terraform-aws-github-runner/modules/runners/policies/lambda-scale-up.json at cf3ecdf8a0cf0724d488a31d990206cb2743f38e · github-aws-runners/terraform-aws-github-runner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeTags",
                "ec2:RunInstances",
                "ec2:CreateFleet",
                "ec2:CreateTags"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "${arn_runner_instance_role}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:AddTagsToResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": [
                "${github_app_key_base64_arn}",
                "${github_app_id_arn}",
                "${ssm_config_path}/*",
                "${ssm_ami_id_parameter_arn}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
              "ssm:GetParameters"
            ],
            "Resource": [
                "${ssm_ami_id_parameter_arn}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:ReceiveMessage",
                "sqs:GetQueueAttributes",
                "sqs:DeleteMessage"
            ],
            "Resource": "${sqs_arn}"
%{ if kms_key_arn != "" ~}
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "${kms_key_arn}"
%{ endif ~}
%{ if ami_kms_key_arn != "" ~}
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:ReEncrypt*",
                "kms:Decrypt"
            ],
            "Resource": "${ami_kms_key_arn}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant"
            ],
            "Resource": "${ami_kms_key_arn}",
            "Condition": {
                "Bool": {
                    "aws:ViaAWSService": "true"
                }
            }
%{ endif ~}
        }
    ]
}