fix(microvm): tighten runner role permissions

Author: edersonbrilhante

lambdas/libs/compute-providers/aws/microvm/README.md

@@ -13,7 +13,7 @@ The MicroVM image `/run` hook receives this `runHookPayload`:
 }
 ```
 
-Lambda adds `microvmId` beside that payload. The image must poll the SecureString parameter at `<runnerConfigSsmPath>/<microvmId>`, start the GitHub runner with its encoded JIT configuration, delete the parameter after reading it, and terminate the MicroVM after the job completes.
+Lambda adds `microvmId` beside that payload. The image must poll the SecureString parameter at `<runnerConfigSsmPath>/<microvmId>`, start the GitHub runner with its encoded JIT configuration, delete the parameter after reading it, and exit its lifecycle entrypoint after the job completes. Trusted control-plane cleanup and the fixed lifetime remain the MicroVM termination backstops.
 
 Runner ownership and lifecycle state are stored separately as non-secret `String`
 parameters under `<MICROVM_METADATA_SSM_PATH>/<microvmId>`. The immutable base
@@ -52,12 +52,13 @@ resource-level permissions, enforce the connector boundary with the explicit
 dynamic-label allowlist described below.
 
 All MicroVMs using one execution role and JIT prefix share a trust boundary.
-Grant that role only `ssm:GetParameter` and `ssm:DeleteParameter` on the JIT
-prefix; do not grant parameter-listing APIs or access to the metadata prefix.
-The `MicrovmId` tag on each JIT parameter supports operations but is not a
-documented binding to the calling MicroVM's session identity. Only allow trusted
-images and workloads within a shared role, or isolate trust domains with
-separate roles, prefixes, and provider deployments.
+Grant that role only `ssm:GetParameter`, `ssm:ListTagsForResource`, and
+`ssm:DeleteParameter` on the JIT prefix; do not grant parameter-listing APIs or
+access to the metadata prefix. The `MicrovmId` tag on each JIT parameter
+supports operations but is not a documented binding to the calling MicroVM's
+session identity. Only allow trusted images and workloads within a shared role,
+or isolate trust domains with separate roles, prefixes, and provider
+deployments.
 
 ## Dynamic labels
 

modules/compute-providers/aws/microvm/README.md

@@ -6,7 +6,7 @@ Select it with the `compute_provider.aws.microvm` leaf. The Terraform dispatch k
 
 MicroVM runners use the provider's fixed 28,800-second (8-hour) lifetime; this is not a Terraform input.
 
-The resolved provider-neutral `runner.iam.role` is passed to Lambda as the MicroVM execution role. The provider creates `/github-self-hosted-runners/<prefix>/microvm` with the common observability lifecycle and derives a control-plane-only metadata prefix at `<ssm.paths.root>/<ssm.paths.config>/microvm-metadata`. Scale-up, scale-down, and pool use that non-secret prefix for MicroVM ownership and lifecycle state; the runner role retains access only to its one-time JIT path plus runtime logging and self-termination. When the runner role is supplied externally, its Lambda trust, JIT parameter access, stream-write, and self-termination permissions remain caller-owned.
+The resolved provider-neutral `runner.iam.role` is passed to Lambda as the MicroVM execution role. The provider creates `/github-self-hosted-runners/<prefix>/microvm` with the common observability lifecycle and derives a control-plane-only metadata prefix at `<ssm.paths.root>/<ssm.paths.config>/microvm-metadata`. Scale-up, scale-down, and pool use that non-secret prefix for MicroVM ownership and lifecycle state; the runner role retains value, tag-read, and deletion access only on the lane-scoped one-time JIT path, plus runtime logging. When the runner role is supplied externally, its Lambda trust, JIT parameter access, and stream-write permissions remain caller-owned.
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
@@ -37,7 +37,6 @@ No modules.
