS key required to launch encrypted AMIs or snapshots. The wrapper's presence is the plan-time policy discriminator.
- `aws.ec2.ami.kms_key.arn`: ARN of the KMS key. The ARN may be unknown until apply.
- `aws.ec2.vpc_id`: VPC in which runner networking resources are created.
- `aws.ec2.subnet_ids`: Subnets from which scale-up may launch runner instances.
- `aws.ec2.overrides`: Optional resource-name overrides.
- `aws.ec2.overrides.name_runner`: Name tag used for runner compute resources. An empty value uses the generated provider name.
- `aws.ec2.overrides.name_sg`: Name tag used for the managed runner security group. An empty value uses the generated provider name.
- `aws.ec2.instance_profile`: Optional externally managed instance profile used by the launch template.
- `aws.ec2.instance_profile.name`: Name of the externally managed instance profile.
- `aws.ec2.instance_profile_path`: IAM path for the provider-managed instance profile. Null uses a path derived from the runner-configuration prefix.
- `aws.ec2.binaries_syncer`: Runner-distribution synchronization configuration.
- `aws.ec2.binaries_syncer.enabled`: Enables use of a synchronized runner distribution from S3.
- `aws.ec2.binaries_syncer.s3`: S3 object containing the synchronized runner distribution. Required when synchronization is enabled.
- `aws.ec2.binaries_syncer.s3.arn`: ARN of the runner-distribution bucket, used by IAM policies.
- `aws.ec2.binaries_syncer.s3.id`: Bucket name used to construct the runner-distribution S3 URI.
- `aws.ec2.binaries_syncer.s3.key`: Object key of the runner distribution.
- `aws.ec2.block_device_mappings`: EBS mappings added to the runner launch template.
- `aws.ec2.block_device_mappings[].delete_on_termination`: Deletes the volume when its runner instance terminates.
- `aws.ec2.block_device_mappings[].device_name`: Device name exposed to the runner instance.
- `aws.ec2.block_device_mappings[].encrypted`: Enables EBS encryption.
- `aws.ec2.block_device_mappings[].iops`: Provisioned IOPS for volume types that support it.
- `aws.ec2.block_device_mappings[].kms_key_id`: KMS key ID or ARN used to encrypt the volume.
- `aws.ec2.block_device_mappings[].snapshot_id`: Snapshot used to initialize the volume.
- `aws.ec2.block_device_mappings[].throughput`: Provisioned throughput for volume types that support it.
- `aws.ec2.block_device_mappings[].volume_initialization_rate`: Fixed initialization rate in MiB/s for supported snapshot-backed volumes.
- `aws.ec2.block_device_mappings[].volume_size`: Volume size in GiB.
- `aws.ec2.block_device_mappings[].volume_type`: EBS volume type.
- `aws.ec2.ebs_optimized`: Requests EBS-optimized runner instances.
- `aws.ec2.instance_target_capacity_type`: Primary capacity type, either `spot` or `on-demand`.
- `aws.ec2.instance_allocation_strategy`: EC2 Fleet allocation strategy used to select instance capacity.
- `aws.ec2.instance_type_priorities`: Optional numeric priorities keyed by instance type.
- `aws.ec2.instance_max_spot_price`: Optional maximum hourly Spot price.
- `aws.ec2.instance_types`: EC2 instance types available to the scale-up and pool functions.
- `aws.ec2.user_data`: Runner bootstrap user-data configuration.
- `aws.ec2.user_data.enabled`: Enables launch-template user data.
- `aws.ec2.user_data.template`: Optional path to a custom user-data template.
- `aws.ec2.user_data.content`: Optional complete user-data content. When set, it is used instead of rendering a template.
- `aws.ec2.user_data.pre_install`: Script content inserted before runner installation in the default template.
- `aws.ec2.user_data.post_install`: Script content inserted after runner installation in the default template.
- `aws.ec2.user_data.debug_logging_enabled`: Enables verbose user-data tracing, which can expose secrets in logs.
- `aws.ec2.ssm_enabled`: Attaches runner permissions and policies required for AWS Systems Manager access.
- `aws.ec2.create_service_linked_role_spot`: Allows scale-up to create the EC2 Spot service-linked role.
- `aws.ec2.cloudwatch_agent`: CloudWatch agent configuration for runner instances.
- `aws.ec2.cloudwatch_agent.enabled`: Installs and configures the CloudWatch agent through the default bootstrap flow.
- `aws.ec2.cloudwatch_agent.config`: Optional complete CloudWatch agent configuration. Null renders the provider default from `log_files`.
- `aws.ec2.managed_security_group_enabled`: Creates and attaches the provider-managed runner security group.
- `aws.ec2.log_files`: Optional log files collected by the CloudWatch agent. Null uses the provider defaults.
- `aws.ec2.log_files[].log_group_name`: CloudWatch log-group name, before optional prefixing.
- `aws.ec2.log_files[].prefix_log_group`: Prefixes the log-group name with the runner configuration path when true.
- `aws.ec2.log_files[].file_path`: File or glob read by the CloudWatch agent.
- `aws.ec2.log_files[].log_stream_name`: CloudWatch log-stream name template.
- `aws.ec2.log_files[].log_class`: CloudWatch log-group class for the collected file.
- `aws.ec2.key_name`: Optional EC2 key-pair name added to the launch template.
- `aws.ec2.additional_security_group_ids`: Existing security groups attached in addition to the managed security group.
- `aws.ec2.detailed_monitoring_enabled`: Enables detailed EC2 monitoring for runner instances.
- `aws.ec2.egress_rules`: Egress rules created on the managed runner security group.
- `aws.ec2.egress_rules[].cidr_blocks`: IPv4 CIDR destinations.
- `aws.ec2.egress_rules[].ipv6_cidr_blocks`: IPv6 CIDR destinations.
- `aws.ec2.egress_rules[].prefix_list_ids`: AWS prefix-list destinations.
- `aws.ec2.egress_rules[].from_port`: First destination port in the permitted range.
- `aws.ec2.egress_rules[].protocol`: IP protocol name or number. Use `-1` for all protocols.
- `aws.ec2.egress_rules[].security_groups`: Destination security-group IDs.
- `aws.ec2.egress_rules[].self`: Allows traffic to the managed security group itself when true.
- `aws.ec2.egress_rules[].to_port`: Last destination port in the permitted range.
- `aws.ec2.egress_rules[].description`: Optional rule description.
- `aws.ec2.tags`: Additional tags for runner instances, EBS volumes, network interfaces, and eligible Spot instance requests created from the launch template. They override module-level tags and the generated runner `Name`; the provider-managed `ghr:environment`, `ghr:ssm_config_path`, and `ghr:runner_name_prefix` bootstrap tags take final precedence. These tags do not apply to static provider resources such as the launch template, security group, IAM resources, SSM parameters, or log groups.
- `aws.ec2.metadata_options`: Instance Metadata Service configuration in the launch template.
- `aws.ec2.metadata_options.instance_metadata_tags`: Exposes instance tags through Instance Metadata Service when `enabled`.
- `aws.ec2.metadata_options.http_endpoint`: Enables or disables the Instance Metadata Service endpoint.
- `aws.ec2.metadata_options.http_tokens`: Controls whether IMDSv2 session tokens are optional or required.
- `aws.ec2.metadata_options.http_put_response_hop_limit`: Network hop limit for Instance Metadata Service token responses.
- `aws.ec2.credit_specification`: CPU credit mode for burstable instance types, either `standard` or `unlimited`.
- `aws.ec2.cpu_options`: CPU topology and processor-feature configuration.
- `aws.ec2.cpu_options.core_count`: Number of CPU cores exposed to the runner instance.
- `aws.ec2.cpu_options.threads_per_core`: Number of hardware threads exposed per CPU core.
- `aws.ec2.cpu_options.amd_sev_snp`: Enables or disables AMD SEV-SNP on supported instance types.
- `aws.ec2.cpu_options.nested_virtualization`: Enables or disables nested virtualization on supported instance types.
- `aws.ec2.placement`: EC2 placement configuration for runner instances.
- `aws.ec2.placement.affinity`: Host affinity setting.
- `aws.ec2.placement.availability_zone`: Availability Zone in which the instance is placed.
- `aws.ec2.placement.group_id`: Placement-group ID.
- `aws.ec2.placement.group_name`: Placement-group name.
- `aws.ec2.placement.host_id`: Dedicated Host ID.
- `aws.ec2.placement.host_resource_group_arn`: ARN of the host resource group used for placement.
- `aws.ec2.placement.spread_domain`: Spread-domain placement value.
- `aws.ec2.placement.tenancy`: Instance tenancy, such as `default`, `dedicated`, or `host`.
- `aws.ec2.placement.partition_number`: Placement-group partition number.
- `aws.ec2.license_specifications`: License Manager configurations added to the launch template.
- `aws.ec2.license_specifications[].license_configuration_arn`: ARN of a License Manager license configuration.
- `aws.ec2.associate_public_ipv4_address`: Associates a public IPv4 address with runner network interfaces.
- `aws.ec2.on_demand_failover_for_errors`: EC2 error codes that trigger an on-demand fallback after a Spot launch failure.
- `aws.ec2.scale_errors`: EC2 error codes treated as retryable scale-up failures.
- `aws.ec2.use_dedicated_host`: Enables the dedicated-host launch path, required for macOS runners. | object({
aws = optional(object({
ec2 = optional(object({
ami = optional(object({
filter = optional(map(list(string)), { state = ["available"] })
owners = optional(list(string), ["amazon"])
id_ssm_parameter = optional(object({
arn = string
}), null)
kms_key = optional(object({
arn = string
}), null)
}), null)
vpc_id = string
subnet_ids = list(string)
overrides = optional(object({
name_runner = optional(string, "")
name_sg = optional(string, "")
}), {})
instance_profile = optional(object({
name = string
}), null)
instance_profile_path = optional(string, null)
binaries_syncer = optional(object({
enabled = optional(bool, true)
s3 = optional(object({
arn = string
id = string
key = string
}), null)
}), {})
block_device_mappings = optional(list(object({
delete_on_termination = optional(bool, true)
device_name = optional(string, "/dev/xvda")
encrypted = optional(bool, true)
iops = optional(number)
kms_key_id = optional(string)
snapshot_id = optional(string)
throughput = optional(number)
volume_initialization_rate = optional(number)
volume_size = number
volume_type = optional(string, "gp3")
})), [{ volume_size = 30 }])
ebs_optimized = optional(bool, false)
instance_target_capacity_type = optional(string, "spot")
instance_allocation_strategy = optional(string, "lowest-price")
instance_type_priorities = optional(map(number), null)
instance_max_spot_price = optional(string, null)
instance_types = list(string)
user_data = optional(object({
enabled = optional(bool, true)
template = optional(string, null)
content = optional(string, null)
pre_install = optional(string, "")
post_install = optional(string, "")
debug_logging_enabled = optional(bool, false)
}), {})
ssm_enabled = optional(bool, false)
create_service_linked_role_spot = optional(bool, false)
cloudwatch_agent = optional(object({
enabled = optional(bool, true)
config = optional(string, null)
}), {})
managed_security_group_enabled = optional(bool, true)
log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
key_name = optional(string, null)
additional_security_group_ids = optional(list(string), [])
detailed_monitoring_enabled = optional(bool, false)
egress_rules = optional(list(object({
cidr_blocks = list(string)
ipv6_cidr_blocks = list(string)
prefix_list_ids = list(string)
from_port = number
protocol = string
security_groups = list(string)
self = bool
to_port = number
description = string
})), [{
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
prefix_list_ids = null
from_port = 0
protocol = "-1"
security_groups = null
self = null
to_port = 0
description = null
}])
tags = optional(map(string), {})
metadata_options = optional(object({
instance_metadata_tags = optional(string, "enabled")
http_endpoint = optional(string, "enabled")
http_tokens = optional(string, "required")
http_put_response_hop_limit = optional(number, 1)
}), {})
credit_specification = optional(string, null)
cpu_options = optional(object({
core_count = optional(number)
threads_per_core = optional(number)
amd_sev_snp = optional(string)
nested_virtualization = optional(string)
}), null)
placement = optional(object({
affinity = optional(string)
availability_zone = optional(string)
group_id = optional(string)
group_name = optional(string)
host_id = optional(string)
host_resource_group_arn = optional(string)
spread_domain = optional(string)
tenancy = optional(string)
partition_number = optional(number)
}), null)
license_specifications = optional(list(object({
license_configuration_arn = string
})), [])
associate_public_ipv4_address = optional(bool, false)
on_demand_failover_for_errors = optional(list(string), [])
scale_errors = optional(list(string), [
"UnfulfillableCapacity",
"MaxSpotInstanceCountExceeded",
"TargetCapacityLimitExceededException",
"RequestLimitExceeded",
"ResourceLimitExceeded",
"MaxSpotInstanceCountExceeded",
"MaxSpotFleetRequestCountExceeded",
"InsufficientInstanceCapacity",
"InsufficientCapacityOnHost",
])
use_dedicated_host = optional(bool, false)
}), null)
microvm = optional(object({
image_arn = string
image_version = optional(string, null)
ingress_network_connectors = optional(list(string), [])
egress_network_connectors = optional(list(string), [])
cloudwatch_agent = optional(object({
enabled = optional(bool, true)
config = optional(string, null)
}), {})
log_files = optional(list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
log_class = optional(string, "STANDARD")
})), null)
environment_variables = optional(map(string), {})
iam = optional(object({
resource_arns = optional(object({
images = optional(list(string), null)
}), {})
additional_policy_json = optional(object({
scale_up = optional(string, null)
}), {})
managed_policies = optional(object({
scale_up = optional(object({
arn = string
}), null)
pool = optional(object({
arn = string
}), null)
}), {})
}), {})
}), null)
}), {})
}) | n/a | yes |
+| [compute\_provider\_key](#input\_compute\_provider\_key) | Optional plan-known compute-provider dispatch key. Null discovers the key from the exactly one populated compute\_provider block. | `string` | `null` | no |
+| [github](#input\_github) | GitHub API and runner-registration configuration.
- `app_parameters.key_base64`: Ordered Parameter Store references for GitHub App private keys.
- `app_parameters.id`: Ordered Parameter Store references for GitHub App IDs.
- `app_parameters.installation_id`: Ordered optional Parameter Store references for GitHub App installation IDs.
- `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.
- `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server requests.
- `user_agent`: Optional User-Agent value added to GitHub API requests. | object({
app_parameters = object({
key_base64 = list(map(string))
id = list(map(string))
installation_id = list(object({ name = string, arn = string }))
})
enterprise_server = optional(object({
url = optional(string, null)
ssl_verify = optional(bool, true)
}), {})
user_agent = optional(string, null)
}) | n/a | yes |
+| [lambda](#input\_lambda) | Common Lambda substrate independent of the selected runner orchestration provider.
- `artifact.s3.bucket`: Optional shared S3 bucket containing component-owned Lambda artifacts. An orchestration provider selects its own object key and version; the bucket alone selects no artifact.
- `runtime`: Runtime used by the control-plane Lambda functions.
- `architecture`: Instruction-set architecture used by the control-plane Lambda functions. Supported values are `arm64` and `x86_64`.
- `subnet_ids`: Subnets used for Lambda VPC configuration.
- `security_group_ids`: Security groups used for Lambda VPC configuration.
- `tags`: Shared tags applied to Lambda function resources only. These override module-level `tags`; component `tags` override this map when keys conflict.
- `principals`: Additional principals allowed to assume the control-plane Lambda roles.
- `role.path`: IAM path for module-managed Lambda execution roles. Defaults to a path derived from `prefix`.
- `role.permissions_boundary`: Permissions-boundary ARN applied to module-managed Lambda execution roles. | object({
artifact = optional(object({
s3 = optional(object({
bucket = optional(string, null)
}), {})
}), {})
runtime = optional(string, "nodejs24.x")
architecture = optional(string, "arm64")
subnet_ids = optional(list(string), [])
security_group_ids = optional(list(string), [])
tags = optional(map(string), {})
principals = optional(list(object({
type = string
identifiers = list(string)
})), [])
role = optional(object({
path = optional(string, null)
permissions_boundary = optional(string, null)
}), {})
}) | `{}` | no |
+| [observability](#input\_observability) | Logging, tracing, and metrics configuration for control-plane and provider resources.
- `logs.level`: Application log level supplied to the control-plane functions.
- `logs.retention_in_days`: CloudWatch Logs retention period.
- `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt CloudWatch log groups.
- `logs.class`: CloudWatch log-group class. Supported values are `STANDARD` and `INFREQUENT_ACCESS`.
- `logs.tags`: Shared tags for CloudWatch log groups. These override module-level `tags`; component `tags` override this map when keys conflict.
- `tracing.mode`: Optional Lambda active-tracing mode. Null disables X-Ray tracing configuration.
- `tracing.capture_http_requests`: Enables HTTP request capture in the tracing helper.
- `tracing.capture_error`: Enables error capture in the tracing helper.
- `metrics.enabled`: Enables module-emitted metrics.
- `metrics.namespace`: CloudWatch namespace used for emitted metrics.
- `metrics.metric.github_app_rate_limit.enabled`: Emits GitHub App rate-limit metrics.
- `metrics.metric.job_retry.enabled`: Emits job-retry metrics.
- `metrics.metric.spot_termination_warning.enabled`: Emits spot-termination warning metrics where supported. | object({
logs = optional(object({
level = optional(string, "info")
retention_in_days = optional(number, 180)
kms_key_id = optional(string, null)
class = optional(string, "STANDARD")
tags = optional(map(string), {})
}), {})
tracing = optional(object({
mode = optional(string, null)
capture_http_requests = optional(bool, false)
capture_error = optional(bool, false)
}), {})
metrics = optional(object({
enabled = optional(bool, false)
namespace = optional(string, "GitHub Runners")
metric = optional(object({
github_app_rate_limit = optional(object({
enabled = optional(bool, true)
}), {})
job_retry = optional(object({
enabled = optional(bool, true)
}), {})
spot_termination_warning = optional(object({
enabled = optional(bool, true)
}), {})
}), {})
}), {})
}) | `{}` | no |
+| [orchestration\_provider](#input\_orchestration\_provider) | Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.
- `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.
- `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.
- `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.
- `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.
- `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.
- `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.
- `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.
- `webhook.queue.build.arn`: ARN of the runner configuration's build queue.
- `webhook.queue.build.url`: URL of the runner configuration's build queue.
- `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.
- `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.
- `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.
- `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.
- `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.
- `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.
- `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.
- `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.
- `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.
- `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.
- `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.
- `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.
- `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.
- `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.
- `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.
- `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.
- `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.
- `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.
- `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.
- `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.
- `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.
- `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.
- `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.
- `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.
- `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.
- `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.
- `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.
- `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.
- `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.
- `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.
- `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.
- `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.
- `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.
- `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.
- `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.
- `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.
- `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.
- `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.
- `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.
- `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.
- `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.
