sprinters/setup/aws/sprinters-setup.yml at main · sprinters-sh/sprinters · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
AWSTemplateFormatVersion: 2010-09-09
Description: Sprinters Setup

Parameters:
  GitHubAccountName:
    Description: "Your GitHub account name (ex.: my-github-org)"
    Type: String
    MinLength: 1
    MaxLength: 39
    AllowedPattern: "^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?!-)){0,38}$"

Resources:
  SprintersRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: sprinters-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: 381491863103
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                "sts:ExternalId": { "Ref" : "GitHubAccountName" }
      Policies:
        - PolicyName: sprinters-policy
          # Sprinters strictly adheres to the principle of least-privilege and
          # only requests this absolute minimum set of permissions to be able to operate:
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: Regular
                Effect: Allow
                Action:
                  - ec2:RunInstances             # Launch ephemeral EC2 instances for your runners
                  - ec2:DescribeInstances        # List runner EC2 instances and check whether they are running
                  - ec2:DescribeSpotPriceHistory # Automatically select cheapest availability zone for spot instances and calculate savings
                  - iam:PassRole                 # Enable runner EC2 instances to use IAM instance profiles
                Resource:
                  - "*"
              - Sid: RestrictCreateTagsToRunInstances
                Effect: Allow
                Action:
                  - ec2:CreateTags               # Let EC2 tag instances and their volumes on launch as runners
                Resource:
                  - "*"
                Condition:
                  StringEquals:
                    "ec2:CreateAction": "RunInstances"
              - Sid: RestrictToSprintersResources
                Effect: Allow
                Action:
                  - ec2:CreateTags               # Tag runners with the job they currently process
                  - ec2:ModifyVolume             # Optimize boot speed of runner EC2 instances
                  - ec2:TerminateInstances       # Clean up runner EC2 instances in case they fail to gracefully shut down
                Resource:
                  - "*"
                Condition:
                  StringEquals:
                    "aws:ResourceTag/sprinters:sprinters": "true"

Outputs:
  AccountId:
    Description: AWS Account ID
    Value: !Ref AWS::AccountId