https://github.com/flexion/aws-codebuild-runner-project-tf-module

A Terraform module to build a codebuild hosted runner project
https://github.com/flexion/aws-codebuild-runner-project-tf-module
Last synced: 4 months ago
JSON representation
A Terraform module to build a codebuild hosted runner project
Host: GitHub
URL: https://github.com/flexion/aws-codebuild-runner-project-tf-module
Owner: flexion
Created: 2025-04-15T20:13:38.000Z (about 1 year ago)
Default Branch: main
Last Pushed: 2025-11-20T18:46:13.000Z (7 months ago)
Last Synced: 2025-11-20T20:23:35.388Z (7 months ago)
Language: HCL
Size: 76.2 KB
Stars: 0
Watchers: 49
Forks: 0
Open Issues: 2
Metadata Files:
- Readme: README.md
Awesome Lists containing this project

README

          # Terraform AWS CodeBuild Runner Project

This Terraform module provisions an AWS CodeBuild Runner project with an attached webhook. Currently, AWS does not support creating Runner Projects via API or CLI. This module is a workaround. Terraform creates a default project and, by applying certain webhooks, it converts the project into a Runner project. This module is useful for teams that want to run GitHub Actions on AWS-managed on-demand compute.

---

## 🛠️ Prerequisites

- A GitHub App **"AWS Connector for GitHub"** successfully installed and configured in your AWS account. [More info on that](https://qnetconfluence.cms.gov/display/ISFCS/Configuring+Github+Runners+using+AWS+CodeBuild)

- CodeConnection itself can be provisioned via Terraform but requires manual authorization from AWS. The module will fail if the connection is not authorized.

## ✨ Features

- 🚀 Provisions a CodeBuild Runner project using GitHub as the source (via CodeConnections)

- 📦 Adds default filter groups to capture key events (indirectly creates a runner project without official support)

- ➕ Supports additional user-supplied filter groups

- 🧠 Automatically configures `scope_configuration` when applicable (i.e., webhook access at repo level vs org level)

- 🔁 Defaults to Lambda compute with 2 GB memory, Linux OS, and Node.js runtime

---

## 📦 Module Usage Examples

See the [examples](examples) dir for examples of usage:

1. [Access level - Repo | Compute - EC2 | Mode - Container](examples/repo-ec2)

1. [Access level - Org | Compute - Lambda (4 GB) | Mode - Container](examples/org-lambda)

1. [Repo-level access with additional webhook filter](examples/repo-webhook)

---

## 🧩 Default Filter Groups

This default filter group is the core logic that triggers creation of a runner project. Since AWS does not officially support provisioning CodeBuild runner projects via API, this webhook indirectly transforms a default CodeBuild project into a runner-enabled project.

```tf

[ # group 1

  {

    type    = "EVENT"

    pattern = "WORKFLOW_JOB_QUEUED"

  }

]

```

---

## 🔧 Input Variables

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.0.0 |

|  [aws](#requirement\_aws) | >= 5.0.0 |

## Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | 5.95.0 |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [aws_codebuild_project.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource |

| [aws_codebuild_source_credential.ssm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_source_credential) | resource |

| [aws_codebuild_webhook.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_webhook) | resource |

| [aws_secretsmanager_secret.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |

| [aws_secretsmanager_secret_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_policy) | resource |

| [aws_secretsmanager_secret_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |

| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |

| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_role.role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |

| [aws_ssm_parameter.github_personal_access_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [additional\_filter\_groups](#input\_additional\_filter\_groups) | Additional filter groups to be appended to the default | 
list(list(object({
    type                    = string
    pattern                 = string
    exclude_matched_pattern = optional(bool)
  }))) | `[]` | no |

|  [build\_timeout](#input\_build\_timeout) | Build timeout in minutes | `number` | `5` | no |

|  [cloudwatch\_logs\_group\_name](#input\_cloudwatch\_logs\_group\_name) | Name of the CloudWatch log group | `string` | `""` | no |

|  [cloudwatch\_logs\_stream\_name](#input\_cloudwatch\_logs\_stream\_name) | Name of the CloudWatch log stream | `string` | `""` | no |

|  [codeconnections\_arn](#input\_codeconnections\_arn) | preauthorized ARN of the CodeConnection | `string` | `null` | no |

|  [description](#input\_description) | Description of the CodeBuild project | `string` | `""` | no |