- `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`. | object({
webhook = optional(object({
runner = optional(object({
boot_time_in_minutes = optional(number, 5)
ephemeral = optional(bool, false)
jit_config_enabled = optional(bool, null)
maximum_count = optional(number, 3)
}), {})
github = object({
organization_runners = bool
})
queue = object({
build = object({
arn = string
url = string
})
kms_key_id = optional(string, null)
tags = optional(map(string), {})
})
lambda = optional(object({
artifact = optional(object({
zip = optional(string, null)
s3 = optional(object({
key = string
object_version = optional(string, null)
}), null)
}), {})
scale = optional(object({
up = optional(object({
memory_size = optional(number, 512)
timeout = optional(number, 60)
reserved_concurrent_executions = optional(number, 1)
job_queued_check_enabled = optional(bool, null)
event_source_mapping = optional(object({
batch_size = optional(number, 10)
maximum_batching_window_in_seconds = optional(number, 0)
}), {})
tags = optional(map(string), {})
}), {})
down = optional(object({
memory_size = optional(number, 512)
timeout = optional(number, 60)
schedule_expression = optional(string, "cron(*/5 * * * ? *)")
minimum_running_time_in_minutes = optional(number, null)
idle_config = optional(list(object({
cron = string
timeZone = string
idleCount = number
evictionStrategy = optional(string, "oldest_first")
})), [])
tags = optional(map(string), {})
}), {})
}), {})
pool = optional(object({
memory_size = optional(number, 512)
timeout = optional(number, 60)
reserved_concurrent_executions = optional(number, 1)
config = optional(list(object({
schedule_expression = string
schedule_expression_timezone = optional(string)
size = number
})), [])
include_busy_runners = optional(bool, false)
runner_owner = optional(string, null)
tags = optional(map(string), {})
}), {})
}), {})
job_retry = optional(object({
enabled = optional(bool, false)
delay_in_seconds = optional(number, 300)
delay_backoff = optional(number, 2)
max_attempts = optional(number, 1)
tags = optional(map(string), {})
lambda = optional(object({
memory_size = optional(number, 256)
reserved_concurrent_executions = optional(number, 1)
timeout = optional(number, 30)
}), {})
}), {})
}), null)
}) | n/a | yes |
+| [prefix](#input\_prefix) | The prefix used for naming resources. | `string` | `"github-actions"` | no |
+| [runner](#input\_runner) | Provider-neutral GitHub runner configuration.
- `os`: Runner operating system. Supported values are `linux`, `osx`, and `windows`.
- `architecture`: Runner distribution architecture, such as `x64` or `arm64`.
- `disable_default_labels`: Prevents GitHub's default self-hosted, operating-system, and architecture labels from being registered.
- `labels`: Complete set of labels supplied to the control-plane functions.
- `group_name`: GitHub runner group used during registration.
- `name_prefix`: Prefix added to registered runner names.
- `run_as_root`: Runs the runner service as root when supported by the compute provider.
- `run_as`: Operating-system user used when `run_as_root` is false.
- `auto_update_disabled`: Disables the GitHub runner application's built-in updater.
- `tags`: Additional tags for common runner resources, currently the managed runner IAM role. These override module-level `tags` with the same key.
- `hooks.job_started`: Script content installed as the runner job-started hook.
- `hooks.job_completed`: Script content installed as the runner job-completed hook.
- `iam.role.arn`: ARN of an externally managed runner role. When set, this module does not create or modify that role.
- `iam.managed_policy_arns`: Named managed-policy ARNs attached to the module-managed runner role.
- `iam.additional_trust_policy_json`: Optional IAM policy document merged with the selected compute provider's default runner-role trust policy.
- `iam.path`: IAM path for the module-managed runner role. Defaults to a path derived from `prefix`.
- `iam.permissions_boundary`: Permissions-boundary ARN for the module-managed runner role. | object({
os = optional(string, "linux")
architecture = optional(string, "x64")
disable_default_labels = optional(bool, false)
labels = list(string)
group_name = optional(string, "Default")
name_prefix = optional(string, "")
run_as_root = optional(bool, false)
run_as = optional(string, "ec2-user")
auto_update_disabled = optional(bool, false)
tags = optional(map(string), {})
hooks = optional(object({
job_started = optional(string, "")
job_completed = optional(string, "")
}), {})
iam = optional(object({
role = optional(object({
arn = string
}), null)
managed_policy_arns = optional(map(string), {})
additional_trust_policy_json = optional(string, null)
path = optional(string, null)
permissions_boundary = optional(string, null)
}), {})
}) | n/a | yes |
+| [ssm](#input\_ssm) | Parameter Store paths, encryption, tag scopes, and housekeeper configuration.
- `paths.root`: Root Parameter Store path for this runner configuration.
- `paths.tokens`: Path segment under `paths.root` used for registration tokens and just-in-time configuration.
- `paths.config`: Path segment under `paths.root` used for persistent runner configuration.
- `kms_key_id`: Optional customer-managed KMS key ARN used by control-plane IAM policies to decrypt shared GitHub App parameters. The ARN may be unknown until apply; null omits the provider-owned KMS statements. It does not select encryption for runtime-created runner parameters.
- `tags`: Shared tags for SSM-related resources. These override module-level `tags` and are inherited by parameter and housekeeper resources.
- `parameters.tags`: Tags for Terraform-managed runner configuration parameters and temporary parameters created by the scale-up and pool Lambdas. These override module-level and `ssm.tags` values with the same key.
- `housekeeper.schedule_expression`: EventBridge schedule expression that invokes the SSM housekeeper.
- `housekeeper.state`: EventBridge rule state, such as `ENABLED` or `DISABLED`.
- `housekeeper.tags`: Tags for housekeeper resources, including the Lambda function, log group, EventBridge rule, and IAM role. These override module-level, `ssm.tags`, shared Lambda, and shared log tags when keys conflict.
- `housekeeper.lambda.artifact`: Component-owned SSM-housekeeper artifact selection. Set at most one of `zip` or `s3`; when neither is selected, the module uses its packaged runner control-plane archive. This selector does not inherit an orchestration-provider artifact.
- `housekeeper.lambda.artifact.zip`: Optional local path to the SSM-housekeeper Lambda archive.
- `housekeeper.lambda.artifact.s3`: Optional object key and version in the shared `lambda.artifact.s3.bucket`. Selecting S3 requires that common bucket.
- `housekeeper.lambda.artifact.s3.key`: Object key of the SSM-housekeeper Lambda archive.
- `housekeeper.lambda.artifact.s3.object_version`: Optional object version of the SSM-housekeeper Lambda archive.
- `housekeeper.lambda.memory_size`: Memory allocated to the SSM housekeeper Lambda in MB.
- `housekeeper.lambda.timeout`: SSM housekeeper Lambda timeout in seconds.
- `housekeeper.config.tokenPath`: Parameter Store token path cleaned by the housekeeper. When omitted, the configured runner token path is used.
- `housekeeper.config.minimumDaysOld`: Minimum parameter age in days before deletion is allowed.
- `housekeeper.config.dryRun`: Reports eligible parameters without deleting them when true. | object({
paths = object({
root = string
tokens = string
config = string
})
kms_key_id = optional(string, null)
tags = optional(map(string), {})
parameters = optional(object({
tags = optional(map(string), {})
}), {})
housekeeper = optional(object({
schedule_expression = optional(string, "rate(1 day)")
state = optional(string, "ENABLED")
tags = optional(map(string), {})
lambda = optional(object({
artifact = optional(object({
zip = optional(string, null)
s3 = optional(object({
key = string
object_version = optional(string, null)
}), null)
}), {})
memory_size = optional(number, 512)
timeout = optional(number, 60)
}), {})
config = optional(object({
tokenPath = optional(string)
minimumDaysOld = optional(number, 1)
dryRun = optional(bool, false)
}), {})
}), {})
}) | n/a | yes |
+| [tags](#input\_tags) | Base tags added to taggable resources created by this runner configuration. Shared, component, and compute-provider tag maps override matching keys within their documented resource scopes. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [orchestration\_provider](#output\_orchestration\_provider) | Resources grouped under the selected runner orchestration provider. |
+| [pool](#output\_pool) | Scheduled pool resources. Null when no pool configuration is supplied. |
+| [provider](#output\_provider) | Provider-specific resources grouped under the selected provider namespace and type. |
+| [runner](#output\_runner) | Common runner resources. The role is null when an external runner role is used. |
+| [scale\_down](#output\_scale\_down) | Scale-down control-plane resources. Null when webhook orchestration is not configured. |
+| [scale\_up](#output\_scale\_up) | Scale-up control-plane resources. Null when webhook orchestration is not configured. |
+
diff --git a/modules/runner-config/common-config.tf b/modules/runner-config/common-config.tf
new file mode 100644
index 0000000000..660fcc60ab
--- /dev/null
+++ b/modules/runner-config/common-config.tf
@@ -0,0 +1,44 @@
+# Shared control-plane configuration: naming, paths, tags, and normalized values.
+locals {
+ common_tags = var.tags
+ runner_tags = merge(local.common_tags, var.runner.tags)
+ lambda_tags = merge(local.common_tags, var.lambda.tags)
+ observability_log_tags = merge(local.common_tags, var.observability.logs.tags)
+
+ ssm_tags = merge(local.common_tags, var.ssm.tags)
+ ssm_parameter_tags = merge(local.ssm_tags, var.ssm.parameters.tags)
+ ssm_housekeeper_tags = merge(local.ssm_tags, var.ssm.housekeeper.tags)
+ ssm_housekeeper_lambda_tags = merge(local.lambda_tags, var.ssm.tags, var.ssm.housekeeper.tags)
+ ssm_housekeeper_log_tags = merge(local.observability_log_tags, var.ssm.tags, var.ssm.housekeeper.tags)
+
+ lambda_role_path = var.lambda.role.path == null ? "/${var.prefix}/" : var.lambda.role.path
+ runner_role_path = var.runner.iam.path == null ? "/${var.prefix}/" : var.runner.iam.path
+ packaged_runners_lambda_zip = "${path.module}/../../lambdas/functions/control-plane/runners.zip"
+ ssm_housekeeper_artifact_s3_selected = (
+ var.ssm.housekeeper.lambda.artifact.s3 != null
+ )
+ ssm_housekeeper_artifact = {
+ zip = local.ssm_housekeeper_artifact_s3_selected ? null : coalesce(
+ var.ssm.housekeeper.lambda.artifact.zip,
+ local.packaged_runners_lambda_zip,
+ )
+ s3 = {
+ bucket = local.ssm_housekeeper_artifact_s3_selected ? var.lambda.artifact.s3.bucket : null
+ key = try(var.ssm.housekeeper.lambda.artifact.s3.key, null)
+ object_version = try(var.ssm.housekeeper.lambda.artifact.s3.object_version, null)
+ }
+ }
+ kms_key_id = var.ssm.kms_key_id
+ token_path = "${var.ssm.paths.root}/${var.ssm.paths.tokens}"
+ arn_ssm_parameters_path_tokens = "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter${var.ssm.paths.root}/${var.ssm.paths.tokens}"
+ arn_ssm_parameters_path_config = "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter${var.ssm.paths.root}/${var.ssm.paths.config}"
+
+ parameter_store_tags = jsonencode([
+ for key, value in local.ssm_parameter_tags : {
+ Key = key
+ Value = value
+ }
+ ])
+}
+
+data "aws_caller_identity" "current" {}
diff --git a/modules/runner-config/compute-provider.aws.ec2.tf b/modules/runner-config/compute-provider.aws.ec2.tf
new file mode 100644
index 0000000000..5d053a73dc
--- /dev/null
+++ b/modules/runner-config/compute-provider.aws.ec2.tf
@@ -0,0 +1,37 @@
+module "compute_aws_ec2_trust_policy" {
+ count = local.provider_key == "aws_ec2" ? 1 : 0
+ source = "../compute-providers/aws/ec2/trust-policy"
+
+ additional_trust_policy_json = var.runner.iam.additional_trust_policy_json
+}
+
+module "compute_aws_ec2" {
+ count = local.provider_key == "aws_ec2" ? 1 : 0
+ source = "../compute-providers/aws/ec2"
+
+ aws_partition = var.aws_partition
+ aws_region = var.aws_region
+ prefix = var.prefix
+ tags = var.tags
+
+ config = var.compute_provider.aws.ec2
+ runner = merge(var.runner, {
+ iam = merge(var.runner.iam, {
+ role = local.runner_role
+ managed_policy_arns = local.common_runner_managed_policy_arns
+ })
+ })
+ github = var.github
+ ssm = var.ssm
+ observability = var.observability
+}
+
+moved {
+ from = module.compute_ec2_trust_policy
+ to = module.compute_aws_ec2_trust_policy
+}
+
+moved {
+ from = module.compute_ec2
+ to = module.compute_aws_ec2
+}
diff --git a/modules/runner-config/compute-provider.aws.microvm.tf b/modules/runner-config/compute-provider.aws.microvm.tf
new file mode 100644
index 0000000000..bdfb5a8f30
--- /dev/null
+++ b/modules/runner-config/compute-provider.aws.microvm.tf
@@ -0,0 +1,27 @@
+module "compute_aws_microvm_trust_policy" {
+ count = local.provider_key == "aws_microvm" ? 1 : 0
+ source = "../compute-providers/aws/microvm/trust-policy"
+
+ additional_trust_policy_json = var.runner.iam.additional_trust_policy_json
+}
+
+module "compute_aws_microvm" {
+ count = local.provider_key == "aws_microvm" ? 1 : 0
+ source = "../compute-providers/aws/microvm"
+
+ aws_partition = var.aws_partition
+ aws_region = var.aws_region
+ prefix = var.prefix
+ tags = var.tags
+
+ config = var.compute_provider.aws.microvm
+ runner = merge(var.runner, {
+ iam = merge(var.runner.iam, {
+ role = local.runner_role
+ managed_policy_arns = local.common_runner_managed_policy_arns
+ })
+ })
+ github = var.github
+ ssm = var.ssm
+ observability = var.observability
+}
diff --git a/modules/runner-config/compute-provider.tf b/modules/runner-config/compute-provider.tf
new file mode 100644
index 0000000000..c768c47c22
--- /dev/null
+++ b/modules/runner-config/compute-provider.tf
@@ -0,0 +1,33 @@
+locals {
+ compute_providers = {
+ aws_ec2 = var.compute_provider.aws.ec2
+ aws_microvm = var.compute_provider.aws.microvm
+ }
+
+ discovered_provider_key = one([
+ for provider_key, provider_config in local.compute_providers : provider_key
+ if provider_config != null
+ ])
+ provider_key = var.compute_provider_key != null ? var.compute_provider_key : local.discovered_provider_key
+
+ provider_types = {
+ aws_ec2 = "ec2"
+ aws_microvm = "microvm"
+ }
+
+ provider_type = local.provider_types[local.provider_key]
+
+ provider_assume_role_policies = {
+ aws_ec2 = try(module.compute_aws_ec2_trust_policy[0].assume_role_policy, null)
+ aws_microvm = try(module.compute_aws_microvm_trust_policy[0].assume_role_policy, null)
+ }
+
+ provider_assume_role_policy = local.provider_assume_role_policies[local.provider_key]
+
+ provider_contracts = {
+ aws_ec2 = one(module.compute_aws_ec2[*].provider)
+ aws_microvm = one(module.compute_aws_microvm[*].provider)
+ }
+
+ provider_contract = local.provider_contracts[local.provider_key]
+}
diff --git a/modules/runner-config/orchestration-provider.tf b/modules/runner-config/orchestration-provider.tf
new file mode 100644
index 0000000000..25994beaba
--- /dev/null
+++ b/modules/runner-config/orchestration-provider.tf
@@ -0,0 +1,73 @@
+locals {
+ orchestration_providers = {
+ for provider_type, provider_config in var.orchestration_provider : provider_type => provider_config
+ if provider_config != null
+ }
+
+ orchestration_provider_type = one(keys(local.orchestration_providers))
+
+ orchestration_provider_enabled = {
+ webhook = local.orchestration_provider_type == "webhook"
+ }
+
+ orchestration_provider_runner_lifecycle = {
+ webhook = one(module.orchestration_webhook[*].runner_lifecycle)
+ }[local.orchestration_provider_type]
+}
+
+module "orchestration_webhook" {
+ source = "../orchestration-providers/webhook"
+ count = local.orchestration_provider_enabled.webhook ? 1 : 0
+
+ aws_partition = var.aws_partition
+ prefix = var.prefix
+ tags = var.tags
+
+ config = var.orchestration_provider.webhook
+ runner = var.runner
+ github = var.github
+ lambda = {
+ artifact = var.lambda.artifact
+ runtime = var.lambda.runtime
+ architecture = var.lambda.architecture
+ subnet_ids = var.lambda.subnet_ids
+ security_group_ids = var.lambda.security_group_ids
+ tags = var.lambda.tags
+ role = {
+ path = local.lambda_role_path
+ permissions_boundary = var.lambda.role.permissions_boundary
+ principals = var.lambda.principals
+ }
+ }
+ ssm = {
+ token_path = local.token_path
+ token_path_arn = local.arn_ssm_parameters_path_tokens
+ config_path = "${var.ssm.paths.root}/${var.ssm.paths.config}"
+ config_path_arn = local.arn_ssm_parameters_path_config
+ kms_key_id = local.kms_key_id
+ parameter_store_tags = local.parameter_store_tags
+ }
+ observability = var.observability
+
+ runner_provider = {
+ type = local.provider_type
+ scale_up = {
+ environment_variables = local.provider_contract.environment_variables.scale_up
+ iam_policy_json = local.provider_contract.policies.scale_up.iam_policy_json
+ additional_iam_policy_json = local.provider_contract.policies.scale_up.additional_iam_policy_json
+ managed_policy = local.provider_contract.policies.scale_up.managed_policy_enabled ? {
+ arn = local.provider_contract.policies.scale_up.managed_policy_arn
+ } : null
+ }
+ scale_down = {
+ environment_variables = local.provider_contract.environment_variables.scale_down
+ iam_policy_json = local.provider_contract.policies.scale_down.iam_policy_json
+ }
+ pool = {
+ environment_variables = local.provider_contract.environment_variables.pool
+ iam_policy_json = local.provider_contract.policies.pool.iam_policy_json
+ managed_policy_enabled = local.provider_contract.policies.pool.managed_policy_enabled
+ managed_policy_arn = local.provider_contract.policies.pool.managed_policy_arn
+ }
+ }
+}
diff --git a/modules/runner-config/outputs.tf b/modules/runner-config/outputs.tf
new file mode 100644
index 0000000000..93582279da
--- /dev/null
+++ b/modules/runner-config/outputs.tf
@@ -0,0 +1,43 @@
+output "runner" {
+ description = "Common runner resources. The role is null when an external runner role is used."
+ value = {
+ role = one(aws_iam_role.runner[*])
+ }
+}
+
+output "scale_up" {
+ description = "Scale-up control-plane resources. Null when webhook orchestration is not configured."
+ value = one(module.orchestration_webhook[*].scale_up)
+}
+
+output "scale_down" {
+ description = "Scale-down control-plane resources. Null when webhook orchestration is not configured."
+ value = one(module.orchestration_webhook[*].scale_down)
+}
+
+output "pool" {
+ description = "Scheduled pool resources. Null when no pool configuration is supplied."
+ value = one(module.orchestration_webhook[*].pool)
+}
+
+output "orchestration_provider" {
+ description = "Resources grouped under the selected runner orchestration provider."
+ value = {
+ webhook = local.orchestration_provider_enabled.webhook ? {
+ scale_up = one(module.orchestration_webhook[*].scale_up)
+ scale_down = one(module.orchestration_webhook[*].scale_down)
+ pool = one(module.orchestration_webhook[*].pool)
+ job_retry = one(module.orchestration_webhook[*].job_retry)
+ } : null
+ }
+}
+
+output "provider" {
+ description = "Provider-specific resources grouped under the selected provider namespace and type."
+ value = {
+ aws = {
+ ec2 = local.provider_key == "aws_ec2" ? local.provider_contract.resources : null
+ microvm = local.provider_key == "aws_microvm" ? local.provider_contract.resources : null
+ }
+ }
+}
diff --git a/modules/runner-config/runner-role.tf b/modules/runner-config/runner-role.tf
new file mode 100644
index 0000000000..6baa1e4206
--- /dev/null
+++ b/modules/runner-config/runner-role.tf
@@ -0,0 +1,48 @@
+locals {
+ # Role ownership belongs to the common runner configuration. The selected trust-policy
+ # submodule supplies the assume-role document, while the full compute provider
+ # supplies permissions after the role has been resolved.
