feat(terraform): add SSM storage provider boundary - #5454
Open
edersonbrilhante wants to merge 8 commits into
Open
edersonbrilhante wants to merge 8 commits into
edersonbrilhante wants to merge 8 commits into
Conversation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
edersonbrilhante
force-pushed
the
feat/ssm-storage-provider-terraform
branch
2 times, most recently
from
September 18, 2026 22:33
b48c0d3 to
d254931
Compare
edersonbrilhante
marked this pull request as draft
September 18, 2026 22:42
edersonbrilhante
force-pushed
the
feat/ssm-storage-provider-terraform
branch
9 times, most recently
from
September 18, 2026 23:57
b6a170c to
dbc3aaa
Compare
edersonbrilhante
force-pushed
the
feat/ssm-storage-provider-terraform
branch
from
September 19, 2026 00:16
83950de to
93f5536
Compare
edersonbrilhante
marked this pull request as ready for review
September 21, 2026 19:35
edersonbrilhante
enabled auto-merge (squash)
September 21, 2026 20:32
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Nine unresolved findings remain, including two critical issues.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
Adds an AWS SSM storage-provider boundary across runner, webhook, orchestration, and EC2 modules.
Changes:
- Relocates the SSM module under
modules/storage-providers/aws/ssm. - Nests global and lane configuration under storage-provider objects.
- Updates configuration propagation, IAM wiring, tests, documentation, and examples.
| File | Review summary |
|---|---|
README.md |
Updates root documentation. Critical (1 vote): workflow still validates removed modules/ssm; update the workflow list and documentation include. |
modules/webhook/webhook.tf |
Passes nested storage-provider configuration. No final comment. |
modules/webhook/variables.tf |
Defines webhook storage-provider input. No final comment. |
modules/webhook/README.md |
Updates webhook documentation. No final comment. |
modules/webhook/eventbridge/webhook.tf |
Uses nested KMS configuration. No final comment. |
modules/webhook/eventbridge/variables.tf |
Updates EventBridge configuration schema. No final comment. |
modules/webhook/eventbridge/README.md |
Updates EventBridge documentation. No final comment. |
modules/webhook/eventbridge/dispatcher.tf |
Updates dispatcher KMS wiring. No final comment. |
modules/webhook/direct/webhook.tf |
Moderate (1 vote): Lambda KMS policy is not gated on the selected aws_ssm provider; apply the same condition to EventBridge policies. |
modules/webhook/direct/variables.tf |
Updates direct webhook configuration schema. No final comment. |
modules/webhook/direct/README.md |
Updates direct webhook documentation. No final comment. |
modules/storage-providers/aws/ssm/versions.tf |
Adds SSM module requirements. No final comment. |
modules/storage-providers/aws/ssm/variables.tf |
Defines SSM inputs. No final comment. |
modules/storage-providers/aws/ssm/ssm.tf |
Creates SSM parameters and manifests. No final comment. |
modules/storage-providers/aws/ssm/README.md |
Documents the relocated module. No final comment. |
modules/storage-providers/aws/ssm/outputs.tf |
Exposes SSM parameter metadata. No final comment. |
modules/storage-providers/aws/ssm/local.tf |
Resolves the default KMS key. No final comment. |
modules/runners/README.md |
Updates runner documentation. No final comment. |
modules/runner-config/variables.tf |
Replaces the legacy SSM input. No final comment. |
modules/runner-config/validations.tf |
Uses nested SSM paths. No final comment. |
modules/runner-config/tests/tags.tftest.hcl |
Updates nested test inputs. No final comment. |
modules/runner-config/tests/pool.tftest.hcl |
Updates nested test inputs. No final comment. |
modules/runner-config/tests/fixtures/computed-iam-inputs/computed-iam-inputs.tf |
Updates fixture configuration. No final comment. |
