I have a GitHub Actions workflow to deploy a service to an EC2 instance. I have currently opened the SSH access to all IPs but I want to restrict this to IPs used by GitHub Actions runners.
However, by default AWS limits the inbound rules to 60 IP address ranges or you can request an increase to a maximum of 1000 ranges.
The IP list for GitHub Actions is currently ~1900 ranges, so even increasing the limit to 1000 won't help.
How have others solved this problem? Create multiple security groups with 60 different IP ranges? Create fewer security groups with up to 1000 IP ranges? Dynamically create the inbound rule for the specific runner IP address and remove it after?