+ create_runner_role = var.runner.iam.role == null
+
+ runner_role = {
+ arn = local.create_runner_role ? one(aws_iam_role.runner[*].arn) : var.runner.iam.role.arn
+ name = local.create_runner_role ? one(aws_iam_role.runner[*].name) : basename(var.runner.iam.role.arn)
+ managed = local.create_runner_role
+ }
+
+ common_runner_managed_policy_arns = merge(
+ {
+ for policy_name, policy_arn in var.runner.iam.managed_policy_arns :
+ "user-${policy_name}" => policy_arn
+ },
+ var.observability.tracing.mode != null ? {
+ xray = "arn:${var.aws_partition}:iam::aws:policy/AWSXRayDaemonWriteAccess"
+ } : {},
+ )
+
+ provider_runner_policies = local.provider_contract.policies.runner
+}
+
+resource "aws_iam_role" "runner" {
+ count = local.create_runner_role ? 1 : 0
+ name = "${substr("${var.prefix}-runner", 0, 54)}-${substr(md5("${var.prefix}-runner"), 0, 8)}"
+ assume_role_policy = local.provider_assume_role_policy
+ path = local.runner_role_path
+ permissions_boundary = var.runner.iam.permissions_boundary
+ tags = local.runner_tags
+}
+
+resource "aws_iam_role_policy" "runner_provider" {
+ for_each = local.create_runner_role ? local.provider_runner_policies.inline_policies : {}
+
+ name = each.value.name
+ role = aws_iam_role.runner[0].name
+ policy = each.value.policy_json
+}
+
+resource "aws_iam_role_policy_attachment" "runner" {
+ for_each = local.create_runner_role ? local.provider_runner_policies.managed_policy_arns : {}
+
+ role = aws_iam_role.runner[0].name
+ policy_arn = each.value
+}
diff --git a/modules/runner-config/runner-ssm-parameters.tf b/modules/runner-config/runner-ssm-parameters.tf
new file mode 100644
index 0000000000..1d97c908a8
--- /dev/null
+++ b/modules/runner-config/runner-ssm-parameters.tf
@@ -0,0 +1,28 @@
+# Shared runner configuration stored in SSM Parameter Store.
+resource "aws_ssm_parameter" "runner_agent_mode" {
+ name = "${var.ssm.paths.root}/${var.ssm.paths.config}/agent_mode"
+ type = "String"
+ value = local.orchestration_provider_runner_lifecycle.ephemeral ? "ephemeral" : "persistent"
+ tags = local.ssm_parameter_tags
+}
+
+resource "aws_ssm_parameter" "disable_default_labels" {
+ name = "${var.ssm.paths.root}/${var.ssm.paths.config}/disable_default_labels"
+ type = "String"
+ value = var.runner.disable_default_labels
+ tags = local.ssm_parameter_tags
+}
+
+resource "aws_ssm_parameter" "jit_config_enabled" {
+ name = "${var.ssm.paths.root}/${var.ssm.paths.config}/enable_jit_config"
+ type = "String"
+ value = local.orchestration_provider_runner_lifecycle.jit_config_enabled
+ tags = local.ssm_parameter_tags
+}
+
+resource "aws_ssm_parameter" "token_path" {
+ name = "${var.ssm.paths.root}/${var.ssm.paths.config}/token_path"
+ type = "String"
+ value = "${var.ssm.paths.root}/${var.ssm.paths.tokens}"
+ tags = local.ssm_parameter_tags
+}
diff --git a/modules/runner-config/ssm-housekeeper.tf b/modules/runner-config/ssm-housekeeper.tf
new file mode 100644
index 0000000000..5bb31bb7b5
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper.tf
@@ -0,0 +1,57 @@
+locals {
+ ssm_housekeeper_token_path = coalesce(var.ssm.housekeeper.config.tokenPath, local.token_path)
+ ssm_housekeeper_parameter_path_arn = (
+ "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter${local.ssm_housekeeper_token_path}*"
+ )
+}
+
+module "ssm_housekeeper" {
+ source = "./ssm-housekeeper"
+
+ config = {
+ prefix = var.prefix
+ aws_partition = var.aws_partition
+ schedule = {
+ expression = var.ssm.housekeeper.schedule_expression
+ state = var.ssm.housekeeper.state
+ }
+ cleanup = {
+ token_path = local.ssm_housekeeper_token_path
+ parameter_path_arn = local.ssm_housekeeper_parameter_path_arn
+ minimum_days_old = var.ssm.housekeeper.config.minimumDaysOld
+ dry_run = var.ssm.housekeeper.config.dryRun
+ }
+ lambda = {
+ # The housekeeper resolves only its component-owned selector and never
+ # inherits the selected orchestration provider's runner-control artifact.
+ artifact = local.ssm_housekeeper_artifact
+ runtime = var.lambda.runtime
+ architecture = var.lambda.architecture
+ memory_size = var.ssm.housekeeper.lambda.memory_size
+ timeout = var.ssm.housekeeper.lambda.timeout
+ vpc = {
+ subnet_ids = var.lambda.subnet_ids
+ security_group_ids = var.lambda.security_group_ids
+ }
+ role = {
+ path = local.lambda_role_path
+ permissions_boundary = var.lambda.role.permissions_boundary
+ principals = var.lambda.principals
+ }
+ }
+ observability = {
+ logs = {
+ level = var.observability.logs.level
+ retention_in_days = var.observability.logs.retention_in_days
+ kms_key_id = var.observability.logs.kms_key_id
+ class = var.observability.logs.class
+ }
+ tracing = var.observability.tracing
+ }
+ tags = {
+ resources = local.ssm_housekeeper_tags
+ lambda = local.ssm_housekeeper_lambda_tags
+ log_group = local.ssm_housekeeper_log_tags
+ }
+ }
+}
diff --git a/modules/runner-config/ssm-housekeeper/README.md b/modules/runner-config/ssm-housekeeper/README.md
new file mode 100644
index 0000000000..5f5d1ad166
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/README.md
@@ -0,0 +1,57 @@
+# SSM housekeeper module
+
+> This module is treated as an internal module; breaking changes do not trigger a major release bump.
+
+This provider-neutral child module owns the Lambda function, EventBridge schedule, IAM policies, and CloudWatch log group used to remove expired runner registration parameters from Parameter Store.
+
+The module is an implementation detail of the experimental runner configuration. It is composed by `runner-config` and is not intended to be called directly.
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 1.3.0 |
+| [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [aws](#provider\_aws) | >= 6.33 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_event_rule.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
+| [aws_cloudwatch_event_target.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
+| [aws_cloudwatch_log_group.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_iam_role.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.ssm_housekeeper_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.ssm_housekeeper_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy_attachment.ssm_housekeeper_vpc_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_lambda_function.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
+| [aws_lambda_permission.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
+| [aws_iam_policy_document.lambda_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.ssm_housekeeper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.ssm_housekeeper_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| [config](#input\_config) | Provider-neutral SSM housekeeper configuration assembled by runner-config.
- `prefix`: Prefix used to name the housekeeper resources.
- `aws_partition`: AWS partition used to construct IAM policy ARNs.
- `schedule.expression`: EventBridge schedule expression that invokes the housekeeper.
- `schedule.state`: State of the EventBridge rule.
- `cleanup.token_path`: Parameter Store token path supplied to the Lambda.
- `cleanup.parameter_path_arn`: IAM resource ARN matching `cleanup.token_path`.
- `cleanup.minimum_days_old`: Minimum parameter age before deletion.
- `cleanup.dry_run`: Reports eligible parameters without deleting them when true.
- `lambda.artifact.zip`: Resolved local control-plane archive.
- `lambda.artifact.s3.bucket`: Optional S3 bucket containing the Lambda archive.
- `lambda.artifact.s3.key`: Object key of the Lambda archive.
- `lambda.artifact.s3.object_version`: Optional object version of the Lambda archive.
- `lambda.runtime`: Runtime used by the housekeeper Lambda.
- `lambda.architecture`: Instruction-set architecture used by the housekeeper Lambda.
- `lambda.memory_size`: Memory allocated to the housekeeper Lambda.
- `lambda.timeout`: Housekeeper Lambda timeout in seconds.
- `lambda.vpc.subnet_ids`: Subnets used for Lambda VPC configuration.
- `lambda.vpc.security_group_ids`: Security groups used for Lambda VPC configuration.
- `lambda.role.path`: IAM path used for the housekeeper Lambda role.
- `lambda.role.permissions_boundary`: Optional permissions boundary for the housekeeper role.
- `lambda.role.principals`: Additional principals allowed to assume the housekeeper Lambda role.
- `observability.logs`: Logging level, retention, encryption, and log-class configuration.
- `observability.tracing`: Lambda X-Ray and tracing-helper configuration.
- `tags.resources`: Tags for the housekeeper role and EventBridge rule.
- `tags.lambda`: Tags for the housekeeper Lambda function.
- `tags.log_group`: Tags for the housekeeper log group. | object({
prefix = string
aws_partition = string
schedule = object({
expression = string
state = string
})
cleanup = object({
token_path = string
parameter_path_arn = string
minimum_days_old = number
dry_run = bool
})
lambda = object({
artifact = object({
zip = string
s3 = object({
bucket = optional(string, null)
key = optional(string, null)
object_version = optional(string, null)
})
})
runtime = string
architecture = string
memory_size = number
timeout = number
vpc = object({
subnet_ids = list(string)
security_group_ids = list(string)
})
role = object({
path = string
permissions_boundary = optional(string, null)
principals = optional(list(object({
type = string
identifiers = list(string)
})), [])
})
})
observability = object({
logs = object({
level = string
retention_in_days = number
kms_key_id = optional(string, null)
class = string
})
tracing = object({
mode = optional(string, null)
capture_http_requests = bool
capture_error = bool
})
})
tags = object({
resources = map(string)
lambda = map(string)
log_group = map(string)
})
}) | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [housekeeper](#output\_housekeeper) | SSM housekeeper Lambda resources. |
+
diff --git a/modules/runner-config/ssm-housekeeper/iam-policies.tf b/modules/runner-config/ssm-housekeeper/iam-policies.tf
new file mode 100644
index 0000000000..8d3bab2865
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/iam-policies.tf
@@ -0,0 +1,58 @@
+data "aws_iam_policy_document" "lambda_assume_role" {
+ statement {
+ actions = ["sts:AssumeRole"]
+
+ principals {
+ type = "Service"
+ identifiers = ["lambda.amazonaws.com"]
+ }
+
+ dynamic "principals" {
+ for_each = var.config.lambda.role.principals
+
+ content {
+ type = principals.value.type
+ identifiers = principals.value.identifiers
+ }
+ }
+ }
+}
+
+data "aws_iam_policy_document" "lambda_xray" {
+ count = var.config.observability.tracing.mode != null ? 1 : 0
+
+ # AWS X-Ray trace APIs do not support resource-level permissions.
+ statement {
+ sid = "AllowXRay"
+ effect = "Allow"
+ actions = [
+ "xray:BatchGetTraces",
+ "xray:GetTraceSummaries",
+ "xray:PutTelemetryRecords",
+ "xray:PutTraceSegments",
+ ]
+ resources = ["*"]
+ }
+}
+
+data "aws_iam_policy_document" "ssm_housekeeper" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "ssm:DeleteParameter",
+ "ssm:GetParametersByPath",
+ ]
+ resources = [var.config.cleanup.parameter_path_arn]
+ }
+}
+
+data "aws_iam_policy_document" "ssm_housekeeper_logging" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "logs:CreateLogStream",
+ "logs:PutLogEvents",
+ ]
+ resources = ["${aws_cloudwatch_log_group.ssm_housekeeper.arn}*"]
+ }
+}
diff --git a/modules/runner-config/ssm-housekeeper/outputs.tf b/modules/runner-config/ssm-housekeeper/outputs.tf
new file mode 100644
index 0000000000..064f5a1ab1
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/outputs.tf
@@ -0,0 +1,8 @@
+output "housekeeper" {
+ description = "SSM housekeeper Lambda resources."
+ value = {
+ lambda = aws_lambda_function.ssm_housekeeper
+ log_group = aws_cloudwatch_log_group.ssm_housekeeper
+ role = aws_iam_role.ssm_housekeeper
+ }
+}
diff --git a/modules/runner-config/ssm-housekeeper/ssm-housekeeper.tf b/modules/runner-config/ssm-housekeeper/ssm-housekeeper.tf
new file mode 100644
index 0000000000..bcafed201a
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/ssm-housekeeper.tf
@@ -0,0 +1,119 @@
+locals {
+ vpc_enabled = (
+ length(var.config.lambda.vpc.subnet_ids) > 0 &&
+ length(var.config.lambda.vpc.security_group_ids) > 0
+ )
+
+ cleanup_config = {
+ tokenPath = var.config.cleanup.token_path
+ minimumDaysOld = var.config.cleanup.minimum_days_old
+ dryRun = var.config.cleanup.dry_run
+ }
+}
+
+resource "aws_lambda_function" "ssm_housekeeper" {
+ s3_bucket = var.config.lambda.artifact.s3.bucket
+ s3_key = var.config.lambda.artifact.s3.key
+ s3_object_version = var.config.lambda.artifact.s3.object_version
+ filename = var.config.lambda.artifact.s3.bucket == null ? var.config.lambda.artifact.zip : null
+ source_code_hash = var.config.lambda.artifact.s3.bucket == null ? filebase64sha256(var.config.lambda.artifact.zip) : null
+ function_name = "${var.config.prefix}-ssm-housekeeper"
+ role = aws_iam_role.ssm_housekeeper.arn
+ handler = "index.ssmHousekeeper"
+ runtime = var.config.lambda.runtime
+ timeout = var.config.lambda.timeout
+ tags = var.config.tags.lambda
+ memory_size = var.config.lambda.memory_size
+ architectures = [var.config.lambda.architecture]
+
+ environment {
+ variables = {
+ ENVIRONMENT = var.config.prefix
+ LOG_LEVEL = upper(var.config.observability.logs.level)
+ SSM_CLEANUP_CONFIG = jsonencode(local.cleanup_config)
+ POWERTOOLS_SERVICE_NAME = "${var.config.prefix}-ssm-housekeeper"
+ POWERTOOLS_TRACE_ENABLED = var.config.observability.tracing.mode != null
+ POWERTOOLS_TRACER_CAPTURE_HTTPS_REQUESTS = var.config.observability.tracing.capture_http_requests
+ POWERTOOLS_TRACER_CAPTURE_ERROR = var.config.observability.tracing.capture_error
+ }
+ }
+
+ dynamic "vpc_config" {
+ for_each = local.vpc_enabled ? [true] : []
+
+ content {
+ security_group_ids = var.config.lambda.vpc.security_group_ids
+ subnet_ids = var.config.lambda.vpc.subnet_ids
+ }
+ }
+
+ dynamic "tracing_config" {
+ for_each = var.config.observability.tracing.mode != null ? [true] : []
+
+ content {
+ mode = var.config.observability.tracing.mode
+ }
+ }
+}
+
+resource "aws_cloudwatch_log_group" "ssm_housekeeper" {
+ name = "/aws/lambda/${aws_lambda_function.ssm_housekeeper.function_name}"
+ retention_in_days = var.config.observability.logs.retention_in_days
+ kms_key_id = var.config.observability.logs.kms_key_id
+ log_group_class = var.config.observability.logs.class
+ tags = var.config.tags.log_group
+}
+
+resource "aws_cloudwatch_event_rule" "ssm_housekeeper" {
+ name = "${var.config.prefix}-ssm-housekeeper"
+ schedule_expression = var.config.schedule.expression
+ state = var.config.schedule.state
+ tags = var.config.tags.resources
+}
+
+resource "aws_cloudwatch_event_target" "ssm_housekeeper" {
+ rule = aws_cloudwatch_event_rule.ssm_housekeeper.name
+ arn = aws_lambda_function.ssm_housekeeper.arn
+}
+
+resource "aws_lambda_permission" "ssm_housekeeper" {
+ statement_id = "AllowExecutionFromCloudWatch"
+ action = "lambda:InvokeFunction"
+ function_name = aws_lambda_function.ssm_housekeeper.function_name
+ principal = "events.amazonaws.com"
+ source_arn = aws_cloudwatch_event_rule.ssm_housekeeper.arn
+}
+
+resource "aws_iam_role" "ssm_housekeeper" {
+ name = "${substr("${var.config.prefix}-ssm-hk-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-ssm-hk-lambda"), 0, 8)}"
+ description = "Lambda role for SSM Housekeeper (${var.config.prefix})"
+ assume_role_policy = data.aws_iam_policy_document.lambda_assume_role.json
+ path = var.config.lambda.role.path
+ permissions_boundary = var.config.lambda.role.permissions_boundary
+ tags = var.config.tags.resources
+}
+
+resource "aws_iam_role_policy" "ssm_housekeeper" {
+ name = "ssm-policy"
+ role = aws_iam_role.ssm_housekeeper.name
+ policy = data.aws_iam_policy_document.ssm_housekeeper.json
+}
+
+resource "aws_iam_role_policy" "ssm_housekeeper_logging" {
+ name = "logging-policy"
+ role = aws_iam_role.ssm_housekeeper.name
+ policy = data.aws_iam_policy_document.ssm_housekeeper_logging.json
+}
+
+resource "aws_iam_role_policy_attachment" "ssm_housekeeper_vpc_execution_role" {
+ count = local.vpc_enabled ? 1 : 0
+ role = aws_iam_role.ssm_housekeeper.name
+ policy_arn = "arn:${var.config.aws_partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy" "ssm_housekeeper_xray" {
+ count = var.config.observability.tracing.mode != null ? 1 : 0
+ name = "xray-policy"
+ policy = data.aws_iam_policy_document.lambda_xray[0].json
+ role = aws_iam_role.ssm_housekeeper.name
+}
diff --git a/modules/runner-config/ssm-housekeeper/tests/ssm-housekeeper.tftest.hcl b/modules/runner-config/ssm-housekeeper/tests/ssm-housekeeper.tftest.hcl
new file mode 100644
index 0000000000..bac30c6752
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/tests/ssm-housekeeper.tftest.hcl
@@ -0,0 +1,263 @@
+mock_provider "aws" {
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ }
+ }
+
+ mock_resource "aws_iam_role" {
+ defaults = {
+ arn = "arn:aws:iam::123456789012:role/ssm-housekeeper-test"
+ }
+ }
+
+ mock_resource "aws_lambda_function" {
+ defaults = {
+ arn = "arn:aws:lambda:eu-west-1:123456789012:function:ssm-housekeeper-test"
+ }
+ }
+
+ mock_resource "aws_cloudwatch_event_rule" {
+ defaults = {
+ arn = "arn:aws:events:eu-west-1:123456789012:rule/ssm-housekeeper-test"
+ }
+ }
+
+ mock_resource "aws_cloudwatch_log_group" {
+ defaults = {
+ arn = "arn:aws:logs:eu-west-1:123456789012:log-group:/aws/lambda/ssm-housekeeper-test"
+ }
+ }
+}
+
+variables {
+ config = {
+ prefix = "ssm-housekeeper-test"
+ aws_partition = "aws-us-gov"
+ schedule = {
+ expression = "rate(6 hours)"
+ state = "DISABLED"
+ }
+ cleanup = {
+ token_path = "/custom/runner/tokens"
+ parameter_path_arn = "arn:aws-us-gov:ssm:us-gov-west-1:123456789012:parameter/custom/runner/tokens*"
+ minimum_days_old = 7
+ dry_run = true
+ }
+ lambda = {
+ artifact = {
+ zip = "unused-with-s3.zip"
+ s3 = {
+ bucket = "lambda-artifacts"
+ key = "control-plane/runners.zip"
+ object_version = "version-1"
+ }
+ }
+ runtime = "nodejs24.x"
+ architecture = "arm64"
+ memory_size = 384
+ timeout = 45
+ vpc = {
+ subnet_ids = []
+ security_group_ids = []
+ }
+ role = {
+ path = "/runner-config/"
+ permissions_boundary = null
+ principals = [{
+ type = "AWS"
+ identifiers = ["arn:aws-us-gov:iam::123456789012:role/local-testing"]
+ }]
+ }
+ }
+ observability = {
+ logs = {
+ level = "debug"
+ retention_in_days = 30
+ kms_key_id = null
+ class = "STANDARD"
+ }
+ tracing = {
+ mode = null
+ capture_http_requests = false
+ capture_error = false
+ }
+ }
+ tags = {
+ resources = {
+ Scope = "housekeeper"
+ }
+ lambda = {
+ Scope = "housekeeper"
+ Resource = "lambda"
+ }
+ log_group = {
+ Scope = "housekeeper"
+ Resource = "logs"
+ }
+ }
+ }
+}
+
+run "configures_schedule_cleanup_and_outputs" {
+ command = plan
+
+ assert {
+ condition = (
+ length(data.aws_iam_policy_document.lambda_assume_role.statement[0].principals) == 2 &&
+ contains(data.aws_iam_policy_document.lambda_assume_role.statement[0].principals[*].type, "AWS")
+ )
+ error_message = "The housekeeper Lambda trust policy must include configured additional principals."
