fix(terraform): complete SSM provider wiring

.github/workflows/ministack.yml

@@ -58,7 +58,7 @@ jobs:
           - termination-watcher
     services:
       ministack:
-        image: ghcr.io/ministackorg/ministack:1.5.13@sha256:ce3c906f2866ff953ce4c56f06b1fa3e453bc32e41c00de17b5f5a8672c5a42c
+        image: ghcr.io/ministackorg/ministack:1.5.16@sha256:528fbf57148665b5b0c679dc65eac8c33f7e7dded1b80bc151bd85c7420b6cd4
         ports:
           - 4566:4566
         env:

.github/workflows/smoke-tests.yml

@@ -29,7 +29,7 @@ jobs:
     timeout-minutes: 30
     services:
       ministack:
-        image: ghcr.io/ministackorg/ministack:1.5.13@sha256:ce3c906f2866ff953ce4c56f06b1fa3e453bc32e41c00de17b5f5a8672c5a42c
+        image: ghcr.io/ministackorg/ministack:1.5.16@sha256:528fbf57148665b5b0c679dc65eac8c33f7e7dded1b80bc151bd85c7420b6cd4
         ports:
           - 4566:4566
         options: --add-host=host.docker.internal:host-gateway

.github/workflows/terraform.yml

@@ -225,6 +225,14 @@ jobs:
           mkdir -p "$HOME/.terraform.d/plugin"
           echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin" >> "$GITHUB_ENV"
 
+      - name: "Fake zip files" # Validate will fail if it cannot find the zip files
+        run: |
+          touch lambdas/functions/webhook/webhook.zip
+          touch lambdas/functions/control-plane/runners.zip
+          touch lambdas/functions/gh-agent-syncer/runner-binaries-syncer.zip
+          touch lambdas/functions/ami-housekeeper/ami-housekeeper.zip
+          touch lambdas/functions/termination-watcher/termination-watcher.zip
+
       - name: Setup Terraform
         if: matrix.iac.command == 'terraform'
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
@@ -383,6 +391,14 @@ jobs:
           mkdir -p "$HOME/.terraform.d/plugin"
           echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin" >> "$GITHUB_ENV"
 
+      - name: "Fake zip files" # Validate will fail if it cannot find the zip files
+        run: |
+          touch lambdas/functions/webhook/webhook.zip
+          touch lambdas/functions/control-plane/runners.zip
+          touch lambdas/functions/gh-agent-syncer/runner-binaries-syncer.zip
+          touch lambdas/functions/ami-housekeeper/ami-housekeeper.zip
+          touch lambdas/functions/termination-watcher/termination-watcher.zip
+
       - name: Setup Terraform
         if: matrix.iac.command == 'terraform'
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1

docs/adr/0002-runner-orchestration-provider-boundary.md

@@ -221,7 +221,7 @@ configuration it helps produce.
 | `modules/orchestration-providers/webhook/scale-runners` | Owns scale-up and scale-down Lambdas, schedules, queue integration, IAM, and outputs. |
 | `modules/orchestration-providers/webhook/pool` | Owns optional scheduled pool resources and IAM. |
 | `modules/orchestration-providers/webhook/job-retry` | Owns optional queued-job retry resources and IAM. |
-| `modules/runner-config/ssm-housekeeper` | Owns provider-neutral cleanup of runner token and configuration parameters. |
+| `modules/runner-config/runner-config-housekeeper` | Owns provider-neutral cleanup of runner token and configuration parameters. |
 | `modules/compute-providers/<namespace>/<provider>` | Owns provider-specific capacity resources and returns policy, environment, managed-policy, and resource capabilities. |
 
 Provider leaf modules live below `modules/orchestration-providers/<provider>`,

examples/multi-runner-scale-set/README.md

@@ -69,7 +69,7 @@ The GitHub App must be installed for the configured GitHub account.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    id_ssm_parameter = optional(object({<br/>      arn = string<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
+| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    ssm_parameter = optional(object({<br/>      path = optional(string, null)<br/>      arn  = optional(string, null)<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS region to deploy to. | `string` | `"eu-west-1"` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix. | `string` | n/a | yes |
 | <a name="input_github"></a> [github](#input\_github) | Optional GitHub endpoint and scale-set ownership settings. | <pre>object({<br/>    url                = optional(string, null)<br/>    ssl_verify         = optional(bool, true)<br/>    runner_owner       = optional(string, null)<br/>    registration_level = optional(string, "organization")<br/>  })</pre> | `{}` | no |

examples/multi-runner-scale-set/variables.tf

@@ -61,12 +61,13 @@ variable "ami" {
   type = map(object({
     filter = optional(map(list(string)), { state = ["available"] })
     owners = optional(list(string), ["amazon"])
-    id_ssm_parameter = optional(object({
-      arn = string
+    ssm_parameter = optional(object({
+      path = optional(string, null)
+      arn  = optional(string, null)
     }), null)
     kms_key = optional(object({
       arn = string
     }), null)
   }))
   default = {}
-}
+}

examples/multi-runner-v2/README.md

@@ -63,7 +63,7 @@ variable source in real deployments rather than committed to configuration.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    id_ssm_parameter = optional(object({<br/>      arn = string<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
+| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    ssm_parameter = optional(object({<br/>      path = optional(string, null)<br/>      arn  = optional(string, null)<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS region to deploy to. | `string` | `"eu-west-1"` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix. | `string` | `null` | no |
 | <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub App ID and base64-encoded private key. | <pre>object({<br/>    id         = string<br/>    key_base64 = string<br/>  })</pre> | n/a | yes |

examples/multi-runner-v2/main.tf

@@ -156,9 +156,9 @@ module "runners" {
                 name  = ["Windows_Server-2022-English-Full-ECS_Optimized-*"]
                 state = ["available"]
               }
-              owners           = ["amazon"]
-              id_ssm_parameter = null
-              kms_key          = null
+              owners        = ["amazon"]
+              ssm_parameter = null
+              kms_key       = null
             })
           }
         }

examples/multi-runner-v2/variables.tf

@@ -28,8 +28,9 @@ variable "ami" {
   type = map(object({
     filter = optional(map(list(string)), { state = ["available"] })
     owners = optional(list(string), ["amazon"])
-    id_ssm_parameter = optional(object({
-      arn = string
+    ssm_parameter = optional(object({
+      path = optional(string, null)
+      arn  = optional(string, null)
     }), null)
     kms_key = optional(object({
       arn = string

modules/compute-providers/aws/ec2/logging.tf

@@ -54,17 +54,6 @@ locals {
 
 }
 
-
-resource "aws_ssm_parameter" "cloudwatch_agent_config_runner" {
-  count = var.config.cloudwatch_agent.enabled ? 1 : 0
-  name  = "${var.storage_provider.aws.ssm.paths.root}/${var.storage_provider.aws.ssm.paths.config}/cloudwatch_agent_config_runner"
-  type  = "String"
-  value = var.config.cloudwatch_agent.config != null ? var.config.cloudwatch_agent.config : templatefile("${path.module}/templates/cloudwatch_config.json", {
-    logfiles = jsonencode(local.logfiles)
-  })
-  tags = local.ssm_parameter_tags
-}
-
 resource "aws_cloudwatch_log_group" "gh_runners" {
   count             = length(local.loggroups_names)
   name              = local.loggroups_names[count.index]

modules/compute-providers/aws/ec2/policies.ami.tf

@@ -0,0 +1,124 @@
+locals {
+  # Handle AMI configuration
+  ami_config = var.config.ami != null ? var.config.ami : {
+    filter        = local.default_ami[var.runner.os]
+    owners        = ["amazon"]
+    ssm_parameter = null
+    kms_key       = null
+  }
+
+  default_ssm_parameter_path = "/github-action-runners/${var.prefix}/runners/config"
+  ami_ssm_parameter_path     = try(local.ami_config.ssm_parameter.path, null) != null ? local.ami_config.ssm_parameter.path : local.default_ssm_parameter_path
+  ami_kms_key_enabled        = local.ami_config.kms_key != null
+  ami_kms_key_arn            = local.ami_kms_key_enabled ? local.ami_config.kms_key.arn : null
+  ami_filter                 = merge(local.default_ami[var.runner.os], local.ami_config.filter)
+
+  # The path is plan-known and distinguishes an external parameter (ARN only)
+  # from a provider-managed parameter (explicit path or omitted configuration).
+  ami_id_ssm_external       = local.ami_config.ssm_parameter != null && try(local.ami_config.ssm_parameter.path, null) == null
+  ami_id_ssm_module_managed = !local.ami_id_ssm_external
+  ami_id_ssm_parameter_arn  = local.ami_id_ssm_external ? local.ami_config.ssm_parameter.arn : null
+  # Extract parameter name from ARN (format: arn:aws:ssm:region:account:parameter/path/to/param)
+  ami_id_ssm_parameter_name = local.ami_id_ssm_external ? try(regex("parameter(/.+)$", local.ami_id_ssm_parameter_arn)[0], null) : null
+
+  image_id = local.ami_id_ssm_module_managed ? "resolve:ssm:${aws_ssm_parameter.runner_ami_id[0].arn}" : local.ami_id_ssm_external ? "resolve:ssm:${local.ami_id_ssm_parameter_arn}" : data.aws_ami.runner[0].id
+}
+
+data "aws_ami" "runner" {
+  count = local.ami_id_ssm_external ? 0 : 1
+
+  most_recent = "true"
+
+  dynamic "filter" {
+    for_each = local.ami_filter
+    content {
+      name   = filter.key
+      values = filter.value
+    }
+  }
+
+  owners = local.ami_config.owners
+}
+
+resource "aws_ssm_parameter" "runner_ami_id" {
+  count     = local.ami_id_ssm_module_managed ? 1 : 0
+  name      = "${local.ami_ssm_parameter_path}/ami_id"
+  type      = "String"
+  data_type = "aws:ec2:image"
+  value     = data.aws_ami.runner[0].id
+
+  tags = merge(
+    local.provider_tags,
+    local.ssm_parameter_tags,
+    {
+      # Remove parentheses from AMI name to comply with AWS tag constraints
+      "ghr:ami_name" = replace(data.aws_ami.runner[0].name, "/[()]/", "")
+    },
+    {
+      "ghr:ami_creation_date" = data.aws_ami.runner[0].creation_date
+    },
+    {
+      "ghr:ami_deprecation_time" = data.aws_ami.runner[0].deprecation_time
+    }
+  )
+}
+
+data "aws_iam_policy_document" "ami_id_ssm_parameter_read" {
+  count = local.ami_id_ssm_external ? 1 : 0
+
+  statement {
+    effect    = "Allow"
+    sid       = "AllowSSMParameterRead"
+    actions   = ["ssm:GetParameter"]
+    resources = [local.ami_id_ssm_parameter_arn]
+  }
+}
+
+resource "aws_iam_policy" "ami_id_ssm_parameter_read" {
+  count       = local.ami_id_ssm_external ? 1 : 0
+  name        = "${var.prefix}-ami-id-ssm-parameter-read"
+  path        = local.role_path
+  description = "Allows for reading ${var.prefix} GitHub runner AMI ID from an SSM parameter"
+  tags        = local.provider_tags
+  policy      = data.aws_iam_policy_document.ami_id_ssm_parameter_read[0].json
+}
+
+data "aws_iam_policy_document" "ami_id_ssm" {
+  statement {
+    effect = "Allow"
+    sid    = "AllowSSMParameterRead"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters",
+    ]
+    resources = [local.ami_id_ssm_module_managed ? aws_ssm_parameter.runner_ami_id[0].arn : local.ami_id_ssm_parameter_arn]
+  }
+
+  dynamic "statement" {
+    for_each = local.ami_kms_key_enabled ? [local.ami_kms_key_arn] : []
+
+    content {
+      effect    = "Allow"
+      sid       = "AllowKMSKeyUsage"
+      actions   = ["kms:DescribeKey", "kms:ReEncrypt*", "kms:Decrypt"]
+      resources = [statement.value]
+    }
+  }
+
+  dynamic "statement" {
+    for_each = local.ami_kms_key_enabled ? [local.ami_kms_key_arn] : []
+
+    content {
+      effect    = "Allow"
+      sid       = "AllowKMSKeyGrant"
+      actions   = ["kms:CreateGrant"]
+      resources = [statement.value]
+
+      condition {
+        test     = "Bool"
+        variable = "aws:ViaAWSService"
+        values   = ["true"]
+      }
+    }
+  }
+}

modules/compute-providers/aws/ec2/policies.common.tf

@@ -0,0 +1,10 @@
+# IAM policy documents shared by the EC2 orchestration capabilities.
+data "aws_iam_policy_document" "service_linked_role" {
+  count = var.config.create_service_linked_role_spot ? 1 : 0
+
+  statement {
+    effect    = "Allow"
+    actions   = ["iam:CreateServiceLinkedRole"]
+    resources = ["arn:${var.aws_partition}:iam::*:role/aws-service-role/*"]
+  }
+}

modules/compute-providers/aws/ec2/policies.runner.aws.ssm.tf

@@ -0,0 +1,115 @@
+# extends logging.tf
+resource "aws_ssm_parameter" "cloudwatch_agent_config_runner" {
+  count = var.storage_provider.aws.ssm != null && var.config.cloudwatch_agent.enabled ? 1 : 0
+  name  = "${var.storage_provider.aws.ssm.paths.root}/${var.storage_provider.aws.ssm.paths.config}/cloudwatch_agent_config_runner"
+  type  = "String"
+  value = var.config.cloudwatch_agent.config != null ? var.config.cloudwatch_agent.config : templatefile("${path.module}/templates/cloudwatch_config.json", {
+    logfiles = jsonencode(local.logfiles)
+  })
+  tags = local.ssm_parameter_tags
+}
+
+# extends policies-runner.tf
+data "aws_iam_policy_document" "ssm_parameters" {
+  count = var.storage_provider.aws.ssm != null ? 1 : 0
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:DeleteParameter",
+      "ssm:GetParameters",
+      "ssm:GetParameter",
+    ]
+    resources = [
+      "${local.ssm_parameter_arn_prefix}${var.storage_provider.aws.ssm.paths.root}/${var.storage_provider.aws.ssm.paths.tokens}/*",
+    ]
+
+    condition {
+      test     = "StringLike"
+      variable = "ec2:SourceInstanceARN"
+      values   = ["*/&{aws:ResourceTag/InstanceId}"]
+    }
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters",
+      "ssm:GetParametersByPath",
+    ]
+    resources = [
+      local.ssm_config_arn,
+      "${local.ssm_config_arn}/*",
+    ]
+  }
+}
+
+data "aws_iam_policy_document" "ssm_cloudwatch" {
+  count = var.storage_provider.aws.ssm != null && var.config.cloudwatch_agent.enabled ? 1 : 0
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+    ]
+    resources = [
+      "${aws_ssm_parameter.cloudwatch_agent_config_runner[0].arn}/*",
+    ]
+  }
+}
+
+locals {
+  ssm_runner_inline_policies = var.storage_provider.aws.ssm != null ? {
+    ssm_parameters = {
+      name        = "runner-ssm-parameters"
+      policy_json = data.aws_iam_policy_document.ssm_parameters[0].json
+    }
+    } : {
+  }
+}
+
+# runner config
+locals {
+  ssm_root_path            = try(var.storage_provider.aws.ssm.paths.root, null)
+  ssm_config_path          = local.ssm_root_path == null ? null : "${local.ssm_root_path}/${var.storage_provider.aws.ssm.paths.config}"
+  ssm_parameter_arn_prefix = "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter"
+  ssm_config_arn           = local.ssm_config_path == null ? null : "${local.ssm_parameter_arn_prefix}${local.ssm_config_path}"
+
+  ssm_parameter_tags = merge(
+    local.provider_tags,
+    try(var.storage_provider.aws.ssm.tags, {}),
+    try(var.storage_provider.aws.ssm.parameters.tags, {}),
+  )
+
+  ssm_runner_tags = var.storage_provider.aws.ssm != null ? {
+    "ghr:ssm_config_path" = local.ssm_config_path
+  } : {}
+
+}
+
+resource "aws_ssm_parameter" "runner_config_run_as" {
+  count = var.storage_provider.aws.ssm != null ? 1 : 0
+  name  = "${var.storage_provider.aws.ssm.paths.root}/${var.storage_provider.aws.ssm.paths.config}/run_as"
+  type  = "String"
+  value = var.runner.run_as_root ? "root" : var.runner.run_as
+  tags  = local.ssm_parameter_tags
+}
+
+resource "aws_ssm_parameter" "runner_enable_cloudwatch" {
+  count = var.storage_provider.aws.ssm != null ? 1 : 0
+  name  = "${var.storage_provider.aws.ssm.paths.root}/${var.storage_provider.aws.ssm.paths.config}/enable_cloudwatch"
+  type  = "String"
+  value = var.config.cloudwatch_agent.enabled
+  tags  = local.ssm_parameter_tags
+}
+
+moved {
+  from = aws_ssm_parameter.runner_config_run_as
+  to   = aws_ssm_parameter.runner_config_run_as[0]
+}
+
+moved {
+  from = aws_ssm_parameter.runner_enable_cloudwatch
+  to   = aws_ssm_parameter.runner_enable_cloudwatch[0]
+}