2

I have a GitHub Actions workflow to deploy a service to an EC2 instance. I have currently opened the SSH access to all IPs but I want to restrict this to IPs used by GitHub Actions runners.

However, by default AWS limits the inbound rules to 60 IP address ranges or you can request an increase to a maximum of 1000 ranges.

The IP list for GitHub Actions is currently ~1900 ranges, so even increasing the limit to 1000 won't help.

How have others solved this problem? Create multiple security groups with 60 different IP ranges? Create fewer security groups with up to 1000 IP ranges? Dynamically create the inbound rule for the specific runner IP address and remove it after?

Improve this question

1 Answer 1

Reset to default
1

If the running is aware of it's IP, you could run github action step which takes that as an input var to aws cli or Terraform to update the security group applied to the instance you're targetting, then delete the rule when the run is done.

Improve this answer
1
  • I ended up doing my third option which is about the same as you've suggested. I wasn't sure if this was considered good practice or not.
    – RichardM
    Sep 16, 2021 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.