+ }
+
+ assert {
+ condition = (
+ aws_cloudwatch_event_rule.ssm_housekeeper.schedule_expression == "rate(6 hours)" &&
+ aws_cloudwatch_event_rule.ssm_housekeeper.state == "DISABLED"
+ )
+ error_message = "The housekeeper EventBridge rule must use the configured schedule and state."
+ }
+
+ assert {
+ condition = (
+ jsondecode(aws_lambda_function.ssm_housekeeper.environment[0].variables["SSM_CLEANUP_CONFIG"]).tokenPath == "/custom/runner/tokens" &&
+ jsondecode(aws_lambda_function.ssm_housekeeper.environment[0].variables["SSM_CLEANUP_CONFIG"]).minimumDaysOld == 7 &&
+ jsondecode(aws_lambda_function.ssm_housekeeper.environment[0].variables["SSM_CLEANUP_CONFIG"]).dryRun
+ )
+ error_message = "The Lambda cleanup configuration must preserve the configured path override, age, and dry-run setting."
+ }
+
+ assert {
+ condition = contains(
+ data.aws_iam_policy_document.ssm_housekeeper.statement[0].resources,
+ "arn:aws-us-gov:ssm:us-gov-west-1:123456789012:parameter/custom/runner/tokens*",
+ )
+ error_message = "The housekeeper IAM policy must authorize the same overridden Parameter Store path supplied to the Lambda."
+ }
+
+ assert {
+ condition = toset(keys(output.housekeeper)) == toset(["lambda", "log_group", "role"])
+ error_message = "The module must expose Lambda, log-group, and role resources through one nested housekeeper output."
+ }
+
+ assert {
+ condition = (
+ output.housekeeper.lambda.tags == tomap({
+ Scope = "housekeeper"
+ Resource = "lambda"
+ }) &&
+ output.housekeeper.log_group.tags == tomap({
+ Scope = "housekeeper"
+ Resource = "logs"
+ }) &&
+ output.housekeeper.role.tags == tomap({
+ Scope = "housekeeper"
+ })
+ )
+ error_message = "Each nested output resource must retain its resolved component tags."
+ }
+
+ assert {
+ condition = (
+ length(aws_lambda_function.ssm_housekeeper.vpc_config) == 0 &&
+ length(aws_iam_role_policy_attachment.ssm_housekeeper_vpc_execution_role) == 0 &&
+ length(aws_lambda_function.ssm_housekeeper.tracing_config) == 0 &&
+ length(aws_iam_role_policy.ssm_housekeeper_xray) == 0
+ )
+ error_message = "Empty VPC configuration and disabled tracing must not create their optional Lambda or IAM configuration."
+ }
+}
+
+run "enables_vpc_and_xray_together" {
+ command = plan
+
+ variables {
+ config = {
+ prefix = "ssm-housekeeper-vpc-test"
+ aws_partition = "aws-us-gov"
+ schedule = {
+ expression = "rate(1 day)"
+ state = "ENABLED"
+ }
+ cleanup = {
+ token_path = "/github-runner/tokens"
+ parameter_path_arn = "arn:aws-us-gov:ssm:us-gov-west-1:123456789012:parameter/github-runner/tokens*"
+ minimum_days_old = 1
+ dry_run = false
+ }
+ lambda = {
+ artifact = {
+ zip = "unused-with-s3.zip"
+ s3 = {
+ bucket = "lambda-artifacts"
+ key = "control-plane/runners.zip"
+ }
+ }
+ runtime = "nodejs24.x"
+ architecture = "arm64"
+ memory_size = 512
+ timeout = 60
+ vpc = {
+ subnet_ids = ["subnet-12345678"]
+ security_group_ids = ["sg-12345678"]
+ }
+ role = {
+ path = "/runner-config/"
+ permissions_boundary = null
+ }
+ }
+ observability = {
+ logs = {
+ level = "info"
+ retention_in_days = 14
+ kms_key_id = null
+ class = "STANDARD"
+ }
+ tracing = {
+ mode = "Active"
+ capture_http_requests = true
+ capture_error = true
+ }
+ }
+ tags = {
+ resources = {}
+ lambda = {}
+ log_group = {}
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ length(aws_lambda_function.ssm_housekeeper.vpc_config) == 1 &&
+ aws_lambda_function.ssm_housekeeper.vpc_config[0].subnet_ids == toset(["subnet-12345678"]) &&
+ aws_lambda_function.ssm_housekeeper.vpc_config[0].security_group_ids == toset(["sg-12345678"]) &&
+ length(aws_iam_role_policy_attachment.ssm_housekeeper_vpc_execution_role) == 1 &&
+ aws_iam_role_policy_attachment.ssm_housekeeper_vpc_execution_role[0].policy_arn == "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+ )
+ error_message = "A complete VPC configuration must configure the Lambda and attach the partition-aware VPC execution policy."
+ }
+
+ assert {
+ condition = (
+ length(aws_lambda_function.ssm_housekeeper.tracing_config) == 1 &&
+ aws_lambda_function.ssm_housekeeper.tracing_config[0].mode == "Active" &&
+ length(aws_iam_role_policy.ssm_housekeeper_xray) == 1 &&
+ aws_lambda_function.ssm_housekeeper.environment[0].variables["POWERTOOLS_TRACE_ENABLED"] == "true" &&
+ aws_lambda_function.ssm_housekeeper.environment[0].variables["POWERTOOLS_TRACER_CAPTURE_HTTPS_REQUESTS"] == "true" &&
+ aws_lambda_function.ssm_housekeeper.environment[0].variables["POWERTOOLS_TRACER_CAPTURE_ERROR"] == "true"
+ )
+ error_message = "Active tracing must configure Lambda tracing, X-Ray IAM permissions, and tracing-helper environment variables."
+ }
+
+ assert {
+ condition = (
+ data.aws_iam_policy_document.lambda_xray[0].statement[0].resources == toset(["*"])
+ && alltrue([
+ for action in data.aws_iam_policy_document.lambda_xray[0].statement[0].actions :
+ startswith(action, "xray:")
+ ])
+ )
+ error_message = "The housekeeper wildcard resource must be limited to X-Ray APIs, which do not support resource-level IAM permissions."
+ }
+}
diff --git a/modules/runner-config/ssm-housekeeper/variables.tf b/modules/runner-config/ssm-housekeeper/variables.tf
new file mode 100644
index 0000000000..64848fc33c
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/variables.tf
@@ -0,0 +1,93 @@
+variable "config" {
+ description = <<-EOT
+ Provider-neutral SSM housekeeper configuration assembled by runner-config.
+
+ - `prefix`: Prefix used to name the housekeeper resources.
+ - `aws_partition`: AWS partition used to construct IAM policy ARNs.
+ - `schedule.expression`: EventBridge schedule expression that invokes the housekeeper.
+ - `schedule.state`: State of the EventBridge rule.
+ - `cleanup.token_path`: Parameter Store token path supplied to the Lambda.
+ - `cleanup.parameter_path_arn`: IAM resource ARN matching `cleanup.token_path`.
+ - `cleanup.minimum_days_old`: Minimum parameter age before deletion.
+ - `cleanup.dry_run`: Reports eligible parameters without deleting them when true.
+ - `lambda.artifact.zip`: Resolved local control-plane archive.
+ - `lambda.artifact.s3.bucket`: Optional S3 bucket containing the Lambda archive.
+ - `lambda.artifact.s3.key`: Object key of the Lambda archive.
+ - `lambda.artifact.s3.object_version`: Optional object version of the Lambda archive.
+ - `lambda.runtime`: Runtime used by the housekeeper Lambda.
+ - `lambda.architecture`: Instruction-set architecture used by the housekeeper Lambda.
+ - `lambda.memory_size`: Memory allocated to the housekeeper Lambda.
+ - `lambda.timeout`: Housekeeper Lambda timeout in seconds.
+ - `lambda.vpc.subnet_ids`: Subnets used for Lambda VPC configuration.
+ - `lambda.vpc.security_group_ids`: Security groups used for Lambda VPC configuration.
+ - `lambda.role.path`: IAM path used for the housekeeper Lambda role.
+ - `lambda.role.permissions_boundary`: Optional permissions boundary for the housekeeper role.
+ - `lambda.role.principals`: Additional principals allowed to assume the housekeeper Lambda role.
+ - `observability.logs`: Logging level, retention, encryption, and log-class configuration.
+ - `observability.tracing`: Lambda X-Ray and tracing-helper configuration.
+ - `tags.resources`: Tags for the housekeeper role and EventBridge rule.
+ - `tags.lambda`: Tags for the housekeeper Lambda function.
+ - `tags.log_group`: Tags for the housekeeper log group.
+ EOT
+
+ type = object({
+ prefix = string
+ aws_partition = string
+ schedule = object({
+ expression = string
+ state = string
+ })
+ cleanup = object({
+ token_path = string
+ parameter_path_arn = string
+ minimum_days_old = number
+ dry_run = bool
+ })
+ lambda = object({
+ artifact = object({
+ zip = string
+ s3 = object({
+ bucket = optional(string, null)
+ key = optional(string, null)
+ object_version = optional(string, null)
+ })
+ })
+ runtime = string
+ architecture = string
+ memory_size = number
+ timeout = number
+ vpc = object({
+ subnet_ids = list(string)
+ security_group_ids = list(string)
+ })
+ role = object({
+ path = string
+ permissions_boundary = optional(string, null)
+ principals = optional(list(object({
+ type = string
+ identifiers = list(string)
+ })), [])
+ })
+ })
+ observability = object({
+ logs = object({
+ level = string
+ retention_in_days = number
+ kms_key_id = optional(string, null)
+ class = string
+ })
+ tracing = object({
+ mode = optional(string, null)
+ capture_http_requests = bool
+ capture_error = bool
+ })
+ })
+ tags = object({
+ resources = map(string)
+ lambda = map(string)
+ log_group = map(string)
+ })
+ })
+
+ nullable = false
+}
diff --git a/modules/runner-config/ssm-housekeeper/versions.tf b/modules/runner-config/ssm-housekeeper/versions.tf
new file mode 100644
index 0000000000..da9769f550
--- /dev/null
+++ b/modules/runner-config/ssm-housekeeper/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.3.0"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 6.33"
+ }
+ }
+}
diff --git a/modules/runner-config/tests/README.md b/modules/runner-config/tests/README.md
new file mode 100644
index 0000000000..fa55dfecd9
--- /dev/null
+++ b/modules/runner-config/tests/README.md
@@ -0,0 +1,72 @@
+# Terraform Tests
+
+This directory contains [Terraform test files](https://developer.hashicorp.com/terraform/language/tests) (`.tftest.hcl`) for the runners module.
+
+## Why `terraform test` instead of `terraform validate`?
+
+`terraform validate` only checks syntax and basic type correctness of the configuration. It **cannot** detect:
+
+- Conditional expressions with inconsistent result types (e.g., one branch returns an object with 1 attribute, the other returns 16)
+- Runtime type mismatches that only surface during `plan`
+- Invalid cross-module references that depend on resource attribute shapes
+
+`terraform test` with `mock_provider` runs a full plan without needing real cloud credentials, catching these classes of bugs in CI.
+
+## Requirements
+
+- Terraform >= 1.7 (for `mock_provider` and `mock_data` support)
+- No AWS credentials required — all providers are mocked
+
+## Running locally
+
+```bash
+cd modules/runners
+terraform test -test-directory=tests
+```
+
+Expected output:
+
+```
+tests/pool.tftest.hcl... in progress
+ run "plan_with_pool_enabled"... pass
+tests/pool.tftest.hcl... pass
+
+Success! 1 passed, 0 failed.
+```
+
+## Writing new tests
+
+1. Create a `.tftest.hcl` file in this directory
+2. Use `mock_provider "aws" {}` to avoid needing credentials
+3. Use `mock_data` blocks to provide realistic values for data sources that perform validation (e.g., `aws_iam_policy_document` validates JSON)
+4. Set all required variables in a `variables {}` block
+5. Use `run` blocks with `command = plan` and `assert` conditions
+
+### Example template
+
+```hcl
+mock_provider "aws" {
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
+ }
+ }
+}
+
+variables {
+ # ... required variables ...
+}
+
+run "descriptive_test_name" {
+ command = plan
+
+ assert {
+ condition =
+ error_message = "Explanation of what failed"
+ }
+}
+```
+
+## CI integration
+
+These tests run automatically in the `terraform_test` job of `.github/workflows/terraform.yml` on every PR that touches `*.tf` or `*.hcl` files.
diff --git a/modules/runner-config/tests/computed-iam-inputs.tftest.hcl b/modules/runner-config/tests/computed-iam-inputs.tftest.hcl
new file mode 100644
index 0000000000..ff36530377
--- /dev/null
+++ b/modules/runner-config/tests/computed-iam-inputs.tftest.hcl
@@ -0,0 +1,44 @@
+mock_provider "aws" {
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ }
+ }
+}
+
+run "computed_external_values_keep_plan_shape_known" {
+ command = plan
+
+ module {
+ source = "./tests/fixtures/computed-iam-inputs"
+ }
+
+ # The packaged runner archive is added by the release build, so the computed
+ # IAM fixture isolates the two common housekeeper children in a source checkout.
+ override_module {
+ target = module.external_iam.module.ssm_housekeeper
+ }
+
+ override_module {
+ target = module.generated_policy.module.ssm_housekeeper
+ }
+
+ override_module {
+ target = module.computed_microvm.module.ssm_housekeeper
+ }
+
+ assert {
+ condition = output.external_role_runner_count == 0
+ error_message = "Computed external AMI parameter, KMS key, role, and profile values must not make resource or policy-block counts unknown."
+ }
+
+ assert {
+ condition = output.generated_policy_role_runner_count == 1
+ error_message = "A computed managed-policy ARN under a caller-known map key must keep attachment planning stable."
+ }
+
+ assert {
+ condition = output.computed_microvm_role_runner_count == 1
+ error_message = "A computed MicroVM image ARN and computed managed-policy ARNs inside plan-known wrappers must keep provider dispatch and attachment counts stable."
+ }
+}
diff --git a/modules/runner-config/tests/fixtures/computed-iam-inputs/README.md b/modules/runner-config/tests/fixtures/computed-iam-inputs/README.md
new file mode 100644
index 0000000000..46d64bdce2
--- /dev/null
+++ b/modules/runner-config/tests/fixtures/computed-iam-inputs/README.md
@@ -0,0 +1,42 @@
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| [terraform](#requirement\_terraform) | >= 1.3 |
+| [random](#requirement\_random) | ~> 3.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| [random](#provider\_random) | ~> 3.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| [computed\_microvm](#module\_computed\_microvm) | ../../.. | n/a |
+| [external\_iam](#module\_external\_iam) | ../../.. | n/a |
+| [generated\_policy](#module\_generated\_policy) | ../../.. | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [random_id.external](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+| [random_id.generated_policy](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+| [random_id.microvm](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [computed\_microvm\_role\_runner\_count](#output\_computed\_microvm\_role\_runner\_count) | n/a |
+| [external\_role\_runner\_count](#output\_external\_role\_runner\_count) | n/a |
+| [generated\_policy\_role\_runner\_count](#output\_generated\_policy\_role\_runner\_count) | n/a |
+
diff --git a/modules/runner-config/tests/fixtures/computed-iam-inputs/computed-iam-inputs.tf b/modules/runner-config/tests/fixtures/computed-iam-inputs/computed-iam-inputs.tf
new file mode 100644
index 0000000000..a4114c5832
--- /dev/null
+++ b/modules/runner-config/tests/fixtures/computed-iam-inputs/computed-iam-inputs.tf
@@ -0,0 +1,314 @@
+# A .tftest.hcl variable block supplies plan-known values. This wrapper uses
+# random_id results to exercise caller inputs that remain unknown during plan,
+# which catches invalid count, for_each, and dynamic-block expressions in the
+# IAM boundary.
+resource "random_id" "external" {
+ byte_length = 4
+}
+
+resource "random_id" "generated_policy" {
+ byte_length = 4
+}
+
+resource "random_id" "microvm" {
+ byte_length = 4
+}
+
+module "external_iam" {
+ source = "../../.."
+
+ aws_region = "eu-west-1"
+ prefix = "computed-external"
+
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ ami = {
+ id_ssm_parameter = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/external-ami-${random_id.external.hex}"
+ }
+ kms_key = {
+ arn = "arn:aws:kms:eu-west-1:123456789012:key/${random_id.external.hex}"
+ }
+ }
+ instance_profile = {
+ name = "external-runner-${random_id.external.hex}"
+ }
+ cloudwatch_agent = {
+ enabled = false
+ }
+ binaries_syncer = {
+ enabled = false
+ }
+ }
+ }
+ }
+
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external-runner-${random_id.external.hex}"
+ }
+ }
+ }
+
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = "lambda-artifacts"
+ }
+ }
+ }
+
+ github = {
+ app_parameters = {
+ key_base64 = [{
+ name = "/github-runner/key-base64"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/key-base64"
+ }]
+ id = [{
+ name = "/github-runner/app-id"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/app-id"
+ }]
+ installation_id = [null]
+ }
+ }
+
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ maximum_count = 3
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:computed-external"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/computed-external"
+ }
+ kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/build-queue-${random_id.external.hex}"
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ pool = {
+ runner_owner = "example"
+ config = [{
+ schedule_expression = "cron(0 8 * * ? *)"
+ size = 1
+ }]
+ }
+ }
+ job_retry = {
+ enabled = true
+ }
+ }
+ }
+
+ ssm = {
+ kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/${random_id.external.hex}"
+ paths = {
+ root = "/github-runner/computed-external"
+ tokens = "tokens"
+ config = "config"
+ }
+ }
+}
+
+module "generated_policy" {
+ source = "../../.."
+
+ aws_region = "eu-west-1"
+ prefix = "computed-policy"
+
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ cloudwatch_agent = {
+ enabled = false
+ }
+ binaries_syncer = {
+ enabled = false
+ }
+ }
+ }
+ }
+
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ managed_policy_arns = {
+ generated = "arn:aws:iam::123456789012:policy/generated-runner-${random_id.generated_policy.hex}"
+ }
+ }
+ }
+
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = "lambda-artifacts"
+ }
+ }
+ }
+
+ github = {
+ app_parameters = {
+ key_base64 = [{
+ name = "/github-runner/key-base64"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/key-base64"
+ }]
+ id = [{
+ name = "/github-runner/app-id"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/app-id"
+ }]
+ installation_id = [null]
+ }
+ }
+
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ maximum_count = 3
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:computed-policy"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/computed-policy"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ }
+ }
+ }
+
+ ssm = {
+ paths = {
+ root = "/github-runner/computed-policy"
+ tokens = "tokens"
+ config = "config"
+ }
+ }
+}
+
+module "computed_microvm" {
+ source = "../../.."
