{"id":18952411,"url":"https://github.com/tailscale/tailscale-aws-host-acl-updater","last_synced_at":"2025-10-29T12:12:12.759Z","repository":{"id":146333637,"uuid":"524862735","full_name":"tailscale/tailscale-aws-host-acl-updater","owner":"tailscale","description":"Update Hosts list in Tailscale ACL file as AWS resources move about.","archived":false,"fork":false,"pushed_at":"2022-08-20T15:07:49.000Z","size":16,"stargazers_count":15,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-20T01:31:58.185Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tailscale.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-15T05:13:57.000Z","updated_at":"2025-02-15T07:40:48.000Z","dependencies_parsed_at":"2023-06-14T05:45:42.588Z","dependency_job_id":null,"html_url":"https://github.com/tailscale/tailscale-aws-host-acl-updater","commit_stats":null,"previous_names":["tailscale/tailscale-aws-host-acl-updater","dentongentry/tailscale-aws-host-acl-updater"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tailscale/tailscale-aws-host-acl-updater","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Ftailscale-aws-host-acl-updater","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Ftailscale-aws-host-acl-updater/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Ftailscale-aws-host-acl-updater/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Ftailscale-aws-host-acl-updater/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tailscale","download_url":"https://codeload.github.com/tailscale/tailscale-aws-host-acl-updater/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Ftailscale-aws-host-acl-updater/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":281618349,"owners_count":26532145,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-29T02:00:06.901Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T13:33:16.590Z","updated_at":"2025-10-29T12:12:12.730Z","avatar_url":"https://github.com/tailscale.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Tailscale AWS hostname monitor\n\nhttps://tailscale.com\n\n## Overview\n\nThis repository contains a set of AWS Lambda functions intended to:\n- receive notifications of changes in AWS tags across a number of\n  AWS services\n- check for an AWS tag named \"ts-hostname\"\n- automatically populate the `Hosts` section of a Tailscale ACL\n  Policy file to update the IP address of that hostname\n\nThis is intended to be used in conjunction with a Tailscale\n[subnet router](https://tailscale.com/kb/1019/subnets/) offering\na Tailscale route to a private AWS VPC. ACLs can be defined for\nthe private 172.16.x.y VPC IP addresses, relying on this Lambda\nfunction to update the IP address if the AWS instance is replaced.\n\n## Setup\n\n### Step 1: Lambda function\nCreate a Lambda function in the AWS Console in the AWS region where\nthe EC2/RDS/etc resources used with Tailscale are located.\n\nCloudWatch events can only be sent to a Lambda function in the same\nregion. A Lambda will be needed in each region where there are\nresources to be tracked.\n\n\n### Step 2: Permissions\nIn Lambda \u003e Configuration \u003e Permissions, the ARN of the role created for the\nLambda function will be shown. It needs to be given several permissions.\n\na. It needs to be able to read EC2 Instance Details. Attach the\n`AmazonEC2ReadOnlyAccess` policy to the role.\n \nb. It needs to be able to get RDS instance details and tags. Create\nan inline policy of:\n```\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"AllowRDSTagsRead\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"rds:DescribeDBInstances\",\n\t\t\"rds:ListTagsForResource\"\n            ],\n            \"Resource\": \"*\"\n        }\n    ]\n}\n```\n\n### Step 3: Configuration\nIn Lambda \u003e Configuration \u003e Environment variables, create the following variable:\n- `TAILSCALE_TAILNET`: the name of the tailnet, such as `example.com` or `octocat.github`\n\n\nIn the AWS Secrets Manager create a secret containing a Key/Value pair:\n- Key: `API_KEY`\n- Value: the `tskey-...` of a [Tailscale API key](https://tailscale.com/kb/1101/api/).\n\nIn the Replicate Secret section you can replicate the same secret across all regions\nwhere you intend to run this Lambda function. All of them can use the same API Key.\n\nWe suggest naming the secret `ts-acl-hostname-updater`, but you may choose\nwhatever naming convention you prefer by setting the `SECRET_NAME` environment variable.\n\nIn the role created for the Lambda function (in Lambda \u003e Configuration \u003e Permissions) add\nanother inline policy to access the secret:\n```\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"secretsmanager:GetSecretValue\"\n            ],\n            \"Resource\": [\n                \"ARN_OF_SECRET\"\n            ]\n        }\n    ]\n}\n```\n\n### Step 4: EventBridge\nCreate an EventBridge event with pattern:\n```\n{\n  \"source\": [\"aws.tag\"],\n  \"detail-type\": [\"Tag Change on Resource\"],\n  \"detail\": {\n    \"service\": [\"ec2\", \"rds\", \"elasticloadbalancing\"]\n  }\n}\n```\nThis will run the Lambda function whenever tags are changed on an EC2 or RDS instance.\n\nCreate a second EventBridge rule with the pattern:\n```\n{\n  \"source\": [\"aws.rds\"],\n  \"detail-type\": [\"RDS DB Instance Event\"]\n}\n```\nThis will run the Lambda function whenever the RDS instance reboots or otherwise\nchanges its running state.\n\nCreate a third EventBridge rule with the pattern:\n```\n{\n  \"source\": [\"aws.elasticloadbalancing\"],\n  \"detail-type\": [\"AWS API Call via CloudTrail\"],\n  \"detail\": {\n    \"eventSource\": [\"elasticloadbalancing.amazonaws.com\"],\n    \"eventName\": [\"CreateLoadBalancer\"]\n  }\n}\n```\nThis will run the Lambda function whenever a new Load Balancer instance is created.\nUnfortunately AWS does not generate CloudWatch events for other Load Balancer state\nchanges, we cannot automatically run the Lambda.\n\n\n### Step 5: Add `ts-hostname` AWS Tags\nFor any AWS resource for which you wish this Lambda function to keep the IP\naddress up to date, two things need to be done:\n1. Add an AWS Tag with key `ts-hostname` and value of the hostname which it is to maintain.\n   This is an _AWS_ Tag, not a Tag in the Tailscale ACL file.\n1. Add an initial entry for the hostname in the [Tailscale ACLs Hosts section](https://login.tailscale.com/admin/acls).\n   This Lambda function will update a `Hosts` entry which is already present. It will not\n   add a new Hosts entry. This initial entry can be any valid IP address like `1.2.3.4`\n\n## Bugs\n\nPlease file any issues about this function on\n[the issue tracker](https://github.com/tailscale/tailscale/issues).\n\n## Contributing\n\nPRs welcome! But please file bugs. Commit messages should [reference\nbugs](https://docs.github.com/en/github/writing-on-github/autolinked-references-and-urls).\n\nWe require [Developer Certificate of\nOrigin](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin)\n`Signed-off-by` lines in commits.\n\n## About Us\n\n[Tailscale](https://tailscale.com/) is primarily developed by the\npeople at https://github.com/orgs/tailscale/people. For other contributors,\nsee:\n\n* https://github.com/tailscale/tailscale/graphs/contributors\n* https://github.com/tailscale/tailscale-android/graphs/contributors\n\n## Legal\n\nWireGuard is a registered trademark of Jason A. Donenfeld.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftailscale%2Ftailscale-aws-host-acl-updater","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftailscale%2Ftailscale-aws-host-acl-updater","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftailscale%2Ftailscale-aws-host-acl-updater/lists"}