|  [docker\_server\_compute\_type](#input\_docker\_server\_compute\_type) | Compute type for the Docker server. Default: null. Valid values: BUILD\_GENERAL1\_SMALL, BUILD\_GENERAL1\_MEDIUM, BUILD\_GENERAL1\_LARGE, BUILD\_GENERAL1\_XLARGE, and BUILD\_GENERAL1\_2XLARGE. | `string` | `null` | no |

|  [docker\_server\_security\_group\_ids](#input\_docker\_server\_security\_group\_ids) | The list of Security Group IDs for the Docker server. | `list(string)` | `null` | no |

|  [environment\_compute\_type](#input\_environment\_compute\_type) | BUILD\_GENERAL1\_SMALL, BUILD\_GENERAL1\_MEDIUM, BUILD\_LAMBDA\_2GB, BUILD\_LAMBDA\_4GB, etc | `string` | `"BUILD_LAMBDA_2GB"` | no |

|  [environment\_image](#input\_environment\_image) | applicable image of ec2 or lambda | `string` | `"aws/codebuild/amazonlinux-x86_64-lambda-standard:nodejs20"` | no |

|  [environment\_image\_pull\_creds](#input\_environment\_image\_pull\_creds) | Type of credentials AWS CodeBuild uses to pull images in your build. Valid values: CODEBUILD, SERVICE\_ROLE. | `string` | `"CODEBUILD"` | no |

|  [environment\_type](#input\_environment\_type) | LINUX\_CONTAINER for EC2 and LINUX\_LAMBDA\_CONTAINER for Lambda | `string` | `"LINUX_LAMBDA_CONTAINER"` | no |

|  [github\_org\_name](#input\_github\_org\_name) | Name of your github org if webhook is of org level | `string` | n/a | yes |

|  [github\_personal\_access\_token\_ssm\_parameter](#input\_github\_personal\_access\_token\_ssm\_parameter) | The GitHub personal access token to use for accessing the repository. If not specified then GitHub auth must be configured separately. | `string` | `null` | no |

|  [name](#input\_name) | Name of the CodeBuild project | `string` | n/a | yes |

|  [pat\_override](#input\_pat\_override) | Is the PAT provided an override of the default account token. Default: true | `bool` | `true` | no |

|  [privileged\_mode](#input\_privileged\_mode) | Is privileged mode enabled for AWS CodeBuild. Required for Docker builds. Default: false | `bool` | `false` | no |

|  [service\_role\_name](#input\_service\_role\_name) | IAM role name for CodeBuild to assume | `string` | n/a | yes |

|  [source\_buildspec](#input\_source\_buildspec) | The build spec declaration to use for this build project's related builds. Enter a path from your repository's root dir. | `string` | `null` | no |

|  [source\_git\_submodules\_config\_fetch](#input\_source\_git\_submodules\_config\_fetch) | Whether to fetch Git submodules for the AWS CodeBuild build project. | `bool` | `false` | no |

|  [source\_location](#input\_source\_location) | The git remote address for the repository | `string` | `"CODEBUILD_DEFAULT_WEBHOOK_SOURCE_LOCATION"` | no |

|  [vpc\_id](#input\_vpc\_id) | The VPC ID for AWS CodeBuild to launch ephemeral instances in. | `string` | `null` | no |

|  [vpc\_security\_group\_ids](#input\_vpc\_security\_group\_ids) | The list of Security Group IDs for AWS CodeBuild to launch ephemeral EC2 instances in. | `list(string)` | `[]` | no |

|  [vpc\_subnet\_ids](#input\_vpc\_subnet\_ids) | The list of Subnet IDs for AWS CodeBuild to launch ephemeral EC2 instances in. | `list(string)` | `[]` | no |

## Outputs

| Name | Description |

|------|-------------|

|  [project\_arn](#output\_project\_arn) | n/a |

|  [project\_name](#output\_project\_name) | n/a |

## ℹ️  Notes:

> - A default filter group is always added to transform the project into a runner project.

> - `additional_filter_groups` are appended after the default filter group.

> - Each additional group must contain a filter with `type = "EVENT"`.

> - `exclude_matched_pattern` is optional and defaults to `false`.

> - `scope_configuration` is applied only when `source_location` is default or unset.

---

## ✅ Tested With

- Terraform v1.5+

- AWS Provider v5.x

- GitHub + CodeConnections integration

- Default and additional filter group handling
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/flexion/aws-codebuild-runner-project-tf-module

Awesome Lists containing this project

README