+
+ aws_region = "eu-west-1"
+ prefix = "computed-microvm"
+
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-${random_id.microvm.hex}"
+ iam = {
+ managed_policies = {
+ scale_up = {
+ arn = "arn:aws:iam::123456789012:policy/microvm-scale-up-${random_id.microvm.hex}"
+ }
+ pool = {
+ arn = "arn:aws:iam::123456789012:policy/microvm-pool-${random_id.microvm.hex}"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ labels = ["self-hosted", "linux", "arm64", "microvm"]
+ }
+
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = "lambda-artifacts"
+ }
+ }
+ }
+
+ github = {
+ app_parameters = {
+ key_base64 = [{
+ name = "/github-runner/key-base64"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/key-base64"
+ }]
+ id = [{
+ name = "/github-runner/app-id"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/app-id"
+ }]
+ installation_id = [null]
+ }
+ }
+
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ ephemeral = true
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:computed-microvm"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/computed-microvm"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ pool = {
+ runner_owner = "example"
+ config = [{
+ schedule_expression = "cron(0 8 * * ? *)"
+ size = 1
+ }]
+ }
+ }
+ }
+ }
+
+ ssm = {
+ paths = {
+ root = "/github-runner/computed-microvm"
+ tokens = "tokens"
+ config = "config"
+ }
+ }
+}
+
+output "external_role_runner_count" {
+ value = module.external_iam.runner.role == null ? 0 : 1
+}
+
+output "generated_policy_role_runner_count" {
+ value = module.generated_policy.runner.role == null ? 0 : 1
+}
+
+output "computed_microvm_role_runner_count" {
+ value = module.computed_microvm.runner.role == null ? 0 : 1
+}
diff --git a/modules/runner-config/tests/fixtures/computed-iam-inputs/versions.tf b/modules/runner-config/tests/fixtures/computed-iam-inputs/versions.tf
new file mode 100644
index 0000000000..9fd85fad8f
--- /dev/null
+++ b/modules/runner-config/tests/fixtures/computed-iam-inputs/versions.tf
@@ -0,0 +1,13 @@
+terraform {
+ required_version = ">= 1.3"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = "~> 3.0"
+ }
+ }
+}
diff --git a/modules/runner-config/tests/pool.tftest.hcl b/modules/runner-config/tests/pool.tftest.hcl
new file mode 100644
index 0000000000..c8a0a383f5
--- /dev/null
+++ b/modules/runner-config/tests/pool.tftest.hcl
@@ -0,0 +1,983 @@
+mock_provider "aws" {
+ mock_data "aws_caller_identity" {
+ defaults = {
+ account_id = "123456789012"
+ }
+ }
+
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
+ }
+ }
+
+ mock_resource "aws_iam_role" {
+ defaults = {
+ arn = "arn:aws:iam::123456789012:role/runner-test"
+ }
+ }
+
+ mock_resource "aws_ssm_parameter" {
+ defaults = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/ami-id"
+ }
+ }
+}
+
+# The runner archive is injected during packaging, so isolate the common
+# housekeeper child in source-checkout tests where that build artifact is absent.
+override_module {
+ target = module.ssm_housekeeper
+}
+
+variables {
+ aws_region = "eu-west-1"
+
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ ami = {
+ filter = { state = ["available"] }
+ owners = ["amazon"]
+ id_ssm_parameter = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/external-ami-id"
+ }
+ kms_key = null
+ }
+ binaries_syncer = {
+ s3 = {
+ arn = "arn:aws:s3:::my-bucket"
+ id = "my-bucket"
+ key = "runners/linux/actions-runner.tar.gz"
+ }
+ }
+ ssm_enabled = true
+ }
+ }
+ }
+
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ managed_policy_arns = {
+ readonly = "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ }
+ additional_trust_policy_json = jsonencode({
+ Version = "2012-10-17"
+ Statement = [{
+ Sid = "AdditionalTrustedAccount"
+ Effect = "Allow"
+ Action = "sts:AssumeRole"
+ Principal = { AWS = "arn:aws:iam::210987654321:root" }
+ }]
+ })
+ }
+ }
+
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = "my-lambda-bucket"
+ }
+ }
+ }
+
+ github = {
+ app_parameters = {
+ key_base64 = [{ name = "/github-runner/key-base64", arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/key-base64" }]
+ id = [{ name = "/github-runner/app-id", arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/app-id" }]
+ installation_id = [null]
+ }
+ }
+
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ boot_time_in_minutes = 8
+ ephemeral = true
+ jit_config_enabled = null
+ maximum_count = 9
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ pool = {
+ config = [{
+ schedule_expression = "cron(0 8 * * ? *)"
+ size = 1
+ }]
+ }
+ }
+ }
+ }
+
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ }
+
+}
+
+run "plan_with_pool_enabled" {
+ command = plan
+
+ assert {
+ condition = module.orchestration_webhook[0].pool != null
+ error_message = "Pool module should be enabled when pool.config is non-empty"
+ }
+
+ assert {
+ condition = (
+ !contains(keys(var.runner), "maximum_count")
+ && !contains(keys(var.runner), "boot_time_in_minutes")
+ && !contains(keys(var.runner), "ephemeral")
+ && !contains(keys(var.runner), "jit_config_enabled")
+ && var.orchestration_provider.webhook.runner.boot_time_in_minutes == 8
+ && var.orchestration_provider.webhook.runner.ephemeral
+ && var.orchestration_provider.webhook.runner.jit_config_enabled == null
+ && var.orchestration_provider.webhook.runner.maximum_count == 9
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["RUNNERS_MAXIMUM_COUNT"] == "9"
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["RUNNER_BOOT_TIME_IN_MINUTES"] == "8"
+ && module.orchestration_webhook[0].pool.lambda.environment[0].variables["RUNNERS_MAXIMUM_COUNT"] == "9"
+ && module.orchestration_webhook[0].pool.lambda.environment[0].variables["RUNNER_BOOT_TIME_IN_MINUTES"] == "8"
+ )
+ error_message = "Runner capacity and boot time must be owned by orchestration_provider.webhook.runner and routed to webhook controls, not retained in the common runner contract."
+ }
+
+ assert {
+ condition = (
+ aws_ssm_parameter.runner_agent_mode.value == "ephemeral"
+ && aws_ssm_parameter.jit_config_enabled.value == "true"
+ )
+ error_message = "Runner-config must serialize the webhook provider's resolved lifecycle contract without duplicating its JIT fallback."
+ }
+
+ assert {
+ condition = (
+ module.orchestration_webhook[0].scale_up.lambda.s3_bucket == "my-lambda-bucket"
+ && module.orchestration_webhook[0].scale_up.lambda.s3_key == "runners.zip"
+ && local.ssm_housekeeper_artifact.s3.bucket == null
+ && endswith(local.ssm_housekeeper_artifact.zip, "/lambdas/functions/control-plane/runners.zip")
+ )
+ error_message = "The webhook provider must combine its artifact key with the shared bucket while the common SSM housekeeper remains on the packaged archive."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.provider)) == toset(["aws"])
+ && toset(keys(output.provider.aws)) == toset(["ec2", "microvm"])
+ && output.provider.aws.microvm == null
+ )
+ error_message = "The runner configuration must expose resources under the selected provider namespace and type."
+ }
+
+ assert {
+ condition = contains(keys(output.provider.aws.ec2), "launch_template")
+ error_message = "The runner configuration must expose EC2 resources only under provider.aws.ec2."
+ }
+
+ assert {
+ condition = length(aws_iam_role.runner) == 1 && output.runner.role != null
+ error_message = "The common runner configuration must create and expose the runner role."
+ }
+
+ assert {
+ condition = (
+ length(module.compute_aws_ec2_trust_policy) == 1
+ && length(module.compute_aws_microvm_trust_policy) == 0
+ && length(module.compute_aws_microvm) == 0
+ && aws_iam_role.runner[0].assume_role_policy == module.compute_aws_ec2_trust_policy[0].assume_role_policy
+ )
+ error_message = "The common runner role must use the selected EC2 trust-policy submodule output."
+ }
+
+ assert {
+ condition = (
+ output.pool != null
+ && toset(keys(output.pool)) == toset(["lambda", "log_group", "role"])
+ )
+ error_message = "An enabled pool must expose its Lambda, log group, and role through the nested pool output."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.orchestration_provider)) == toset(["webhook"])
+ && output.orchestration_provider.webhook != null
+ && output.orchestration_provider.webhook.scale_up != null
+ && output.orchestration_provider.webhook.scale_down != null
+ && output.orchestration_provider.webhook.pool != null
+ )
+ error_message = "The canonical orchestration output must group the existing webhook control-plane resources while flat aliases remain available."
+ }
+
+ assert {
+ condition = length(jsondecode(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["SSM_PARAMETER_STORE_TAGS"])) == 0
+ error_message = "Runtime Parameter Store tags must remain empty when no module or SSM tags are configured; EC2 bootstrap tags must not leak into them."
+ }
+
+ assert {
+ condition = !contains(keys(output.provider.aws.ec2), "role_runner")
+ error_message = "The common runner role must not be duplicated in the EC2 resource output."
+ }
+
+ assert {
+ condition = toset(keys(aws_iam_role_policy.runner_provider)) == toset([
+ "ssm_parameters",
+ "describe_tags",
+ "create_tags",
+ "terminate_self",
+ "session_manager",
+ "distribution_bucket",
+ "cloudwatch",
+ ])
+ error_message = "The common runner configuration must attach every enabled EC2 runner policy by its stable provider key."
+ }
+
+ assert {
+ condition = aws_iam_role_policy_attachment.runner["user-readonly"].policy_arn == "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ error_message = "The selected EC2 provider contract must return common managed runner policies for one attachment path."
+ }
+
+ assert {
+ condition = (
+ module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["COMPUTE_PROVIDER_TYPE"] == "ec2"
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["COMPUTE_PROVIDER_TYPE"] == "ec2"
+ )
+ error_message = "Scaling Lambdas must receive the provider type from the selected provider."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["INSTANCE_TYPES"] == "m5.large"
+ error_message = "Scale-up must merge the EC2 environment fragment."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["RUNNER_BOOT_TIME_IN_MINUTES"] == "8"
+ error_message = "Scale-down must receive boot time from the webhook orchestration configuration."
+ }
+
+ assert {
+ condition = (
+ toset(keys(module.orchestration_webhook[0].scale_up)) == toset(["lambda", "log_group", "role"])
+ && toset(keys(module.orchestration_webhook[0].scale_down)) == toset(["lambda", "log_group", "role"])
+ )
+ error_message = "The scale-runners child module must forward the nested scale-up and scale-down resource contracts."
+ }
+
+}
+
+run "housekeeper_uses_component_s3_artifact" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ housekeeper = {
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "housekeeper/runner-config.zip"
+ object_version = "housekeeper-version"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ local.ssm_housekeeper_artifact.zip == null
+ && local.ssm_housekeeper_artifact.s3.bucket == "my-lambda-bucket"
+ && local.ssm_housekeeper_artifact.s3.key == "housekeeper/runner-config.zip"
+ && local.ssm_housekeeper_artifact.s3.object_version == "housekeeper-version"
+ )
+ error_message = "The SSM housekeeper must combine its component-owned S3 key and version with the common Lambda artifact bucket."
+ }
+}
+
+run "housekeeper_uses_component_local_zip" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ housekeeper = {
+ lambda = {
+ artifact = {
+ zip = "README.md"
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ local.ssm_housekeeper_artifact.zip == "README.md"
+ && local.ssm_housekeeper_artifact.s3.bucket == null
+ && local.ssm_housekeeper_artifact.s3.key == null
+ && local.ssm_housekeeper_artifact.s3.object_version == null
+ )
+ error_message = "The SSM housekeeper must use its component-owned local zip without inheriting the common bucket or webhook artifact."
+ }
+}
+
+run "rejects_conflicting_housekeeper_artifacts" {
+ command = plan
+
+ variables {
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ housekeeper = {
+ lambda = {
+ artifact = {
+ zip = "README.md"
+ s3 = {
+ key = "housekeeper/runner-config.zip"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_housekeeper_s3_without_common_bucket" {
+ command = plan
+
+ variables {
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = null
+ }
+ }
+ }
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ housekeeper = {
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "housekeeper/runner-config.zip"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_missing_orchestration_provider" {
+ command = plan
+
+ variables {
+ orchestration_provider = {
+ webhook = null
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "external_runner_role_is_not_managed_by_common" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external/runner-role"
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = length(aws_iam_role.runner) == 0 && length(aws_iam_role_policy.runner_provider) == 0 && length(aws_iam_role_policy_attachment.runner) == 0
+ error_message = "An external runner role must remain unmanaged by the common runner configuration."
+ }
+
+ assert {
+ condition = output.runner.role == null
+ error_message = "The nested runner role output must be null when an external role is selected."
+ }
+
+
+ assert {
+ condition = output.provider.aws.ec2.launch_template.iam_instance_profile[0].name == "github-actions-runner-profile"
+ error_message = "EC2 must create an instance profile around an externally supplied runner role when no profile override is provided."
+ }
+}
+
+run "external_runner_role_and_profile_remain_external" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external/runner-role"
+ }
+ }
+ }
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ instance_profile = {
+ name = "external-runner-profile"
+ }
+ binaries_syncer = {
+ enabled = false
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = length(aws_iam_role.runner) == 0 && length(aws_iam_role_policy.runner_provider) == 0
+ error_message = "The common runner configuration must not manage an external role."
+ }
+
+ assert {
+ condition = output.provider.aws.ec2.launch_template.iam_instance_profile[0].name == "external-runner-profile"
+ error_message = "The EC2 launch template must use the external instance profile."
+ }
+}
+
+run "empty_runner_iam_uses_common_role" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {}
+ }
+ }
+
+ assert {
+ condition = length(aws_iam_role.runner) == 1
+ error_message = "An empty runner.iam object must use common role ownership."
+ }
+}
+
+run "external_role_rejects_managed_policy_attachments" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external/runner-role"
+ }
+ managed_policy_arns = {
+ readonly = "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "external_role_rejects_trust_policy_extension" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external/runner-role"
+ }
+ additional_trust_policy_json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_invalid_trust_policy_extension" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ iam = {
+ additional_trust_policy_json = "{"
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_empty_compute_provider" {
+ command = plan
+
+ variables {
+ compute_provider = {}
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_empty_aws_compute_provider_namespace" {
+ command = plan
+
+ variables {
+ compute_provider = {
+ aws = {}
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "job_retry_uses_common_runner_configuration_identity" {
+ command = plan
+
+ variables {
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ name_prefix = "provider-neutral-"
+ }
+ orchestration_provider = {
+ webhook = {
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ }
+ job_retry = {
+ enabled = true
+ lambda = {
+ reserved_concurrent_executions = 2
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].job_retry.lambda.function.environment[0].variables["RUNNER_NAME_PREFIX"] == "provider-neutral-"
+ error_message = "Job retry must receive the common runner-configuration name prefix."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].job_retry.lambda.function.reserved_concurrent_executions == 2
+ error_message = "Job retry must apply its configured Lambda reserved concurrency."
+ }
+}
+
+run "routes_lambda_microvm_provider" {
+ command = plan
+
+ variables {
+ compute_provider_key = "aws_microvm"
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ labels = ["self-hosted", "linux", "arm64", "microvm"]
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ image_version = "7"
+ ingress_network_connectors = [
+ "arn:aws:lambda:eu-west-1:123456789012:network-connector:private-ingress",
+ ]
+ egress_network_connectors = [
+ "arn:aws:lambda:eu-west-1:aws:network-connector:aws-network-connector:INTERNET_EGRESS",
+ ]
+ }
+ }
+ }
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ ephemeral = true
+ jit_config_enabled = null
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ length(module.compute_aws_ec2) == 0
+ && length(module.compute_aws_ec2_trust_policy) == 0
+ && length(module.compute_aws_microvm) == 1
+ && length(module.compute_aws_microvm_trust_policy) == 1
+ && aws_iam_role.runner[0].assume_role_policy == module.compute_aws_microvm_trust_policy[0].assume_role_policy
+ && toset(keys(aws_iam_role_policy.runner_provider)) == toset(["cloudwatch", "runner_metadata", "runtime_logs", "ssm_jit"])
+ && aws_iam_role_policy.runner_provider["cloudwatch"].name == "runner-microvm-cloudwatch"
+ && aws_iam_role_policy.runner_provider["runner_metadata"].name == "runner-microvm-metadata"
+ && aws_iam_role_policy.runner_provider["runtime_logs"].name == "runner-microvm-runtime-logs"
+ && aws_iam_role_policy.runner_provider["ssm_jit"].name == "runner-microvm-ssm-jit"
+ )
+ error_message = "The aws.microvm leaf must dispatch only to the namespaced provider modules and attach all required policies to its managed runner role."
+ }
+
+ assert {
+ condition = (
+ toset(keys(output.provider.aws)) == toset(["ec2", "microvm"])
+ && output.provider.aws.ec2 == null
+ && output.provider.aws.microvm.image_arn == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ && output.provider.aws.microvm.image_version == "7"
+ && contains(keys(output.provider.aws.microvm), "execution_role_arn")
+ && output.provider.aws.microvm.runners_log_groups[0].name == "/github-self-hosted-runners/github-actions/microvm"
+ && toset(slice(output.provider.aws.microvm.runners_log_groups[*].name, 1, 4)) == toset([
+ "/github-self-hosted-runners/github-actions/internal_service",
+ "/github-self-hosted-runners/github-actions/run",
+ "/github-self-hosted-runners/github-actions/runner",
+ ])
+ && output.provider.aws.microvm.logfiles[2].file_path == "/opt/actions-runner/_diag/Runner_**.log"
+ )
+ error_message = "The selected MicroVM resources must be exposed only under provider.aws.microvm."
+ }
+
+ assert {
+ condition = (
+ module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["COMPUTE_PROVIDER_TYPE"] == "microvm"
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["COMPUTE_PROVIDER_TYPE"] == "microvm"
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["MICROVM_IMAGE_ARN"] == "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ && contains(keys(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables), "MICROVM_EXECUTION_ROLE_ARN")
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["MICROVM_LOG_GROUP"] == "/github-self-hosted-runners/github-actions/microvm"
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["MICROVM_METADATA_SSM_PATH"] == "/github-runner/config/microvm-metadata"
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["SSM_CONFIG_PATH"] == "/github-runner/config"
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["ENVIRONMENT"] == "github-actions"
+ && module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["RUNNER_NAME_PREFIX"] == ""
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["MICROVM_METADATA_SSM_PATH"] == "/github-runner/config/microvm-metadata"
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["SSM_TOKEN_PATH"] == "/github-runner/tokens"
+ && module.orchestration_webhook[0].scale_down.lambda.environment[0].variables["RUNNER_BOOT_TIME_IN_MINUTES"] == "5"
+ && !contains(keys(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables), "MICROVM_RUN_CONFIG")
+ && !contains(keys(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables), "MICROVM_TAGS")
+ && !contains(keys(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables), "MICROVM_METADATA_TAGS")
+ && !contains(keys(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables), "MICROVM_RUNNER_CONFIG_SSM_ARN")
+ )
+ error_message = "Runner-config must preserve the runtime provider type and merge the canonical MicroVM environment with webhook-owned lifecycle values."
+ }
+}
+
+run "external_microvm_runner_role_remains_unmanaged" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ labels = ["self-hosted", "linux", "arm64", "microvm"]
+ iam = {
+ role = {
+ arn = "arn:aws:iam::123456789012:role/external/microvm-runner"
+ }
+ }
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ ephemeral = true
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ }
+ }
+ }
+ }
+
+ assert {
+ condition = (
+ length(aws_iam_role.runner) == 0
+ && length(aws_iam_role_policy.runner_provider) == 0
+ && length(aws_iam_role_policy_attachment.runner) == 0
+ && output.provider.aws.microvm.execution_role_arn == "arn:aws:iam::123456789012:role/external/microvm-runner"
+ )
+ error_message = "An external provider-neutral runner role must remain caller-owned while serving as the MicroVM execution role."
