You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|[aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)| data source |
102
104
103
105
## Inputs
@@ -125,18 +127,20 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
125
127
| <aname="input_enable_jit_config"></a> [enable\_jit\_config](#input\_enable\_jit\_config)| Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI. |`bool`|`null`| no |
126
128
| <aname="input_enable_job_queued_check"></a> [enable\_job\_queued\_check](#input\_enable\_job\_queued\_check)| Only scale if the job event received by the scale up lambda is in the queued state. By default enabled for non ephemeral runners and disabled for ephemeral. Set this variable to overwrite the default behavior. |`bool`|`null`| no |
127
129
| <aname="input_enable_managed_runner_security_group"></a> [enable\_managed\_runner\_security\_group](#input\_enable\_managed\_runner\_security\_group)| Enables creation of the default managed security group. Unmanaged security groups can be specified via `runner_additional_security_group_ids`. |`bool`|`true`| no |
128
-
| <aname="input_enable_organization_runners"></a> [enable\_organization\_runners](#input\_enable\_organization\_runners)| Register runners to organization, instead of repo level|`bool`|`false`| no |
130
+
| <aname="input_enable_organization_runners"></a> [enable\_organization\_runners](#input\_enable\_organization\_runners)|DEPRECATED: Use `runner_registration_level` instead. Register runners to organization (true) or repository (false).|`bool`|`false`| no |
129
131
| <aname="input_enable_runner_binaries_syncer"></a> [enable\_runner\_binaries\_syncer](#input\_enable\_runner\_binaries\_syncer)| Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI. |`bool`|`true`| no |
130
132
| <aname="input_enable_runner_detailed_monitoring"></a> [enable\_runner\_detailed\_monitoring](#input\_enable\_runner\_detailed\_monitoring)| Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details. |`bool`|`false`| no |
131
133
| <aname="input_enable_runner_on_demand_failover_for_errors"></a> [enable\_runner\_on\_demand\_failover\_for\_errors](#input\_enable\_runner\_on\_demand\_failover\_for\_errors)| Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later. |`list(string)`|`[]`| no |
132
134
| <aname="input_enable_runner_workflow_job_labels_check_all"></a> [enable\_runner\_workflow\_job\_labels\_check\_all](#input\_enable\_runner\_workflow\_job\_labels\_check\_all)| If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ label matches it will trigger the webhook. |`bool`|`true`| no |
133
135
| <aname="input_enable_ssm_on_runners"></a> [enable\_ssm\_on\_runners](#input\_enable\_ssm\_on\_runners)| Enable to allow access to the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. |`bool`|`false`| no |
134
136
| <aname="input_enable_user_data_debug_logging_runner"></a> [enable\_user\_data\_debug\_logging\_runner](#input\_enable\_user\_data\_debug\_logging\_runner)| Option to enable debug logging for user-data, this logs all secrets as well. |`bool`|`false`| no |
135
137
| <aname="input_enable_userdata"></a> [enable\_userdata](#input\_enable\_userdata)| Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI. |`bool`|`true`| no |
138
+
| <a name="input_enterprise_pat"></a> [enterprise\_pat](#input\_enterprise\_pat) | Enterprise Personal Access Token(s) (PAT) for authenticating with GitHub Enterprise runner management APIs.<br/> Required when runner\_registration\_level is "enterprise". Each PAT must have the 'manage\_runners:enterprise' scope.<br/> You can either provide the PAT value directly (Terraform creates the SSM parameter) or reference a pre-existing SSM parameter.<br/> Note: the provided SSM parameter arn and name take precedence over the direct value.<br/><br/> To distribute API calls across multiple PATs and avoid rate limiting, provide a comma-separated list of PATs<br/> in the 'pat' field or in the SSM parameter value. The Lambda functions will randomly select one PAT per invocation.<br/> Example: enterprise\_pat = { pat = "ghp\_token1,ghp\_token2,ghp\_token3" } | <pre>object({<br/> pat = optional(string)<br/> pat_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> })</pre> | `null` | no |
139
+
| <aname="input_enterprise_slug"></a> [enterprise\_slug](#input\_enterprise\_slug)| The slug (URL identifier) of the GitHub Enterprise account. Required when runner\_registration\_level is "enterprise". Example: "my-enterprise". |`string`|`null`| no |
136
140
| <aname="input_eventbridge"></a> [eventbridge](#input\_eventbridge)| Enable the use of EventBridge by the module. By enabling this feature events will be put on the EventBridge by the webhook instead of directly dispatching to queues for scaling.<br/><br/> `enable`: Enable the EventBridge feature.<br/> `accept_events`: List can be used to only allow specific events to be putted on the EventBridge. By default all events, empty list will be be interpreted as all events. | <pre>object({<br/> enable = optional(bool, true)<br/> accept_events = optional(list(string), null)<br/> })</pre> |`{}`| no |
137
141
| <aname="input_ghes_ssl_verify"></a> [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify)| GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). |`bool`|`true`| no |
138
142
| <aname="input_ghes_url"></a> [ghes\_url](#input\_ghes\_url)| GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB. However if you are using GitHub Enterprise Cloud with data-residency (ghe.com), set the endpoint here. Example - https://companyname.ghe.com|`string`|`null`| no |
139
-
| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app.<br/> You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/> If you chose to provide the configuration values directly here,<br/> please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/> Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/> key_base64 = optional(string)<br/> key_base64_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> id = optional(string)<br/> id_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> webhook_secret = optional(string)<br/> webhook_secret_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> })</pre> | n/a | yes |