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.runner_runtime_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.runner_ssm_jit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [aws_iam_policy_document.runner_terminate_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.scale_down](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.scale_up](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 
@@ -51,7 +50,7 @@ No modules.
 | <a name="input_github"></a> [github](#input\_github) | GitHub Enterprise Server settings available to compute-provider bootstrap data.<br/><br/>- `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.<br/>- `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server. | <pre>object({<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_observability"></a> [observability](#input\_observability) | Provider-neutral observability settings applied to the provider-managed MicroVM runtime log group.<br/><br/>- `logs.retention_in_days`: CloudWatch Logs retention period.<br/>- `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt the log group.<br/>- `logs.class`: CloudWatch log-group class.<br/>- `logs.tags`: Tags merged after module-level tags on the log group. | <pre>object({<br/>    logs = optional(object({<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix used to identify resources created for the runner configuration. | `string` | `"github-actions"` | no |
-| <a name="input_runner"></a> [runner](#input\_runner) | Resolved runner settings consumed by the Lambda MicroVM compute provider.<br/><br/>- `os`: Runner operating system. Lambda MicroVM requires `linux`.<br/>- `architecture`: Runner distribution architecture. Lambda MicroVM requires `arm64`.<br/>- `name_prefix`: Prefix added to registered runner names.<br/>- `run_as_root`: Runs the runner service as root.<br/>- `run_as`: Operating-system user used when `run_as_root` is false.<br/>- `hooks.job_started`: Script installed as the runner job-started hook.<br/>- `hooks.job_completed`: Script installed as the runner job-completed hook.<br/>- `iam.role.arn`: Resolved runner-role ARN used as the MicroVM execution role and referenced by provider policies.<br/>- `iam.role.name`: Resolved runner-role name used by provider resources.<br/>- `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter` and `ssm:DeleteParameter` on the lane token path, `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group, and `lambda:TerminateMicrovm` on the approved image ARN or image allowlist for self-termination.<br/>- `iam.managed_policy_arns`: Common managed-policy ARNs returned with the provider-specific runner policies for attachment by runner-config.<br/>- `iam.path`: IAM path available to provider-managed IAM resources. Null derives the path from `prefix`. | <pre>object({<br/>    os           = optional(string, "linux")<br/>    architecture = optional(string, "arm64")<br/>    name_prefix  = optional(string, "")<br/>    run_as_root  = optional(bool, false)<br/>    run_as       = optional(string, "ec2-user")<br/>    hooks = optional(object({<br/>      job_started   = optional(string, "")<br/>      job_completed = optional(string, "")<br/>    }), {})<br/>    iam = object({<br/>      role = object({<br/>        arn     = string<br/>        name    = string<br/>        managed = optional(bool, true)<br/>      })<br/>      managed_policy_arns = optional(map(string), {})<br/>      path                = optional(string, null)<br/>    })<br/>  })</pre> | n/a | yes |
+| <a name="input_runner"></a> [runner](#input\_runner) | Resolved runner settings consumed by the Lambda MicroVM compute provider.<br/><br/>- `os`: Runner operating system. Lambda MicroVM requires `linux`.<br/>- `architecture`: Runner distribution architecture. Lambda MicroVM requires `arm64`.<br/>- `name_prefix`: Prefix added to registered runner names.<br/>- `run_as_root`: Runs the runner service as root.<br/>- `run_as`: Operating-system user used when `run_as_root` is false.<br/>- `hooks.job_started`: Script installed as the runner job-started hook.<br/>- `hooks.job_completed`: Script installed as the runner job-completed hook.<br/>- `iam.role.arn`: Resolved runner-role ARN used as the MicroVM execution role and referenced by provider policies.<br/>- `iam.role.name`: Resolved runner-role name used by provider resources.<br/>- `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter`, `ssm:ListTagsForResource`, and `ssm:DeleteParameter` on the lane token path plus `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group.<br/>- `iam.managed_policy_arns`: Common managed-policy ARNs returned with the provider-specific runner policies for attachment by runner-config.<br/>- `iam.path`: IAM path available to provider-managed IAM resources. Null derives the path from `prefix`. | <pre>object({<br/>    os           = optional(string, "linux")<br/>    architecture = optional(string, "arm64")<br/>    name_prefix  = optional(string, "")<br/>    run_as_root  = optional(bool, false)<br/>    run_as       = optional(string, "ec2-user")<br/>    hooks = optional(object({<br/>      job_started   = optional(string, "")<br/>      job_completed = optional(string, "")<br/>    }), {})<br/>    iam = object({<br/>      role = object({<br/>        arn     = string<br/>        name    = string<br/>        managed = optional(bool, true)<br/>      })<br/>      managed_policy_arns = optional(map(string), {})<br/>      path                = optional(string, null)<br/>    })<br/>  })</pre> | n/a | yes |