+ }
+}
+
+run "rejects_multiple_aws_compute_providers" {
+ command = plan
+
+ variables {
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ }
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_non_ephemeral_microvm_runner" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ labels = ["self-hosted", "linux", "arm64", "microvm"]
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ ephemeral = false
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_microvm_runner_with_jit_disabled" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "linux"
+ architecture = "arm64"
+ labels = ["self-hosted", "linux", "arm64", "microvm"]
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ orchestration_provider = {
+ webhook = {
+ runner = {
+ ephemeral = true
+ jit_config_enabled = false
+ }
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_non_arm64_microvm_runner" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "linux"
+ architecture = "x64"
+ labels = ["self-hosted", "linux", "x64", "microvm"]
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
+
+run "rejects_non_linux_microvm_runner" {
+ command = plan
+
+ variables {
+ runner = {
+ os = "windows"
+ architecture = "arm64"
+ labels = ["self-hosted", "windows", "arm64", "microvm"]
+ }
+ compute_provider = {
+ aws = {
+ microvm = {
+ image_arn = "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"
+ }
+ }
+ }
+ }
+
+ plan_options {
+ target = [terraform_data.validate_config]
+ }
+
+ expect_failures = [terraform_data.validate_config]
+}
diff --git a/modules/runner-config/tests/tags.tftest.hcl b/modules/runner-config/tests/tags.tftest.hcl
new file mode 100644
index 0000000000..6c004879ba
--- /dev/null
+++ b/modules/runner-config/tests/tags.tftest.hcl
@@ -0,0 +1,322 @@
+mock_provider "aws" {
+ mock_data "aws_iam_policy_document" {
+ defaults = {
+ json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+ }
+ }
+
+ mock_resource "aws_iam_role" {
+ defaults = {
+ arn = "arn:aws:iam::123456789012:role/runner-test"
+ }
+ }
+
+ mock_resource "aws_ssm_parameter" {
+ defaults = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/config"
+ }
+ }
+}
+
+# The runner archive is injected during packaging, so model the common
+# housekeeper output while testing parent-level tag composition from source.
+override_module {
+ target = module.ssm_housekeeper
+}
+
+variables {
+ aws_region = "eu-west-1"
+
+ tags = {
+ precedence = "module"
+ module = "yes"
+ }
+
+ compute_provider = {
+ aws = {
+ ec2 = {
+ vpc_id = "vpc-12345678"
+ subnet_ids = ["subnet-12345678"]
+ instance_types = ["m5.large"]
+ ami = {
+ filter = { state = ["available"] }
+ owners = ["amazon"]
+ id_ssm_parameter = {
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/external-ami-id"
+ }
+ kms_key = null
+ }
+ binaries_syncer = {
+ s3 = {
+ arn = "arn:aws:s3:::my-bucket"
+ id = "my-bucket"
+ key = "runners/linux/actions-runner.tar.gz"
+ }
+ }
+ }
+ }
+ }
+
+ runner = {
+ labels = ["self-hosted", "linux", "x64"]
+ tags = {
+ precedence = "runner"
+ runner = "yes"
+ }
+ }
+
+ lambda = {
+ artifact = {
+ s3 = {
+ bucket = "my-lambda-bucket"
+ }
+ }
+ tags = {
+ precedence = "lambda"
+ lambda = "yes"
+ }
+ }
+
+ github = {
+ app_parameters = {
+ key_base64 = [{
+ name = "/github-runner/key-base64"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/key-base64"
+ }]
+ id = [{
+ name = "/github-runner/app-id"
+ arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/app-id"
+ }]
+ installation_id = [null]
+ }
+ }
+
+ orchestration_provider = {
+ webhook = {
+ github = {
+ organization_runners = true
+ }
+ queue = {
+ build = {
+ arn = "arn:aws:sqs:eu-west-1:123456789012:build-queue"
+ url = "https://sqs.eu-west-1.amazonaws.com/123456789012/build-queue"
+ }
+ tags = {
+ precedence = "queue"
+ queue = "yes"
+ }
+ }
+ lambda = {
+ artifact = {
+ s3 = {
+ key = "runners.zip"
+ }
+ }
+ scale = {
+ up = {
+ tags = {
+ precedence = "scale-up"
+ scale_up = "yes"
+ }
+ }
+ down = {
+ tags = {
+ precedence = "scale-down"
+ scale_down = "yes"
+ }
+ }
+ }
+ pool = {
+ config = [{
+ schedule_expression = "cron(0 8 * * ? *)"
+ size = 1
+ }]
+ tags = {
+ precedence = "pool"
+ pool = "yes"
+ }
+ }
+ }
+ job_retry = {
+ enabled = true
+ tags = {
+ precedence = "job-retry"
+ job_retry = "yes"
+ }
+ }
+ }
+ }
+
+ ssm = {
+ paths = {
+ root = "/github-runner"
+ tokens = "tokens"
+ config = "config"
+ }
+ tags = {
+ precedence = "ssm"
+ ssm = "yes"
+ }
+ parameters = {
+ tags = {
+ precedence = "ssm-parameter"
+ parameter = "yes"
+ }
+ }
+ housekeeper = {
+ tags = {
+ precedence = "ssm-housekeeper"
+ housekeeper = "yes"
+ }
+ }
+ }
+
+ observability = {
+ logs = {
+ level = "debug"
+ tags = {
+ precedence = "log"
+ log = "yes"
+ }
+ }
+ }
+}
+
+run "layered_component_tags" {
+ command = plan
+
+ assert {
+ condition = module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["LOG_LEVEL"] == "DEBUG"
+ error_message = "The nested observability.logs.level value must configure the control-plane functions."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].scale_up.lambda.tags == tomap({
+ precedence = "scale-up"
+ module = "yes"
+ lambda = "yes"
+ scale_up = "yes"
+ }) && module.orchestration_webhook[0].scale_up.log_group.tags == tomap({
+ precedence = "scale-up"
+ module = "yes"
+ log = "yes"
+ scale_up = "yes"
+ }) && module.orchestration_webhook[0].scale_up.role.tags == tomap({
+ precedence = "scale-up"
+ module = "yes"
+ scale_up = "yes"
+ })
+ error_message = "Scale-up tags must layer module, shared resource, and component tags with the component taking precedence."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].scale_down.lambda.tags == tomap({
+ precedence = "scale-down"
+ module = "yes"
+ lambda = "yes"
+ scale_down = "yes"
+ }) && module.orchestration_webhook[0].scale_down.log_group.tags == tomap({
+ precedence = "scale-down"
+ module = "yes"
+ log = "yes"
+ scale_down = "yes"
+ }) && module.orchestration_webhook[0].scale_down.role.tags == tomap({
+ precedence = "scale-down"
+ module = "yes"
+ scale_down = "yes"
+ })
+ error_message = "Scale-down tags must layer module, shared resource, and component tags with the component taking precedence."
+ }
+
+ assert {
+ condition = aws_iam_role.runner[0].tags == tomap({
+ precedence = "runner"
+ module = "yes"
+ runner = "yes"
+ })
+ error_message = "Runner tags must override module tags on the common runner role."
+ }
+
+ assert {
+ condition = aws_ssm_parameter.runner_agent_mode.tags == tomap({
+ precedence = "ssm-parameter"
+ module = "yes"
+ ssm = "yes"
+ parameter = "yes"
+ }) && tomap({
+ for tag in jsondecode(module.orchestration_webhook[0].scale_up.lambda.environment[0].variables["SSM_PARAMETER_STORE_TAGS"]) :
+ tag.Key => tag.Value
+ }) == tomap({
+ precedence = "ssm-parameter"
+ module = "yes"
+ ssm = "yes"
+ parameter = "yes"
+ })
+ error_message = "Terraform-managed and runtime-created SSM parameters must use the same layered parameter tags."
+ }
+
+ assert {
+ condition = local.ssm_housekeeper_lambda_tags == tomap({
+ precedence = "ssm-housekeeper"
+ module = "yes"
+ lambda = "yes"
+ ssm = "yes"
+ housekeeper = "yes"
+ }) && local.ssm_housekeeper_log_tags == tomap({
+ precedence = "ssm-housekeeper"
+ module = "yes"
+ log = "yes"
+ ssm = "yes"
+ housekeeper = "yes"
+ }) && local.ssm_housekeeper_tags == tomap({
+ precedence = "ssm-housekeeper"
+ module = "yes"
+ ssm = "yes"
+ housekeeper = "yes"
+ })
+ error_message = "SSM housekeeper tags must layer module, SSM, shared resource, and housekeeper tags."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].pool.lambda.tags == tomap({
+ precedence = "pool"
+ module = "yes"
+ lambda = "yes"
+ pool = "yes"
+ }) && module.orchestration_webhook[0].pool.log_group.tags == tomap({
+ precedence = "pool"
+ module = "yes"
+ log = "yes"
+ pool = "yes"
+ }) && module.orchestration_webhook[0].pool.role.tags == tomap({
+ precedence = "pool"
+ module = "yes"
+ pool = "yes"
+ })
+ error_message = "Pool tags must layer module, shared resource, and component tags with the component taking precedence."
+ }
+
+ assert {
+ condition = module.orchestration_webhook[0].job_retry.lambda.function.tags == tomap({
+ precedence = "job-retry"
+ module = "yes"
+ lambda = "yes"
+ job_retry = "yes"
+ }) && module.orchestration_webhook[0].job_retry.lambda.log_group.tags == tomap({
+ precedence = "job-retry"
+ module = "yes"
+ log = "yes"
+ job_retry = "yes"
+ }) && module.orchestration_webhook[0].job_retry.lambda.role.tags == tomap({
+ precedence = "job-retry"
+ module = "yes"
+ job_retry = "yes"
+ }) && module.orchestration_webhook[0].job_retry.queue.tags == tomap({
+ precedence = "job-retry"
+ module = "yes"
+ queue = "yes"
+ job_retry = "yes"
+ })
+ error_message = "Job-retry tags must layer module, shared resource, and component tags with the component taking precedence."
+ }
+}
diff --git a/modules/runner-config/validations.tf b/modules/runner-config/validations.tf
new file mode 100644
index 0000000000..2b3bfddccb
--- /dev/null
+++ b/modules/runner-config/validations.tf
@@ -0,0 +1,137 @@
+resource "terraform_data" "validate_config" {
+ lifecycle {
+ precondition {
+ condition = contains(["linux", "osx", "windows"], var.runner.os)
+ error_message = "Valid values for runner.os are linux, osx, and windows."
+ }
+
+ precondition {
+ condition = length(var.runner.name_prefix) <= 45
+ error_message = "runner.name_prefix must be at most 45 characters."
+ }
+
+ precondition {
+ condition = var.runner.iam.role == null ? true : trimspace(var.runner.iam.role.arn) != ""
+ error_message = "runner.iam.role.arn must be a non-empty ARN when set."
+ }
+
+ precondition {
+ condition = var.runner.iam.role == null || length(var.runner.iam.managed_policy_arns) == 0
+ error_message = "runner.iam.managed_policy_arns cannot be set with an external runner.iam.role because external roles are not managed by this module."
+ }
+
+ precondition {
+ condition = var.runner.iam.additional_trust_policy_json == null ? true : can(jsondecode(var.runner.iam.additional_trust_policy_json))
+ error_message = "runner.iam.additional_trust_policy_json must be valid JSON when set."
+ }
+
+ precondition {
+ condition = var.runner.iam.role == null || var.runner.iam.additional_trust_policy_json == null
+ error_message = "runner.iam.additional_trust_policy_json cannot be set with an external runner.iam.role because external role trust is not managed by this module."
+ }
+
+ precondition {
+ condition = contains(["arm64", "x86_64"], var.lambda.architecture)
+ error_message = "lambda.architecture must be arm64 or x86_64."
+ }
+
+ precondition {
+ condition = !(
+ var.ssm.housekeeper.lambda.artifact.zip != null &&
+ var.ssm.housekeeper.lambda.artifact.s3 != null
+ )
+ error_message = "ssm.housekeeper.lambda.artifact must select at most one of zip or s3."
+ }
+
+ precondition {
+ condition = (
+ var.ssm.housekeeper.lambda.artifact.s3 == null ||
+ var.lambda.artifact.s3.bucket != null
+ )
+ error_message = "lambda.artifact.s3.bucket must be set when ssm.housekeeper.lambda.artifact.s3 is selected."
+ }
+
+ precondition {
+ condition = contains(["STANDARD", "INFREQUENT_ACCESS"], var.observability.logs.class)
+ error_message = "observability.logs.class must be STANDARD or INFREQUENT_ACCESS."
+ }
+
+ precondition {
+ condition = contains([
+ "silly",
+ "trace",
+ "debug",
+ "info",
+ "warn",
+ "error",
+ "fatal",
+ ], var.observability.logs.level)
+ error_message = "observability.logs.level must be one of silly, trace, debug, info, warn, error, or fatal."
+ }
+
+ precondition {
+ condition = length([
+ for provider_key, provider_config in local.compute_providers : provider_key
+ if provider_config != null
+ ]) == 1
+ error_message = "Exactly one compute-provider block must be set. Supported compute-provider blocks: aws.ec2, aws.microvm."
+ }
+
+ precondition {
+ condition = var.compute_provider.aws.microvm == null ? true : (
+ var.runner.os == "linux" && var.runner.architecture == "arm64"
+ )
+ error_message = "compute_provider.aws.microvm requires runner.os = linux and runner.architecture = arm64."
+ }
+
+ precondition {
+ condition = var.compute_provider_key == null || try(
+ local.compute_providers[var.compute_provider_key] != null,
+ false,
+ )
+ error_message = "compute_provider_key must identify the non-null typed compute-provider block."
+ }
+
+ precondition {
+ condition = length([
+ for provider_name, provider_config in var.orchestration_provider : provider_name
+ if provider_config != null
+ ]) == 1
+ error_message = "Exactly one orchestration provider must be configured. Supported providers: webhook."
+ }
+
+ precondition {
+ condition = var.compute_provider.aws.microvm == null ? true : (
+ try(var.orchestration_provider.webhook.runner.ephemeral, false) &&
+ try(coalesce(
+ var.orchestration_provider.webhook.runner.jit_config_enabled,
+ var.orchestration_provider.webhook.runner.ephemeral,
+ ), false)
+ )
+ error_message = "compute_provider.aws.microvm requires webhook orchestration with ephemeral and JIT runner configuration enabled."
+ }
+
+ precondition {
+ condition = var.orchestration_provider.webhook == null ? true : (
+ var.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.batch_size >= 1 &&
+ var.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.batch_size <= 1000 &&
+ var.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds >= 0 &&
+ var.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds <= 300
+ )
+ error_message = "orchestration_provider.webhook.lambda.scale.up.event_source_mapping batch size must be between 1 and 1000 and its batching window between 0 and 300 seconds."
+ }
+
+ precondition {
+ condition = var.orchestration_provider.webhook == null ? true : !(
+ var.orchestration_provider.webhook.lambda.artifact.zip != null &&
+ var.orchestration_provider.webhook.lambda.artifact.s3 != null
+ )
+ error_message = "orchestration_provider.webhook.lambda.artifact must select at most one of zip or s3."
+ }
+
+ precondition {
+ condition = var.orchestration_provider.webhook == null ? true : (!var.orchestration_provider.webhook.job_retry.enabled || var.orchestration_provider.webhook.job_retry.delay_in_seconds <= 900)
+ error_message = "orchestration_provider.webhook.job_retry.delay_in_seconds cannot exceed the SQS maximum of 900 seconds."
+ }
+ }
+}
diff --git a/modules/runner-config/variables.compute-provider.tf b/modules/runner-config/variables.compute-provider.tf
new file mode 100644
index 0000000000..7e07705894
--- /dev/null
+++ b/modules/runner-config/variables.compute-provider.tf
@@ -0,0 +1,297 @@
+# Optional plan-known dispatch key supplied by the multi-runner topology layer.
+variable "compute_provider_key" {
+ description = "Optional plan-known compute-provider dispatch key. Null discovers the key from the exactly one populated compute_provider block."
+ type = string
+ default = null
+
+ validation {
+ condition = var.compute_provider_key == null ? true : contains(["aws_ec2", "aws_microvm"], var.compute_provider_key)
+ error_message = "compute_provider_key must be null, aws_ec2, or aws_microvm."
+ }
+}
+
+# Typed compute-provider input boundary between the common control plane and compute implementations.
+variable "compute_provider" {
+ description = <<-EOT
+ Typed compute-provider configuration. Provider-owned settings remain inside the selected compute-provider block.
+
+ Exactly one compute-provider block must be non-null. The populated block selects the provider, and its presence must be known during planning. Values inside the selected block may remain unknown until apply.
+
+ - `aws`: AWS compute-provider configurations.
+ - `aws.ec2`: EC2 compute-provider configuration.
+ - `aws.ec2.ami`: Optional AMI discovery or external AMI-parameter configuration. Null uses the operating-system and architecture defaults.
+ - `aws.ec2.ami.filter`: EC2 AMI filters combined with the provider's default AMI-name filter.
+ - `aws.ec2.ami.owners`: AWS account IDs or aliases allowed to own the selected AMI.
+ - `aws.ec2.ami.id_ssm_parameter`: Optional externally managed SSM parameter containing the AMI ID. Null creates a provider-managed AMI-ID parameter. The wrapper's presence is the plan-time ownership discriminator, so keep the object literal even when its ARN comes from another resource.
+ - `aws.ec2.ami.id_ssm_parameter.arn`: ARN of the externally managed SSM parameter. The ARN may be unknown until apply.
+ - `aws.ec2.ami.kms_key`: Optional KMS key required to launch encrypted AMIs or snapshots. The wrapper's presence is the plan-time policy discriminator.
+ - `aws.ec2.ami.kms_key.arn`: ARN of the KMS key. The ARN may be unknown until apply.
+ - `aws.ec2.vpc_id`: VPC in which runner networking resources are created.
+ - `aws.ec2.subnet_ids`: Subnets from which scale-up may launch runner instances.
+ - `aws.ec2.overrides`: Optional resource-name overrides.
+ - `aws.ec2.overrides.name_runner`: Name tag used for runner compute resources. An empty value uses the generated provider name.
+ - `aws.ec2.overrides.name_sg`: Name tag used for the managed runner security group. An empty value uses the generated provider name.
+ - `aws.ec2.instance_profile`: Optional externally managed instance profile used by the launch template.
+ - `aws.ec2.instance_profile.name`: Name of the externally managed instance profile.
+ - `aws.ec2.instance_profile_path`: IAM path for the provider-managed instance profile. Null uses a path derived from the runner-configuration prefix.
+ - `aws.ec2.binaries_syncer`: Runner-distribution synchronization configuration.
+ - `aws.ec2.binaries_syncer.enabled`: Enables use of a synchronized runner distribution from S3.
+ - `aws.ec2.binaries_syncer.s3`: S3 object containing the synchronized runner distribution. Required when synchronization is enabled.
+ - `aws.ec2.binaries_syncer.s3.arn`: ARN of the runner-distribution bucket, used by IAM policies.
+ - `aws.ec2.binaries_syncer.s3.id`: Bucket name used to construct the runner-distribution S3 URI.
+ - `aws.ec2.binaries_syncer.s3.key`: Object key of the runner distribution.
+ - `aws.ec2.block_device_mappings`: EBS mappings added to the runner launch template.
+ - `aws.ec2.block_device_mappings[].delete_on_termination`: Deletes the volume when its runner instance terminates.
+ - `aws.ec2.block_device_mappings[].device_name`: Device name exposed to the runner instance.
+ - `aws.ec2.block_device_mappings[].encrypted`: Enables EBS encryption.
+ - `aws.ec2.block_device_mappings[].iops`: Provisioned IOPS for volume types that support it.
+ - `aws.ec2.block_device_mappings[].kms_key_id`: KMS key ID or ARN used to encrypt the volume.
+ - `aws.ec2.block_device_mappings[].snapshot_id`: Snapshot used to initialize the volume.
+ - `aws.ec2.block_device_mappings[].throughput`: Provisioned throughput for volume types that support it.
+ - `aws.ec2.block_device_mappings[].volume_initialization_rate`: Fixed initialization rate in MiB/s for supported snapshot-backed volumes.
+ - `aws.ec2.block_device_mappings[].volume_size`: Volume size in GiB.
+ - `aws.ec2.block_device_mappings[].volume_type`: EBS volume type.
+ - `aws.ec2.ebs_optimized`: Requests EBS-optimized runner instances.
+ - `aws.ec2.instance_target_capacity_type`: Primary capacity type, either `spot` or `on-demand`.