modules/runner-config/ssm-housekeeper.tf |
Uses nested housekeeper settings. No final comment. |
modules/runner-config/runner-ssm-parameters.tf |
Moderate (1 vote): SSM parameters remain unconditional; gate parameter, housekeeper, and IAM resources on aws_ssm. |
modules/runner-config/README.md |
Updates runner-config documentation. No final comment. |
modules/runner-config/orchestration-provider.tf |
Passes resolved SSM settings downstream. No final comment. |
modules/runner-config/compute-provider.aws.ec2.tf |
Passes storage-provider configuration to EC2. No final comment. |
modules/runner-config/common-config.tf |
Resolves nested tags, paths, and KMS settings. No final comment. |
modules/orchestration-providers/webhook/variables.tf |
Adds storage-provider capabilities. No final comment. |
modules/orchestration-providers/webhook/tests/webhook.tftest.hcl |
Updates nested test inputs. No final comment. |
modules/orchestration-providers/webhook/scale-runners/variables.tf |
Adds scale-runner storage-provider inputs. No final comment. |
modules/orchestration-providers/webhook/scale-runners/tests/scale-runners.tftest.hcl |
Updates scale-runner tests. No final comment. |
modules/orchestration-providers/webhook/scale-runners/scale-up.tf |
Passes storage-provider environment variables. No final comment. |
modules/orchestration-providers/webhook/scale-runners/scale-up-iam-policies.tf |
Moderate (1 vote): KMS permissions are not gated on aws_ssm; apply the guard to the other SSM KMS policies. |
modules/orchestration-providers/webhook/scale-runners/scale-down.tf |
Updates environment wiring. No final comment. |
modules/orchestration-providers/webhook/scale-runners/scale-down-iam-policies.tf |
Updates KMS policy wiring. No final comment. |
modules/orchestration-providers/webhook/scale-runners/README.md |
Updates scale-runner documentation. No final comment. |
modules/orchestration-providers/webhook/scale-runners.tf |
Passes storage-provider configuration. No final comment. |
modules/orchestration-providers/webhook/README.md |
Updates webhook provider documentation. No final comment. |
modules/orchestration-providers/webhook/pool/variables.tf |
Adds pool storage-provider inputs. No final comment. |
modules/orchestration-providers/webhook/pool/tests/provider.tftest.hcl |
Updates pool tests. No final comment. |
modules/orchestration-providers/webhook/pool/README.md |
Updates pool documentation. No final comment. |
modules/orchestration-providers/webhook/pool/pool.tf |
Uses nested SSM environment and policies. No final comment. |
modules/orchestration-providers/webhook/pool/iam-policies.tf |
Updates SSM and KMS policy wiring. No final comment. |
modules/orchestration-providers/webhook/pool.tf |
Passes pool storage-provider settings. No final comment. |
modules/orchestration-providers/webhook/main.tf |
Includes storage-provider configuration in resolved data. No final comment. |
modules/orchestration-providers/webhook/job-retry/variables.tf |
Adds job-retry storage-provider inputs. No final comment. |
modules/orchestration-providers/webhook/job-retry/tests/job-retry.tftest.hcl |
Updates job-retry tests. No final comment. |
modules/orchestration-providers/webhook/job-retry/README.md |
Updates job-retry documentation. No final comment. |
modules/orchestration-providers/webhook/job-retry/job-retry.tf |
Uses storage-provider environment variables. No final comment. |
modules/orchestration-providers/webhook/job-retry/iam-policies.tf |
Updates KMS and policy composition. No final comment. |
modules/orchestration-providers/webhook/job-retry.tf |
Passes job-retry storage-provider settings. No final comment. |
modules/multi-runner/webhook.tf |
Passes nested SSM settings to webhook. No final comment. |
modules/multi-runner/variables.tf |
Nests lane storage configuration. No final comment. |
