AWS codebuild documentation change
Summary
Added AWS CLI instructions for GitHub Actions webhook filtering and new environment variables for organization/enterprise runner registration
Security assessment
Added documentation for CODEBUILD_CONFIG_GITHUB_ACTIONS_ORG_REGISTRATION_NAME and similar variables which enable granular control over runner registration groups. This improves access control configuration but does not address a specific disclosed vulnerability.
Diff
diff --git a/codebuild/latest/userguide/action-runner.md b/codebuild/latest/userguide/action-runner.md index a8ea6808a..cfbca7794 100644 --- a//codebuild/latest/userguide/action-runner.md +++ b//codebuild/latest/userguide/action-runner.md @@ -5 +5 @@ -Step 1: Create a CodeBuild project with a webhookStep 2: Update your GitHub Actions workflow YAMLStep 3: Review your resultsGitHub Actions runner configuration optionsFilter GitHub Actions webhook events (AWS CloudFormation)Filter GitHub Actions webhook events (AWS CDK)Filter GitHub Actions webhook events (Terraform) +Step 1: Create a CodeBuild project with a webhookStep 2: Update your GitHub Actions workflow YAMLStep 3: Review your resultsGitHub Actions runner configuration optionsFilter GitHub Actions webhook events (AWS CloudFormation)Filter GitHub Actions webhook events (AWS CDK)Filter GitHub Actions webhook events (Terraform)Filter GitHub Actions webhook events (AWS CLI) @@ -98,2 +98,2 @@ The following is an example of a GitHub Actions workflow YAML: - - image:<environment-type>-<image-identifier> - - instance-size:<instance-size> + image:<environment-type>-<image-identifier> + instance-size:<instance-size> @@ -109,2 +109,2 @@ The following is an example of a GitHub Actions workflow YAML: - - image:arm-3.0 - - instance-size:small + image:arm-3.0 + instance-size:small @@ -118 +118 @@ The following is an example of a GitHub Actions workflow YAML: - - fleet:<fleet-name> + fleet:<fleet-name> @@ -124,2 +124,2 @@ To override both the fleet and the image used for the build, use the following s - - fleet:<fleet-name> - - image:<environment-type>-<image-identifier> + fleet:<fleet-name> + image:<environment-type>-<image-identifier> @@ -135,2 +135,2 @@ The following is an example of a GitHub Actions workflow YAML: - - fleet:myFleet - - image:arm-3.0 + fleet:myFleet + image:arm-3.0 @@ -158 +158 @@ By default, CodeBuild ignores any buildspec commands when running a self-hosted - - buildspec-override:true + buildspec-override:true @@ -210 +210,49 @@ Enterprise runners are not available to organization repositories by default. Fo -CodeBuild will register self-hosted runners to the integer runner group ID stored as the value of this environment variable. By default, this value is 1. For more information about self-hosted runner groups, see [ Managing access to self-hosted runners using groups](https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28#create-configuration-for-a-just-in-time-runner-for-an-organization). +CodeBuild will register self-hosted runners to the integer runner group ID stored as the value of this environment variable. By default, this value is 1\. For more information about self-hosted runner groups, see [ Managing access to self-hosted runners using groups](https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28#create-configuration-for-a-just-in-time-runner-for-an-organization). + +`CODEBUILD_CONFIG_GITHUB_ACTIONS_ORG_REGISTRATION_NAME` + + +To configure organization level runner registration using your GitHub Actions workflow YAML file, you can use the following syntax: + + + name: Hello World + on: [push] + jobs: + Hello-World-Job: + runs-on: + - codebuild-myProject-${{ github.run_id }}-${{ github.run_attempt }} + organization-registration-name:myOrganization + steps: + - run: echo "Hello World!" + +`CODEBUILD_CONFIG_GITHUB_ACTIONS_ENTERPRISE_REGISTRATION_NAME` + + +To configure enterprise level runner registration using your GitHub Actions workflow YAML file, you can use the following syntax: + + + name: Hello World + on: [push] + jobs: + Hello-World-Job: + runs-on: + - codebuild-myProject-${{ github.run_id }}-${{ github.run_attempt }} + enterprise-registration-name:myEnterprise + steps: + - run: echo "Hello World!" + +`CODEBUILD_CONFIG_GITHUB_ACTIONS_RUNNER_GROUP_ID` + + +To configure registering runners to a specific runner group ID using your GitHub Actions workflow YAML file, you can use the following syntax: + + + name: Hello World + on: [push] + jobs: + Hello-World-Job: + runs-on: + - codebuild-myProject-${{ github.run_id }}-${{ github.run_attempt }} + registration-group-id:3 + steps: + - run: echo "Hello World!" @@ -272,0 +321,17 @@ The following Terraform template creates a filter group that triggers a build wh +## Filter GitHub Actions webhook events (AWS CLI) + +The following AWS CLI commands create a self-hosted GitHub Actions runner project with a GitHub Actions workflow job request filter group that triggers a build when it evaluates to true. + + + aws codebuild create-project \ + --name <project name> \ + --source "{\"type\":\"GITHUB\",\"location\":\"<repository location>\",\"buildspec\":\"\"}" \ + --artifacts {"\"type\":\"NO_ARTIFACTS\""} \ + --environment "{\"type\": \"LINUX_CONTAINER\",\"image\": \"aws/codebuild/amazonlinux-x86_64-standard:5.0\",\"computeType\": \"BUILD_GENERAL1_MEDIUM\"}" \ + --service-role "<service role ARN>" + + + aws codebuild create-webhook \ + --project-name <project name> \ + --filter-groups "[[{\"type\":\"EVENT\",\"pattern\":\"WORKFLOW_JOB_QUEUED\"}]]" +