+ - `aws.ec2.instance_allocation_strategy`: EC2 Fleet allocation strategy used to select instance capacity.
+ - `aws.ec2.instance_type_priorities`: Optional numeric priorities keyed by instance type.
+ - `aws.ec2.instance_max_spot_price`: Optional maximum hourly Spot price.
+ - `aws.ec2.instance_types`: EC2 instance types available to the scale-up and pool functions.
+ - `aws.ec2.user_data`: Runner bootstrap user-data configuration.
+ - `aws.ec2.user_data.enabled`: Enables launch-template user data.
+ - `aws.ec2.user_data.template`: Optional path to a custom user-data template.
+ - `aws.ec2.user_data.content`: Optional complete user-data content. When set, it is used instead of rendering a template.
+ - `aws.ec2.user_data.pre_install`: Script content inserted before runner installation in the default template.
+ - `aws.ec2.user_data.post_install`: Script content inserted after runner installation in the default template.
+ - `aws.ec2.user_data.debug_logging_enabled`: Enables verbose user-data tracing, which can expose secrets in logs.
+ - `aws.ec2.ssm_enabled`: Attaches runner permissions and policies required for AWS Systems Manager access.
+ - `aws.ec2.create_service_linked_role_spot`: Allows scale-up to create the EC2 Spot service-linked role.
+ - `aws.ec2.cloudwatch_agent`: CloudWatch agent configuration for runner instances.
+ - `aws.ec2.cloudwatch_agent.enabled`: Installs and configures the CloudWatch agent through the default bootstrap flow.
+ - `aws.ec2.cloudwatch_agent.config`: Optional complete CloudWatch agent configuration. Null renders the provider default from `log_files`.
+ - `aws.ec2.managed_security_group_enabled`: Creates and attaches the provider-managed runner security group.
+ - `aws.ec2.log_files`: Optional log files collected by the CloudWatch agent. Null uses the provider defaults.
+ - `aws.ec2.log_files[].log_group_name`: CloudWatch log-group name, before optional prefixing.
+ - `aws.ec2.log_files[].prefix_log_group`: Prefixes the log-group name with the runner configuration path when true.
+ - `aws.ec2.log_files[].file_path`: File or glob read by the CloudWatch agent.
+ - `aws.ec2.log_files[].log_stream_name`: CloudWatch log-stream name template.
+ - `aws.ec2.log_files[].log_class`: CloudWatch log-group class for the collected file.
+ - `aws.ec2.key_name`: Optional EC2 key-pair name added to the launch template.
+ - `aws.ec2.additional_security_group_ids`: Existing security groups attached in addition to the managed security group.
+ - `aws.ec2.detailed_monitoring_enabled`: Enables detailed EC2 monitoring for runner instances.
+ - `aws.ec2.egress_rules`: Egress rules created on the managed runner security group.
+ - `aws.ec2.egress_rules[].cidr_blocks`: IPv4 CIDR destinations.
+ - `aws.ec2.egress_rules[].ipv6_cidr_blocks`: IPv6 CIDR destinations.
+ - `aws.ec2.egress_rules[].prefix_list_ids`: AWS prefix-list destinations.
+ - `aws.ec2.egress_rules[].from_port`: First destination port in the permitted range.
+ - `aws.ec2.egress_rules[].protocol`: IP protocol name or number. Use `-1` for all protocols.
+ - `aws.ec2.egress_rules[].security_groups`: Destination security-group IDs.
+ - `aws.ec2.egress_rules[].self`: Allows traffic to the managed security group itself when true.
+ - `aws.ec2.egress_rules[].to_port`: Last destination port in the permitted range.
+ - `aws.ec2.egress_rules[].description`: Optional rule description.
+ - `aws.ec2.tags`: Additional tags for runner instances, EBS volumes, network interfaces, and eligible Spot instance requests created from the launch template. They override module-level tags and the generated runner `Name`; the provider-managed `ghr:environment`, `ghr:ssm_config_path`, and `ghr:runner_name_prefix` bootstrap tags take final precedence. These tags do not apply to static provider resources such as the launch template, security group, IAM resources, SSM parameters, or log groups.
+ - `aws.ec2.metadata_options`: Instance Metadata Service configuration in the launch template.
+ - `aws.ec2.metadata_options.instance_metadata_tags`: Exposes instance tags through Instance Metadata Service when `enabled`.
+ - `aws.ec2.metadata_options.http_endpoint`: Enables or disables the Instance Metadata Service endpoint.
+ - `aws.ec2.metadata_options.http_tokens`: Controls whether IMDSv2 session tokens are optional or required.
+ - `aws.ec2.metadata_options.http_put_response_hop_limit`: Network hop limit for Instance Metadata Service token responses.
+ - `aws.ec2.credit_specification`: CPU credit mode for burstable instance types, either `standard` or `unlimited`.
+ - `aws.ec2.cpu_options`: CPU topology and processor-feature configuration.
+ - `aws.ec2.cpu_options.core_count`: Number of CPU cores exposed to the runner instance.
+ - `aws.ec2.cpu_options.threads_per_core`: Number of hardware threads exposed per CPU core.
+ - `aws.ec2.cpu_options.amd_sev_snp`: Enables or disables AMD SEV-SNP on supported instance types.
+ - `aws.ec2.cpu_options.nested_virtualization`: Enables or disables nested virtualization on supported instance types.
+ - `aws.ec2.placement`: EC2 placement configuration for runner instances.
+ - `aws.ec2.placement.affinity`: Host affinity setting.
+ - `aws.ec2.placement.availability_zone`: Availability Zone in which the instance is placed.
+ - `aws.ec2.placement.group_id`: Placement-group ID.
+ - `aws.ec2.placement.group_name`: Placement-group name.
+ - `aws.ec2.placement.host_id`: Dedicated Host ID.
+ - `aws.ec2.placement.host_resource_group_arn`: ARN of the host resource group used for placement.
+ - `aws.ec2.placement.spread_domain`: Spread-domain placement value.
+ - `aws.ec2.placement.tenancy`: Instance tenancy, such as `default`, `dedicated`, or `host`.
+ - `aws.ec2.placement.partition_number`: Placement-group partition number.
+ - `aws.ec2.license_specifications`: License Manager configurations added to the launch template.
+ - `aws.ec2.license_specifications[].license_configuration_arn`: ARN of a License Manager license configuration.
+ - `aws.ec2.associate_public_ipv4_address`: Associates a public IPv4 address with runner network interfaces.
+ - `aws.ec2.on_demand_failover_for_errors`: EC2 error codes that trigger an on-demand fallback after a Spot launch failure.
+ - `aws.ec2.scale_errors`: EC2 error codes treated as retryable scale-up failures.
+ - `aws.ec2.use_dedicated_host`: Enables the dedicated-host launch path, required for macOS runners.
+ EOT
+
+ type = object({
+ aws = optional(object({
+ ec2 = optional(object({
+ ami = optional(object({
+ filter = optional(map(list(string)), { state = ["available"] })
+ owners = optional(list(string), ["amazon"])
+ id_ssm_parameter = optional(object({
+ arn = string
+ }), null)
+ kms_key = optional(object({
+ arn = string
+ }), null)
+ }), null)
+ vpc_id = string
+ subnet_ids = list(string)
+ overrides = optional(object({
+ name_runner = optional(string, "")
+ name_sg = optional(string, "")
+ }), {})
+ instance_profile = optional(object({
+ name = string
+ }), null)
+ instance_profile_path = optional(string, null)
+ binaries_syncer = optional(object({
+ enabled = optional(bool, true)
+ s3 = optional(object({
+ arn = string
+ id = string
+ key = string
+ }), null)
+ }), {})
+ block_device_mappings = optional(list(object({
+ delete_on_termination = optional(bool, true)
+ device_name = optional(string, "/dev/xvda")
+ encrypted = optional(bool, true)
+ iops = optional(number)
+ kms_key_id = optional(string)
+ snapshot_id = optional(string)
+ throughput = optional(number)
+ volume_initialization_rate = optional(number)
+ volume_size = number
+ volume_type = optional(string, "gp3")
+ })), [{ volume_size = 30 }])
+ ebs_optimized = optional(bool, false)
+ instance_target_capacity_type = optional(string, "spot")
+ instance_allocation_strategy = optional(string, "lowest-price")
+ instance_type_priorities = optional(map(number), null)
+ instance_max_spot_price = optional(string, null)
+ instance_types = list(string)
+ user_data = optional(object({
+ enabled = optional(bool, true)
+ template = optional(string, null)
+ content = optional(string, null)
+ pre_install = optional(string, "")
+ post_install = optional(string, "")
+ debug_logging_enabled = optional(bool, false)
+ }), {})
+ ssm_enabled = optional(bool, false)
+ create_service_linked_role_spot = optional(bool, false)
+ cloudwatch_agent = optional(object({
+ enabled = optional(bool, true)
+ config = optional(string, null)
+ }), {})
+ managed_security_group_enabled = optional(bool, true)
+ log_files = optional(list(object({
+ log_group_name = string
+ prefix_log_group = bool
+ file_path = string
+ log_stream_name = string
+ log_class = optional(string, "STANDARD")
+ })), null)
+ key_name = optional(string, null)
+ additional_security_group_ids = optional(list(string), [])
+ detailed_monitoring_enabled = optional(bool, false)
+ egress_rules = optional(list(object({
+ cidr_blocks = list(string)
+ ipv6_cidr_blocks = list(string)
+ prefix_list_ids = list(string)
+ from_port = number
+ protocol = string
+ security_groups = list(string)
+ self = bool
+ to_port = number
+ description = string
+ })), [{
+ cidr_blocks = ["0.0.0.0/0"]
+ ipv6_cidr_blocks = ["::/0"]
+ prefix_list_ids = null
+ from_port = 0
+ protocol = "-1"
+ security_groups = null
+ self = null
+ to_port = 0
+ description = null
+ }])
+ tags = optional(map(string), {})
+ metadata_options = optional(object({
+ instance_metadata_tags = optional(string, "enabled")
+ http_endpoint = optional(string, "enabled")
+ http_tokens = optional(string, "required")
+ http_put_response_hop_limit = optional(number, 1)
+ }), {})
+ credit_specification = optional(string, null)
+ cpu_options = optional(object({
+ core_count = optional(number)
+ threads_per_core = optional(number)
+ amd_sev_snp = optional(string)
+ nested_virtualization = optional(string)
+ }), null)
+ placement = optional(object({
+ affinity = optional(string)
+ availability_zone = optional(string)
+ group_id = optional(string)
+ group_name = optional(string)
+ host_id = optional(string)
+ host_resource_group_arn = optional(string)
+ spread_domain = optional(string)
+ tenancy = optional(string)
+ partition_number = optional(number)
+ }), null)
+ license_specifications = optional(list(object({
+ license_configuration_arn = string
+ })), [])
+ associate_public_ipv4_address = optional(bool, false)
+ on_demand_failover_for_errors = optional(list(string), [])
+ scale_errors = optional(list(string), [
+ "UnfulfillableCapacity",
+ "MaxSpotInstanceCountExceeded",
+ "TargetCapacityLimitExceededException",
+ "RequestLimitExceeded",
+ "ResourceLimitExceeded",
+ "MaxSpotInstanceCountExceeded",
+ "MaxSpotFleetRequestCountExceeded",
+ "InsufficientInstanceCapacity",
+ "InsufficientCapacityOnHost",
+ ])
+ use_dedicated_host = optional(bool, false)
+ }), null)
+ microvm = optional(object({
+ image_arn = string
+ image_version = optional(string, null)
+ ingress_network_connectors = optional(list(string), [])
+ egress_network_connectors = optional(list(string), [])
+ cloudwatch_agent = optional(object({
+ enabled = optional(bool, true)
+ config = optional(string, null)
+ }), {})
+ log_files = optional(list(object({
+ log_group_name = string
+ prefix_log_group = bool
+ file_path = string
+ log_stream_name = string
+ log_class = optional(string, "STANDARD")
+ })), null)
+ environment_variables = optional(map(string), {})
+ iam = optional(object({
+ resource_arns = optional(object({
+ images = optional(list(string), null)
+ }), {})
+ additional_policy_json = optional(object({
+ scale_up = optional(string, null)
+ }), {})
+ managed_policies = optional(object({
+ scale_up = optional(object({
+ arn = string
+ }), null)
+ pool = optional(object({
+ arn = string
+ }), null)
+ }), {})
+ }), {})
+ }), null)
+ }), {})
+ })
+
+}
diff --git a/modules/runner-config/variables.orchestration-provider.tf b/modules/runner-config/variables.orchestration-provider.tf
new file mode 100644
index 0000000000..6d176ad6d7
--- /dev/null
+++ b/modules/runner-config/variables.orchestration-provider.tf
@@ -0,0 +1,141 @@
+# Typed orchestration-provider input boundary between the common runner configuration and demand controllers.
+variable "orchestration_provider" {
+ description = <<-EOT
+ Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.
+
+ - `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.
+ - `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.
+ - `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.
+ - `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.
+ - `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.
+ - `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.
+ - `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.
+ - `webhook.queue.build.arn`: ARN of the runner configuration's build queue.
+ - `webhook.queue.build.url`: URL of the runner configuration's build queue.
+ - `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.
+ - `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.
+ - `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.
+ - `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.
+ - `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.
+ - `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.
+ - `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.
+ - `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.
+ - `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.
+ - `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.
+ - `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.
+ - `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.
+ - `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.
+ - `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.
+ - `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.
+ - `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.
+ - `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.
+ - `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.
+ - `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.
+ - `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.
+ - `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.
+ - `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.
+ - `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.
+ - `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.
+ - `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.
+ - `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.
+ - `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.
+ - `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.
+ - `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.
+ - `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.
+ - `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.
+ - `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.
+ - `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.
+ - `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.
+ - `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.
+ - `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.
+ - `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.
+ - `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.
+ - `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.
+ - `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.
+ - `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.
+ - `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`.
+ EOT
+ type = object({
+ webhook = optional(object({
+ runner = optional(object({
+ boot_time_in_minutes = optional(number, 5)
+ ephemeral = optional(bool, false)
+ jit_config_enabled = optional(bool, null)
+ maximum_count = optional(number, 3)
+ }), {})
+ github = object({
+ organization_runners = bool
+ })
+ queue = object({
+ build = object({
+ arn = string
+ url = string
+ })
+ kms_key_id = optional(string, null)
+ tags = optional(map(string), {})
+ })
+ lambda = optional(object({
+ artifact = optional(object({
+ zip = optional(string, null)
+ s3 = optional(object({
+ key = string
+ object_version = optional(string, null)
+ }), null)
+ }), {})
+ scale = optional(object({
+ up = optional(object({
+ memory_size = optional(number, 512)
+ timeout = optional(number, 60)
+ reserved_concurrent_executions = optional(number, 1)
+ job_queued_check_enabled = optional(bool, null)
+ event_source_mapping = optional(object({
+ batch_size = optional(number, 10)
+ maximum_batching_window_in_seconds = optional(number, 0)
+ }), {})
+ tags = optional(map(string), {})
+ }), {})
+ down = optional(object({
+ memory_size = optional(number, 512)
+ timeout = optional(number, 60)
+ schedule_expression = optional(string, "cron(*/5 * * * ? *)")
+ minimum_running_time_in_minutes = optional(number, null)
+ idle_config = optional(list(object({
+ cron = string
+ timeZone = string
+ idleCount = number
+ evictionStrategy = optional(string, "oldest_first")
+ })), [])
+ tags = optional(map(string), {})
+ }), {})
+ }), {})
+ pool = optional(object({
+ memory_size = optional(number, 512)
+ timeout = optional(number, 60)
+ reserved_concurrent_executions = optional(number, 1)
+ config = optional(list(object({
+ schedule_expression = string
+ schedule_expression_timezone = optional(string)
+ size = number
+ })), [])
+ include_busy_runners = optional(bool, false)
+ runner_owner = optional(string, null)
+ tags = optional(map(string), {})
+ }), {})
+ }), {})
+ job_retry = optional(object({
+ enabled = optional(bool, false)
+ delay_in_seconds = optional(number, 300)
+ delay_backoff = optional(number, 2)
+ max_attempts = optional(number, 1)
+ tags = optional(map(string), {})
+ lambda = optional(object({
+ memory_size = optional(number, 256)
+ reserved_concurrent_executions = optional(number, 1)
+ timeout = optional(number, 30)
+ }), {})
+ }), {})
+ }), null)
+ })
+ nullable = false
+
+}
diff --git a/modules/runner-config/variables.tf b/modules/runner-config/variables.tf
new file mode 100644
index 0000000000..5928693ade
--- /dev/null
+++ b/modules/runner-config/variables.tf
@@ -0,0 +1,246 @@
+variable "aws_region" {
+ description = "AWS region."
+ type = string
+}
+
+variable "aws_partition" {
+ description = "AWS partition used to construct ARNs."
+ type = string
+ default = "aws"
+}
+
+variable "prefix" {
+ description = "The prefix used for naming resources."
+ type = string
+ default = "github-actions"
+}
+
+variable "tags" {
+ description = "Base tags added to taggable resources created by this runner configuration. Shared, component, and compute-provider tag maps override matching keys within their documented resource scopes."
+ type = map(string)
+ default = {}
+}
+
+variable "runner" {
+ description = <<-EOT
+ Provider-neutral GitHub runner configuration.
+
+ - `os`: Runner operating system. Supported values are `linux`, `osx`, and `windows`.
+ - `architecture`: Runner distribution architecture, such as `x64` or `arm64`.
+ - `disable_default_labels`: Prevents GitHub's default self-hosted, operating-system, and architecture labels from being registered.
+ - `labels`: Complete set of labels supplied to the control-plane functions.
+ - `group_name`: GitHub runner group used during registration.
+ - `name_prefix`: Prefix added to registered runner names.
+ - `run_as_root`: Runs the runner service as root when supported by the compute provider.
+ - `run_as`: Operating-system user used when `run_as_root` is false.
+ - `auto_update_disabled`: Disables the GitHub runner application's built-in updater.
+ - `tags`: Additional tags for common runner resources, currently the managed runner IAM role. These override module-level `tags` with the same key.
+ - `hooks.job_started`: Script content installed as the runner job-started hook.
+ - `hooks.job_completed`: Script content installed as the runner job-completed hook.
+ - `iam.role.arn`: ARN of an externally managed runner role. When set, this module does not create or modify that role.
+ - `iam.managed_policy_arns`: Named managed-policy ARNs attached to the module-managed runner role.
+ - `iam.additional_trust_policy_json`: Optional IAM policy document merged with the selected compute provider's default runner-role trust policy.
+ - `iam.path`: IAM path for the module-managed runner role. Defaults to a path derived from `prefix`.
+ - `iam.permissions_boundary`: Permissions-boundary ARN for the module-managed runner role.
+ EOT
+ type = object({
+ os = optional(string, "linux")
+ architecture = optional(string, "x64")
+ disable_default_labels = optional(bool, false)
+ labels = list(string)
+ group_name = optional(string, "Default")
+ name_prefix = optional(string, "")
+ run_as_root = optional(bool, false)
+ run_as = optional(string, "ec2-user")
+ auto_update_disabled = optional(bool, false)
+ tags = optional(map(string), {})
+ hooks = optional(object({
+ job_started = optional(string, "")
+ job_completed = optional(string, "")
+ }), {})
+ iam = optional(object({
+ role = optional(object({
+ arn = string
+ }), null)
+ managed_policy_arns = optional(map(string), {})
+ additional_trust_policy_json = optional(string, null)
+ path = optional(string, null)
+ permissions_boundary = optional(string, null)
+ }), {})
+ })
+
+}
+
+variable "github" {
+ description = <<-EOT
+ GitHub API and runner-registration configuration.
+
+ - `app_parameters.key_base64`: Ordered Parameter Store references for GitHub App private keys.
+ - `app_parameters.id`: Ordered Parameter Store references for GitHub App IDs.
+ - `app_parameters.installation_id`: Ordered optional Parameter Store references for GitHub App installation IDs.
+ - `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.
+ - `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server requests.
+ - `user_agent`: Optional User-Agent value added to GitHub API requests.
+ EOT
+ type = object({
+ app_parameters = object({
+ key_base64 = list(map(string))
+ id = list(map(string))
+ installation_id = list(object({ name = string, arn = string }))
+ })
+ enterprise_server = optional(object({
+ url = optional(string, null)
+ ssl_verify = optional(bool, true)
+ }), {})
+ user_agent = optional(string, null)
+ })
+}
+
+variable "lambda" {
+ description = <<-EOT
+ Common Lambda substrate independent of the selected runner orchestration provider.
+
+ - `artifact.s3.bucket`: Optional shared S3 bucket containing component-owned Lambda artifacts. An orchestration provider selects its own object key and version; the bucket alone selects no artifact.
+ - `runtime`: Runtime used by the control-plane Lambda functions.
+ - `architecture`: Instruction-set architecture used by the control-plane Lambda functions. Supported values are `arm64` and `x86_64`.
+ - `subnet_ids`: Subnets used for Lambda VPC configuration.
+ - `security_group_ids`: Security groups used for Lambda VPC configuration.
+ - `tags`: Shared tags applied to Lambda function resources only. These override module-level `tags`; component `tags` override this map when keys conflict.
+ - `principals`: Additional principals allowed to assume the control-plane Lambda roles.
+ - `role.path`: IAM path for module-managed Lambda execution roles. Defaults to a path derived from `prefix`.
+ - `role.permissions_boundary`: Permissions-boundary ARN applied to module-managed Lambda execution roles.
+ EOT
+ type = object({
+ artifact = optional(object({
+ s3 = optional(object({
+ bucket = optional(string, null)
+ }), {})
+ }), {})
+ runtime = optional(string, "nodejs24.x")
+ architecture = optional(string, "arm64")
+ subnet_ids = optional(list(string), [])
+ security_group_ids = optional(list(string), [])
+ tags = optional(map(string), {})
+ principals = optional(list(object({
+ type = string
+ identifiers = list(string)
+ })), [])
+ role = optional(object({
+ path = optional(string, null)
+ permissions_boundary = optional(string, null)
+ }), {})
+ })
+ default = {}
+
+}
+
+variable "ssm" {
+ description = <<-EOT
+ Parameter Store paths, encryption, tag scopes, and housekeeper configuration.
+
+ - `paths.root`: Root Parameter Store path for this runner configuration.
+ - `paths.tokens`: Path segment under `paths.root` used for registration tokens and just-in-time configuration.
+ - `paths.config`: Path segment under `paths.root` used for persistent runner configuration.
+ - `kms_key_id`: Optional customer-managed KMS key ARN used by control-plane IAM policies to decrypt shared GitHub App parameters. The ARN may be unknown until apply; null omits the provider-owned KMS statements. It does not select encryption for runtime-created runner parameters.
+ - `tags`: Shared tags for SSM-related resources. These override module-level `tags` and are inherited by parameter and housekeeper resources.
+ - `parameters.tags`: Tags for Terraform-managed runner configuration parameters and temporary parameters created by the scale-up and pool Lambdas. These override module-level and `ssm.tags` values with the same key.
+ - `housekeeper.schedule_expression`: EventBridge schedule expression that invokes the SSM housekeeper.
+ - `housekeeper.state`: EventBridge rule state, such as `ENABLED` or `DISABLED`.
+ - `housekeeper.tags`: Tags for housekeeper resources, including the Lambda function, log group, EventBridge rule, and IAM role. These override module-level, `ssm.tags`, shared Lambda, and shared log tags when keys conflict.
+ - `housekeeper.lambda.artifact`: Component-owned SSM-housekeeper artifact selection. Set at most one of `zip` or `s3`; when neither is selected, the module uses its packaged runner control-plane archive. This selector does not inherit an orchestration-provider artifact.
+ - `housekeeper.lambda.artifact.zip`: Optional local path to the SSM-housekeeper Lambda archive.
+ - `housekeeper.lambda.artifact.s3`: Optional object key and version in the shared `lambda.artifact.s3.bucket`. Selecting S3 requires that common bucket.
+ - `housekeeper.lambda.artifact.s3.key`: Object key of the SSM-housekeeper Lambda archive.
+ - `housekeeper.lambda.artifact.s3.object_version`: Optional object version of the SSM-housekeeper Lambda archive.
+ - `housekeeper.lambda.memory_size`: Memory allocated to the SSM housekeeper Lambda in MB.
+ - `housekeeper.lambda.timeout`: SSM housekeeper Lambda timeout in seconds.
+ - `housekeeper.config.tokenPath`: Parameter Store token path cleaned by the housekeeper. When omitted, the configured runner token path is used.
+ - `housekeeper.config.minimumDaysOld`: Minimum parameter age in days before deletion is allowed.
+ - `housekeeper.config.dryRun`: Reports eligible parameters without deleting them when true.
+ EOT
+ type = object({
+ paths = object({
+ root = string
+ tokens = string
+ config = string
+ })
+ kms_key_id = optional(string, null)
+ tags = optional(map(string), {})
+ parameters = optional(object({
+ tags = optional(map(string), {})
+ }), {})
+ housekeeper = optional(object({
+ schedule_expression = optional(string, "rate(1 day)")
+ state = optional(string, "ENABLED")
+ tags = optional(map(string), {})
+ lambda = optional(object({
+ artifact = optional(object({
+ zip = optional(string, null)
+ s3 = optional(object({
+ key = string
+ object_version = optional(string, null)
+ }), null)
+ }), {})
+ memory_size = optional(number, 512)
+ timeout = optional(number, 60)
+ }), {})
+ config = optional(object({
+ tokenPath = optional(string)
+ minimumDaysOld = optional(number, 1)
+ dryRun = optional(bool, false)
+ }), {})
+ }), {})
+ })
+
+}
+
+variable "observability" {
+ description = <<-EOT
+ Logging, tracing, and metrics configuration for control-plane and provider resources.
+
+ - `logs.level`: Application log level supplied to the control-plane functions.
+ - `logs.retention_in_days`: CloudWatch Logs retention period.
+ - `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt CloudWatch log groups.
+ - `logs.class`: CloudWatch log-group class. Supported values are `STANDARD` and `INFREQUENT_ACCESS`.
+ - `logs.tags`: Shared tags for CloudWatch log groups. These override module-level `tags`; component `tags` override this map when keys conflict.
+ - `tracing.mode`: Optional Lambda active-tracing mode. Null disables X-Ray tracing configuration.
+ - `tracing.capture_http_requests`: Enables HTTP request capture in the tracing helper.
+ - `tracing.capture_error`: Enables error capture in the tracing helper.
+ - `metrics.enabled`: Enables module-emitted metrics.
+ - `metrics.namespace`: CloudWatch namespace used for emitted metrics.
+ - `metrics.metric.github_app_rate_limit.enabled`: Emits GitHub App rate-limit metrics.
+ - `metrics.metric.job_retry.enabled`: Emits job-retry metrics.
+ - `metrics.metric.spot_termination_warning.enabled`: Emits spot-termination warning metrics where supported.
+ EOT
+ type = object({
+ logs = optional(object({
+ level = optional(string, "info")
+ retention_in_days = optional(number, 180)
+ kms_key_id = optional(string, null)
+ class = optional(string, "STANDARD")
+ tags = optional(map(string), {})
+ }), {})
+ tracing = optional(object({
+ mode = optional(string, null)
+ capture_http_requests = optional(bool, false)
+ capture_error = optional(bool, false)
+ }), {})
+ metrics = optional(object({
+ enabled = optional(bool, false)
+ namespace = optional(string, "GitHub Runners")
+ metric = optional(object({
+ github_app_rate_limit = optional(object({
+ enabled = optional(bool, true)
+ }), {})
+ job_retry = optional(object({
+ enabled = optional(bool, true)
+ }), {})
+ spot_termination_warning = optional(object({
+ enabled = optional(bool, true)
+ }), {})
+ }), {})
+ }), {})
+ })
+ default = {}
+
+}
diff --git a/modules/runner-config/versions.tf b/modules/runner-config/versions.tf
new file mode 100644
index 0000000000..3ef011ea0a
--- /dev/null
+++ b/modules/runner-config/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.4.0"
+
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 6.33"
+ }
+ }
+}
diff --git a/tests/ministack/README.md b/tests/ministack/README.md
index b6442194ff..eb35b954a7 100644
--- a/tests/ministack/README.md
+++ b/tests/ministack/README.md
@@ -1,14 +1,17 @@
# MiniStack example tests
The MiniStack workflow runs the `base`, `prebuilt`, `default`, `ephemeral`,
-`multi-runner`, and `termination-watcher` examples directly with Terraform
-1.4.0 and the latest Terraform release.
+`multi-runner`, `multi-runner-v2`, `microvm-foundation`, and `termination-watcher` examples directly
+with Terraform 1.4.0 and the latest Terraform release.
The examples with input variables get their inputs from their own tfvars files
in this directory. The `termination-watcher` example has no input variables
-and uses the configuration checked into the example itself. No override files,
-setup module, or checked-in Terraform fixture configuration is used. The
-helper creates and removes a temporary AMI override for `default` and
-`ephemeral`, and temporary SSM parameters for `multi-runner`.
+and uses the configuration checked into the example itself. The
+`microvm-foundation` lane uses an isolated tfvars file with no network
+connectors because MiniStack does not provide the regional Lambda Network
+Connector API. No override files or setup module are checked in. The helper
+creates and removes a temporary AMI override for `default` and
+`ephemeral`, temporary SSM parameters for `multi-runner`, and temporary AMI
+fixtures plus an override for `multi-runner-v2`.
Start MiniStack, set the AWS endpoint and test credentials, then run:
@@ -23,6 +26,10 @@ tests/ministack/run-example.sh apply ephemeral
# or
tests/ministack/run-example.sh apply multi-runner
# or
+tests/ministack/run-example.sh apply multi-runner-v2
+# or
+tests/ministack/run-example.sh apply microvm-foundation
+# or
tests/ministack/run-example.sh apply termination-watcher
```
diff --git a/tests/ministack/microvm-foundation.tfvars b/tests/ministack/microvm-foundation.tfvars
new file mode 100644
index 0000000000..9d576d77c7
--- /dev/null
+++ b/tests/ministack/microvm-foundation.tfvars
@@ -0,0 +1,3 @@
+aws_region = "eu-west-1"
+
+network_connectors = {}
diff --git a/tests/ministack/multi-runner-v2.tfvars b/tests/ministack/multi-runner-v2.tfvars
new file mode 100644
index 0000000000..0d646a95f2
--- /dev/null
+++ b/tests/ministack/multi-runner-v2.tfvars
@@ -0,0 +1,7 @@
+environment = "ministack-multi-runner-v2"
+aws_region = "eu-west-1"
+
+github_app = {
+ id = "0"
+ key_base64 = "ministack-invalid-key"
+}
diff --git a/tests/ministack/run-example.sh b/tests/ministack/run-example.sh
index e1a1b6a813..8961f71db9 100755
--- a/tests/ministack/run-example.sh
+++ b/tests/ministack/run-example.sh
@@ -6,22 +6,23 @@ export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-000000000000}"
export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test-only}"
export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-eu-west-1}"
export AWS_REGION="${AWS_REGION:-eu-west-1}"
-export AWS_ENDPOINT_URL="${AWS_ENDPOINT_URL:-http://127.0.0.1:4566}"
+export AWS_ENDPOINT_URL="${AWS_ENDPOINT_URL:-http://localhost:4566}"
export AWS_EC2_METADATA_DISABLED="${AWS_EC2_METADATA_DISABLED:-true}"
action="${1:-}"
example="${2:-}"
tfvars_file="${3:-${MINISTACK_TFVARS_FILE:-}}"
+microvm_foundation_default_tfvars=false
case "$example" in
- base | prebuilt | default | ephemeral | multi-runner)
+ base | prebuilt | default | ephemeral | multi-runner | multi-runner-v2 | microvm-foundation)
use_tfvars=true
;;
termination-watcher)
use_tfvars=false
;;
*)
- echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, termination-watcher" >&2
+ echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, multi-runner-v2, microvm-foundation, termination-watcher" >&2
exit 64
;;
esac
@@ -29,7 +30,7 @@ esac
case "$action" in
init | plan | apply | destroy) ;;
*)
- echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|termination-watcher} [TFVARS_FILE]" >&2
+ echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|multi-runner-v2|microvm-foundation|termination-watcher} [TFVARS_FILE]" >&2
exit 64
;;
esac
@@ -41,6 +42,9 @@ example_root="$source_root/examples/$example"
if [ "$use_tfvars" = true ]; then
if [ -z "$tfvars_file" ]; then
tfvars_file="$script_dir/$example.tfvars"
+ if [ "$example" = microvm-foundation ]; then
+ microvm_foundation_default_tfvars=true
+ fi
fi
case "$tfvars_file" in
@@ -53,6 +57,7 @@ if [ "$use_tfvars" = true ]; then
echo "Pass it as the third argument or set MINISTACK_TFVARS_FILE." >&2
exit 66
fi
+
fi
lambda_fixture_dir=""
@@ -60,6 +65,7 @@ lambda_created_paths=""
ami_created_ids=""
ssm_created_names=""
override_created_paths=""
+tfvars_created_paths=""
lambda_zip_paths="
$source_root/lambdas/functions/ami-housekeeper/ami-housekeeper.zip
$source_root/lambdas/functions/control-plane/runners.zip
@@ -73,6 +79,10 @@ cleanup() {
rm -f "$override_file"
done
+ for fixture_file in $tfvars_created_paths; do
+ rm -f "$fixture_file"
+ done
+
for name in $ssm_created_names; do
ministack_aws ssm delete-parameter --name "$name" >/dev/null 2>&1 || true
done
@@ -150,6 +160,48 @@ create_ssm_fixture() {
$name"
}
+create_microvm_foundation_fixture() {
+ vpc_id=$(ministack_aws ec2 describe-vpcs \
+ --filters Name=is-default,Values=true \
+ --query 'Vpcs[0].VpcId' \
+ --output text)
+ subnet_id=$(ministack_aws ec2 describe-subnets \
+ --filters "Name=vpc-id,Values=$vpc_id" "Name=state,Values=available" \
+ --query 'Subnets[0].SubnetId' \
+ --output text)
+
+ case "$vpc_id" in
+ vpc-[0-9a-f]*) ;;
+ *)
+ echo "MiniStack default VPC fixture was not found." >&2
+ exit 70
+ ;;
+ esac
+
+ case "$subnet_id" in
+ subnet-[0-9a-f]*) ;;
+ *)
+ echo "MiniStack default subnet fixture was not found." >&2
+ exit 70
+ ;;
+ esac
+
+ fixture_tfvars=$(mktemp "${TMPDIR:-/tmp}/terraform-aws-github-runner-microvm-foundation.XXXXXX")
+ printf '%s\n' \
+ "aws_region = \"$AWS_DEFAULT_REGION\"" \
+ '' \
+ 'network_connectors = {' \
+ ' ministack = {' \
+ ' name = "ministack"' \
+ " vpc_id = \"$vpc_id\"" \
+ " subnet_ids = [\"$subnet_id\"]" \
+ ' }' \
+ '}' > "$fixture_tfvars"
+ tfvars_created_paths="$tfvars_created_paths
+$fixture_tfvars"
+ tfvars_file="$fixture_tfvars"
+}
+
create_ami_override() {
override_file="$example_root/zz_ministack_ami_override.tf"
printf '%s\n' \
@@ -195,6 +247,111 @@ create_multi_runner_override() {
$override_file"
}
+create_multi_runner_v2_override() {
+ override_file="$example_root/zz_ministack_override.tf"
+ printf '%s\n' \
+ 'module "runners" {' \
+ ' global_config_compute_provider = {' \
+ ' aws = {' \
+ ' ec2 = {' \
+ ' vpc_id = module.base.vpc.vpc_id' \
+ ' subnet_ids = module.base.vpc.private_subnets' \
+ ' ssm_enabled = true' \
+ ' runner_binaries = {' \
+ ' enabled = false' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' multi_runner_config = {' \
+ ' linux-arm64 = {' \
+ ' runner = {' \
+ ' architecture = "arm64"' \
+ ' name_prefix = "amazon-arm64-"' \
+ ' extra_labels = ["amazon"]' \
+ ' }' \
+ ' orchestration_provider = {' \
+ ' webhook = {' \
+ ' runner = { maximum_count = 1 }' \
+ ' matcherConfig = {' \
+ ' exactMatch = true' \
+ ' labelMatchers = [["self-hosted", "linux", "arm64", "amazon"]]' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' compute_provider = {' \
+ ' aws = {' \
+ ' ec2 = {' \
+ ' instance_types = ["t4g.large", "c6g.large"]' \
+ ' ami = {' \
+ ' filter = { name = ["ministack-v2-linux-arm64"], state = ["available"] }' \
+ ' owners = ["self"]' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' linux-x64 = {' \
+ ' runner = {' \
+ ' name_prefix = "amazon-x64-"' \
+ ' extra_labels = ["amazon"]' \
+ ' }' \
+ ' orchestration_provider = {' \
+ ' webhook = {' \
+ ' runner = { ephemeral = true, maximum_count = 1 }' \
+ ' matcherConfig = {' \
+ ' labelMatchers = [["self-hosted", "linux", "x64", "amazon"]]' \
+ ' exactMatch = false' \
+ ' priority = 1' \
+ ' }' \
+ ' queue = { delay_webhook_event = 0 }' \
+ ' job_retry = { enabled = true }' \
+ ' }' \
+ ' }' \
+ ' compute_provider = {' \
+ ' aws = {' \
+ ' ec2 = {' \
+ ' instance_types = ["m5a.large", "m5ad.large"]' \
+ ' ami = {' \
+ ' filter = { name = ["ministack-v2-linux-x64"], state = ["available"] }' \
+ ' owners = ["self"]' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' windows-x64 = {' \
+ ' runner = {' \
+ ' os = "windows"' \
+ ' name_prefix = "windows-x64-"' \
+ ' }' \
+ ' orchestration_provider = {' \
+ ' webhook = {' \
+ ' runner = { boot_time_in_minutes = 20, maximum_count = 1 }' \
+ ' matcherConfig = {' \
+ ' exactMatch = true' \
+ ' labelMatchers = [["self-hosted", "windows", "x64", "servercore-2022"]]' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' compute_provider = {' \
+ ' aws = {' \
+ ' ec2 = {' \
+ ' instance_types = ["m5.large", "c5.large"]' \
+ ' ami = {' \
+ ' filter = { name = ["ministack-v2-windows-x64"], state = ["available"] }' \
+ ' owners = ["self"]' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ ' }' \
+ '}' > "$override_file"
+ override_created_paths="$override_created_paths
+$override_file"
+}
+
create_ministack_fixtures() {
if ! command -v aws >/dev/null 2>&1; then
echo "AWS CLI is required to seed MiniStack API fixtures." >&2
@@ -213,6 +370,10 @@ create_ministack_fixtures() {
wait_for_ministack
+ if [ "$microvm_foundation_default_tfvars" = true ]; then
+ create_microvm_foundation_fixture
+ fi
+
lambda_fixture_dir=$(mktemp -d "${TMPDIR:-/tmp}/terraform-aws-github-runner-ministack-lambda.XXXXXX")
printf '%s\n' 'exports.handler = async () => ({ statusCode: 200, body: "ministack" });' > "$lambda_fixture_dir/index.js"
(CDPATH='' cd -- "$lambda_fixture_dir" && zip -q ministack-lambda.zip index.js)
@@ -245,6 +406,12 @@ $lambda_zip"
"/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-arm64" \
"ami-0abcdef1234567890"
;;
+ multi-runner-v2)
+ create_multi_runner_v2_override
+ create_ami_fixture "ministack-v2-linux-arm64" arm64 >/dev/null
+ create_ami_fixture "ministack-v2-linux-x64" x86_64 >/dev/null
+ create_ami_fixture "ministack-v2-windows-x64" x86_64 >/dev/null
+ ;;
esac
}