143
+
| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app.<br/> You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/> If you chose to provide the configuration values directly here,<br/> please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/> Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc).<br/><br/> For enterprise runners (runner\_registration\_level = "enterprise"), only `webhook_secret` (or `webhook_secret_ssm`) is required.<br/> The `key_base64` and `id` fields are only needed for org/repo level runners. | <pre>object({<br/> key_base64 = optional(string)<br/> key_base64_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> id = optional(string)<br/> id_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> webhook_secret = optional(string)<br/> webhook_secret_ssm = optional(object({<br/> arn = string<br/> name = string<br/> }))<br/> })</pre> | n/a | yes |
140
144
| <aname="input_idle_config"></a> [idle\_config](#input\_idle\_config)| List of time periods, defined as a cron expression, to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle. | <pre>list(object({<br/> cron = string<br/> timeZone = string<br/> idleCount = number<br/> evictionStrategy = optional(string, "oldest_first")<br/> }))</pre> |`[]`| no |
141
145
| <aname="input_instance_allocation_strategy"></a> [instance\_allocation\_strategy](#input\_instance\_allocation\_strategy)| The allocation strategy for spot instances. AWS recommends using `price-capacity-optimized` however the AWS default is `lowest-price`. |`string`|`"lowest-price"`| no |
142
146
| <aname="input_instance_max_spot_price"></a> [instance\_max\_spot\_price](#input\_instance\_max\_spot\_price)| Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet. |`string`|`null`| no |
@@ -169,7 +173,7 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
169
173
| <aname="input_pool_lambda_memory_size"></a> [pool\_lambda\_memory\_size](#input\_pool\_lambda\_memory\_size)| Memory size limit for scale-up lambda. |`number`|`512`| no |
170
174
| <aname="input_pool_lambda_reserved_concurrent_executions"></a> [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions)| Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. |`number`|`1`| no |
171
175
| <aname="input_pool_lambda_timeout"></a> [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout)| Time out for the pool lambda in seconds. |`number`|`60`| no |
172
-
| <aname="input_pool_runner_owner"></a> [pool\_runner\_owner](#input\_pool\_runner\_owner)| The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported. |`string`|`null`| no |
176
+
| <aname="input_pool_runner_owner"></a> [pool\_runner\_owner](#input\_pool\_runner\_owner)| The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported. For enterprise-level runners, defaults to the enterprise\_slug if not set. |`string`|`null`| no |
173
177
| <aname="input_prefix"></a> [prefix](#input\_prefix)| The prefix used for naming resources |`string`|`"github-actions"`| no |
174
178
| <aname="input_queue_encryption"></a> [queue\_encryption](#input\_queue\_encryption)| Configure how data on queues managed by the modules is encrypted at REST. Options are encrypted via SSE, non encrypted and via KMS. By default encrypted via SSE is enabled. See for more details the Terraform `aws_sqs_queue` resource https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue.| <pre>object({<br/> kms_data_key_reuse_period_seconds = number<br/> kms_master_key_id = string<br/> sqs_managed_sse_enabled = bool<br/> })</pre> | <pre>{<br/> "kms_data_key_reuse_period_seconds": null,<br/> "kms_master_key_id": null,<br/> "sqs_managed_sse_enabled": true<br/>}</pre> | no |
175
179
| <aname="input_redrive_build_queue"></a> [redrive\_build\_queue](#input\_redrive\_build\_queue)| Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries. | <pre>object({<br/> enabled = bool<br/> maxReceiveCount = number<br/> })</pre> | <pre>{<br/> "enabled": false,<br/> "maxReceiveCount": null<br/>}</pre> | no |
@@ -203,6 +207,7 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
203
207
| <aname="input_runner_name_prefix"></a> [runner\_name\_prefix](#input\_runner\_name\_prefix)| The prefix used for the GitHub runner name. The prefix will be used in the default start script to prefix the instance name when register the runner in GitHub. The value is available via an EC2 tag 'ghr:runner\_name\_prefix'. |`string`|`""`| no |
204
208
| <aname="input_runner_os"></a> [runner\_os](#input\_runner\_os)| The EC2 Operating System type to use for action runner instances (linux,windows). |`string`|`"linux"`| no |
205
209
| <aname="input_runner_placement"></a> [runner\_placement](#input\_runner\_placement)| The placement options for the instance. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#placement for details. | <pre>object({<br/> affinity = optional(string)<br/> availability_zone = optional(string)<br/> group_id = optional(string)<br/> group_name = optional(string)<br/> host_id = optional(string)<br/> host_resource_group_arn = optional(string)<br/> spread_domain = optional(string)<br/> tenancy = optional(string)<br/> partition_number = optional(number)<br/> })</pre> |`null`| no |
210
+
| <aname="input_runner_registration_level"></a> [runner\_registration\_level](#input\_runner\_registration\_level)| The level at which runners are registered in GitHub. Valid values: "repo", "org", "enterprise". Defaults to "repo" when not set. |`string`|`null`| no |
206
211
| <aname="input_runner_run_as"></a> [runner\_run\_as](#input\_runner\_run\_as)| Run the GitHub actions agent as user. |`string`|`"ec2-user"`| no |
207
212
| <aname="input_runners_ebs_optimized"></a> [runners\_ebs\_optimized](#input\_runners\_ebs\_optimized)| Enable EBS optimization for the runner instances. |`bool`|`false`| no |
208
213
| <aname="input_runners_lambda_s3_key"></a> [runners\_lambda\_s3\_key](#input\_runners\_lambda\_s3\_key)| S3 key for runners lambda function. Required if using S3 bucket to specify lambdas. |`string`|`null`| no |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments