Skip to content

README.md

Latest commit

 

History

History
40 lines (29 loc) · 1.39 KB

README.md

File metadata and controls

40 lines (29 loc) · 1.39 KB

IAM Permissions Example

This example demonstrates how to grant AWS IAM permissions to runners, allowing them to access AWS services.

What This Example Shows

  • How to grant S3 read/write permissions to runners
  • How providers pass IAM permissions to the runners they create

Important Security Consideration

Any job/workflow that runs on these runners will have these permissions. When you grant IAM permissions to a provider, those permissions are available to all workflows and jobs that execute on runners created by that provider. This means:

  • All repositories using these runners will have access to the granted resources
  • All workflows, regardless of who created them, will have these permissions
  • Only grant the minimum permissions necessary for your use case
  • Consider using separate providers with different permission sets for different use cases

Usage

After deploying, your GitHub Actions workflows can use the runners to access the S3 bucket:

name: Upload to S3
on: [push]
jobs:
  upload:
    runs-on: [self-hosted, codebuild]
    steps:
      - uses: actions/checkout@v5
      - name: Upload artifact
        run: |
          aws s3 cp myfile.txt s3://your-bucket-name/

Setup

  1. Deploy the stack: cdk deploy
  2. Follow the setup instructions in the main README.md to configure GitHub integration
  3. Use the codebuild label in your workflows