Docker Executor - S3 Cache using EC2 IAM Role

[naveenbr90]

Hi ,

I am trying to enable cache directory using S3 bucket with iam role (EC2 Iam role ) in my runner container and my container is deployed in EC2 instance ..! I have given iam role permission to access the s3 bucket and also bucket policy to allow the iam role.

My runner is up and taking jobs and executing successfully but not capturing the cache in S3 bucket

Can Runner container know the Ec2 instance iam role when we give AuthenticationType as IAM or we should pass any variable to container with IAM ARN ?

Thanks in advance !

[kayman-mk]

Sorry for my late reply.

The cache is usually enabled this way:

module "cache" {
  source  = "cattle-ops/gitlab-runner/aws//modules/cache"
  version = "7.2.0"

  cache_expiration_days  = 7
  cache_lifecycle_prefix = "" # module default is wrong

  environment = var.environment
  tags        = local.tags
}

module "gitlab_runner_uncritical" {
  source  = "cattle-ops/gitlab-runner/aws"
  version = "7.2.0"

  runner_worker_cache = {
    shared = true
    create = false
    policy = "${module.cache.policy_arn}"
    bucket = "${module.cache.bucket}"
  }
}

So no need to configure policies manually.

[lenasappvia]

Hi @kayman-mk :) I have tried this solution, but I constantly get 403 and no cache is uploaded to the bucket due to access denied.. I am using managed kms option for runners, which I'm passing to the cache module. Do I need to also add additional configuration on runner s3 cache config side (https://github.com/cattle-ops/terraform-aws-gitlab-runner/blob/main/template/runner-config.tftpl), i.e:

    ServerSideEncryption = "KMS"
    ServerSideEncryptionKeyID = "alias/my-key"

or is there something else that I'm doing wrong?

Thank you in advance for your help!

[kayman-mk]

I quickly checked the policies I attached to the workers. They have

• arn:aws:iam::aws:policy/ReadOnlyAccess

•       {
          "Effect" : "Allow",
          "Action" : "kms:decrypt",
          "Resource" : "*"
        },
        {
          "Effect" : "Allow",
          "Action" : ["s3:PutObject", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject"],
          "Resource" : "*"
        }
        ```
  
  

But I am not 100% sure how the caching actually works. I remember something that the Runner needs the rights to access the cache and not the Workers. But this is handled by the module.

I also use a kms_key_id = var.encryption_key_arn. I checked the permissions of my key but didn't found anything special.

You could try to download the cache to the Runner using the AWS CLI and check what happens. Maybe the error message is better.