 | <a name="input_ssm"></a> [ssm](#input\_ssm) | Parameter Store paths and tag scopes available to compute-provider bootstrap resources.<br/><br/>- `paths.root`: Root Parameter Store path for the runner configuration.<br/>- `paths.tokens`: Path segment used for registration tokens and just-in-time configuration.<br/>- `paths.config`: Path segment used for persistent runner and provider configuration. MicroVM control-plane metadata is stored under its `microvm-metadata` child prefix.<br/>- `tags`: Shared SSM tags that override module-level `tags`.<br/>- `parameters.tags`: Parameter-specific tags that override module-level and shared SSM tags. | <pre>object({<br/>    paths = object({<br/>      root   = string<br/>      tokens = string<br/>      config = string<br/>    })<br/>    tags = optional(map(string), {})<br/>    parameters = optional(object({<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Base tags available to taggable compute-provider resources. Provider-specific tags override this map within their documented scopes. | `map(string)` | `{}` | no |
 

modules/compute-providers/aws/microvm/runner-policies.tf

@@ -5,10 +5,6 @@ locals {
   runner_token_path_arn    = "${local.ssm_parameter_arn_prefix}${var.ssm.paths.root}/${var.ssm.paths.tokens}/*"
 
   runner_inline_policies = {
-    terminate_self = {
-      name        = "runner-microvm-terminate-self"
-      policy_json = data.aws_iam_policy_document.runner_terminate_self.json
-    }
     ssm_jit = {
       name        = "runner-microvm-ssm-jit"
       policy_json = data.aws_iam_policy_document.runner_ssm_jit.json
@@ -20,21 +16,13 @@ locals {
   }
 }
 
-data "aws_iam_policy_document" "runner_terminate_self" {
-  statement {
-    sid       = "SelfTerminate"
-    effect    = "Allow"
-    actions   = ["lambda:TerminateMicrovm"]
-    resources = local.microvm_image_resource_arns
-  }
-}
-
 data "aws_iam_policy_document" "runner_ssm_jit" {
   statement {
     effect = "Allow"
     actions = [
       "ssm:DeleteParameter",
       "ssm:GetParameter",
+      "ssm:ListTagsForResource",
     ]
     resources = [local.runner_token_path_arn]
   }

modules/compute-providers/aws/microvm/tests/provider.tftest.hcl

@@ -181,8 +181,7 @@ run "exposes_microvm_control_plane_contract" {
   assert {
     condition = (
       toset(keys(output.provider.policies)) == toset(["runner", "scale_up", "scale_down", "pool"])
-      && toset(keys(output.provider.policies.runner.inline_policies)) == toset(["runtime_logs", "ssm_jit", "terminate_self"])
-      && output.provider.policies.runner.inline_policies.terminate_self.name == "runner-microvm-terminate-self"
+      && toset(keys(output.provider.policies.runner.inline_policies)) == toset(["runtime_logs", "ssm_jit"])
       && output.provider.policies.runner.inline_policies.ssm_jit.name == "runner-microvm-ssm-jit"
       && output.provider.policies.runner.inline_policies.runtime_logs.name == "runner-microvm-runtime-logs"
       && output.provider.policies.runner.managed_policy_arns["readonly"] == "arn:aws:iam::aws:policy/ReadOnlyAccess"
@@ -194,17 +193,13 @@ run "exposes_microvm_control_plane_contract" {
 
   assert {
     condition = (
-      data.aws_iam_policy_document.runner_terminate_self.statement[0].sid == "SelfTerminate"
-      && data.aws_iam_policy_document.runner_terminate_self.statement[0].effect == "Allow"
-      && data.aws_iam_policy_document.runner_terminate_self.statement[0].actions == toset(["lambda:TerminateMicrovm"])
-      && data.aws_iam_policy_document.runner_terminate_self.statement[0].resources == toset(["arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner"])
-      && data.aws_iam_policy_document.runner_ssm_jit.statement[0].actions == toset(["ssm:DeleteParameter", "ssm:GetParameter"])
+      data.aws_iam_policy_document.runner_ssm_jit.statement[0].actions == toset(["ssm:DeleteParameter", "ssm:GetParameter", "ssm:ListTagsForResource"])
       && data.aws_iam_policy_document.runner_ssm_jit.statement[0].resources == toset(["arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/tokens/*"])
       && length(data.aws_iam_policy_document.runner_runtime_logs.statement) == 1
       && data.aws_iam_policy_document.runner_runtime_logs.statement[0].actions == toset(["logs:CreateLogStream", "logs:PutLogEvents"])
       && data.aws_iam_policy_document.runner_runtime_logs.statement[0].resources == toset(["arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/microvm:*"])
     )
-    error_message = "Managed MicroVM runners must receive self-termination, lane-token JIT access, and stream-write permissions on the provider-managed runtime log group."