modules/multi-runner/variables.experimental.storage-provider.tf |
Moderate (1 vote): schema lacks a plan-known aws_ssm discriminator and selection validation. |
modules/multi-runner/variables.experimental.ssm.tf |
Removes the legacy global SSM input. No final comment. |
modules/multi-runner/tests/config-translation.tftest.hcl |
Updates translation tests. No final comment. |
modules/multi-runner/tests/config-resolution.tftest.hcl |
Updates resolution tests. No final comment. |
modules/multi-runner/tests/config-effective.tftest.hcl |
Updates effective-configuration tests. No final comment. |
modules/multi-runner/storage-provider.aws.ssm.tf |
Moderate (3 votes): SSM module is unconditional and lacks plan-known provider dispatch; gate SSM resources and KMS statements on aws_ssm. |
modules/multi-runner/runners.tf |
Propagates nested SSM settings to legacy runners. No final comment. |
modules/multi-runner/runners.experimental.tf |
Propagates storage-provider settings to runner-config. No final comment. |
modules/multi-runner/main.tf |
Resolves nested SSM root paths. No final comment. |
modules/multi-runner/config.experimental.translation.tf |
Translates legacy SSM configuration. No final comment. |
modules/multi-runner/config.experimental.resolved.tf |
Resolves nested lane storage settings. No final comment. |
modules/multi-runner/config.experimental.effective.tf |
Resolves effective SSM KMS settings. No final comment. |
modules/compute-providers/aws/ec2/variables.tf |
Replaces the EC2 SSM input. No final comment. |
modules/compute-providers/aws/ec2/tests/provider.tftest.hcl |
Critical (3 votes): indexes singleton runner_config_run_as with [0], causing an invalid-index test failure. |
modules/compute-providers/aws/ec2/runner-instances.tf |
Uses nested SSM tags and paths. No final comment. |
modules/compute-providers/aws/ec2/runner-config.tf |
Moderate (1 vote): EC2 SSM parameter remains unconditional; gate it on the selected storage-provider type. |
modules/compute-providers/aws/ec2/README.md |
Updates EC2 documentation. No final comment. |
modules/compute-providers/aws/ec2/policies-runner.tf |
Updates SSM policy paths. No final comment. |
modules/compute-providers/aws/ec2/logging.tf |
Uses nested SSM paths. No final comment. |
main.tf |
Uses the relocated SSM module and nested webhook input. No final comment. |
examples/migration-test/v2/main.tf |
Updates the migration example configuration. No final comment. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | <a name="module_runner_binaries"></a> [runner\_binaries](#module\_runner\_binaries) | ./modules/runner-binaries-syncer | n/a | | ||
| | <a name="module_runners"></a> [runners](#module\_runners) | ./modules/runners | n/a | | ||
| | <a name="module_ssm"></a> [ssm](#module\_ssm) | ./modules/ssm | n/a | | ||
| | <a name="module_ssm"></a> [ssm](#module\_ssm) | ./modules/storage-providers/aws/ssm | n/a | |
Comment on lines
+378
to
+382
| aws_ssm_parameter.runner_config_run_as[0].tags["Name"] == "ssm-name" | ||
| && aws_ssm_parameter.runner_config_run_as[0].tags["Scope"] == "ssm" | ||
| && aws_ssm_parameter.runner_config_run_as[0].tags["SsmOnly"] == "ssm" | ||
| && !contains(keys(aws_ssm_parameter.runner_config_run_as[0].tags), "RunnerOnly") | ||
| && !contains(keys(aws_ssm_parameter.runner_config_run_as[0].tags), "ghr:environment") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add the Terraform storage-provider boundary for the existing AWS SSM implementation.
global_storage_provider.aws.ssm.storage_provider.aws.ssm.runner-config.aws_ssmprovider type.Test Plan
terraform fmt -check -recursiveon all affected Terraform modules.git diff --check.terraform validatewas also attempted, but the local AWS/null/random provider binaries failed the plugin schema handshake before configuration validation.Related Issues
None.