+    error_message = "Managed MicroVM runners must receive lane-token value, tag, and deletion access plus stream-write permissions on the provider-managed runtime log group."
   }
 
   assert {
@@ -308,10 +303,7 @@ run "accepts_external_runner_role_and_policy_overrides" {
 
   assert {
     condition = (
-      toset(keys(output.provider.policies.runner.inline_policies)) == toset(["runtime_logs", "ssm_jit", "terminate_self"])
-      && data.aws_iam_policy_document.runner_terminate_self.statement[0].resources == toset([
-        "arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-*",
-      ])
+      toset(keys(output.provider.policies.runner.inline_policies)) == toset(["runtime_logs", "ssm_jit"])
       && length(data.aws_iam_policy_document.runner_runtime_logs.statement) == 1
       && data.aws_iam_policy_document.runner_runtime_logs.statement[0].resources == toset(["arn:aws:logs:eu-west-1:123456789012:log-group:/github-self-hosted-runners/microvm-test/microvm:*"])
     )

modules/compute-providers/aws/microvm/variables.tf

@@ -82,7 +82,7 @@ variable "runner" {
     - `hooks.job_completed`: Script installed as the runner job-completed hook.
     - `iam.role.arn`: Resolved runner-role ARN used as the MicroVM execution role and referenced by provider policies.
     - `iam.role.name`: Resolved runner-role name used by provider resources.
-    - `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter` and `ssm:DeleteParameter` on the lane token path, `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group, and `lambda:TerminateMicrovm` on the approved image ARN or image allowlist for self-termination.
+    - `iam.role.managed`: Whether runner-config manages the resolved runner role. Callers own an external role and must grant it `ssm:GetParameter`, `ssm:ListTagsForResource`, and `ssm:DeleteParameter` on the lane token path plus `logs:CreateLogStream` and `logs:PutLogEvents` on the provider-managed runtime log group.
     - `iam.managed_policy_arns`: Common managed-policy ARNs returned with the provider-specific runner policies for attachment by runner-config.
     - `iam.path`: IAM path available to provider-managed IAM resources. Null derives the path from `prefix`.
   EOT

modules/runner-config/tests/pool.tftest.hcl

@@ -711,12 +711,11 @@ run "routes_lambda_microvm_provider" {
       && length(module.compute_aws_microvm) == 1
       && length(module.compute_aws_microvm_trust_policy) == 1
       && aws_iam_role.runner[0].assume_role_policy == module.compute_aws_microvm_trust_policy[0].assume_role_policy
-      && toset(keys(aws_iam_role_policy.runner_provider)) == toset(["runtime_logs", "ssm_jit", "terminate_self"])
+      && toset(keys(aws_iam_role_policy.runner_provider)) == toset(["runtime_logs", "ssm_jit"])
       && aws_iam_role_policy.runner_provider["runtime_logs"].name == "runner-microvm-runtime-logs"
       && aws_iam_role_policy.runner_provider["ssm_jit"].name == "runner-microvm-ssm-jit"
-      && aws_iam_role_policy.runner_provider["terminate_self"].name == "runner-microvm-terminate-self"
     )
-    error_message = "The aws.microvm leaf must dispatch only to the namespaced provider modules and attach all three required policies to its managed runner role."
+    error_message = "The aws.microvm leaf must dispatch only to the namespaced provider modules and attach both required policies to its managed runner role."
   }
 
   assert {