Module: sourcefuse/arc-github-runner/aws

Registry: https://registry.terraform.io/modules/sourcefuse/arc-github-runner/aws

Category: DevOps / CI/CD

Source: https://github.com/sourcefuse/terraform-aws-arc-github-runner

Deploys a self-hosted GitHub Actions runner on an EC2 instance with auto-registration, SSM access, and configurable labels.

• EC2-based self-hosted GitHub Actions runner
• Automatic runner registration with GitHub token
• Configurable runner labels for job targeting
• SSM Session Manager access (no SSH required)
• IAM instance profile with configurable policies
• VPC and security group configuration

This module utilizes different local-exec provisioners to execute scripts for obtaining the needed GitHub Runner token and remove the runner from the organization when the resources are destroyed. See Pre-Requisites for information on the needed permissions these scripts will require.

You will need to have a GitHub Personal Access Token (PAT) with admin:org permissions in order to manage GitHub runners for the Organization. If you do not have sufficient permissions to GitHub, the runner will not register.

Once you've obtained a PAT, you will need to set it so Terraform can access it. The recommended approach to this is to save it in Systems Manager Parameter Store with the Parameter name of: /<namespace>/<environment>/github/token You can reference this parameter via a data lookup:

data "aws_ssm_parameter" "github_token" {
  name = "/${var.namespace}/${var.environment}/github/token"
}

⚠️ At this time, this module only supports Debian / Ubuntu AMIs. When choosing an AMI, please be sure to select either Ubuntu or Debian.

To see a full example, check out the main.tf file in the example folder.

module "runner" {
  source  = "sourcefuse/arc-github-runner/aws"
  version = "0.2.6"
  namespace     = var.namespace
  environment   = var.environment
  region        = var.region
  subnet_id     = local.private_subnet_ids[0]
  vpc_id        = data.aws_vpc.this.id
  instance_type = "t2.micro"
  github_token  = data.aws_ssm_parameter.github_token.value
  runner_labels = "example,${var.namespace},${var.environment}"

  tags = module.tags.tags
}

The complete inputs/outputs reference is auto-generated below.

object({
    id       = string
    owner_id = string
  })

{
  "id": "ami-04505e74c0741db8d",
  "owner_id": "099720109477"
}

[
  "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
  "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
]

list(object({
    type        = string
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))

[
  {
    "cidr_blocks": [
      "0.0.0.0/0"
    ],
    "from_port": 0,
    "protocol": "-1",
    "to_port": 65535,
    "type": "egress"
  }
]

• terraform
• aws cli
• terraform-docs
• pre-commit
• golang
• golint

• Configure pre-commit hooks

  pre-commit install

while Contributing or doing git commit please specify the breaking change in your commit message whether its major,minor or patch

For Example

git commit -m "your commit message #major"

By specifying this , it will bump the version and if you dont specify this in your commit message then by default it will consider patch and will bump that accordingly

• Tests are available in test directory
• Configure the dependencies

  cd test/
  go mod init github.com/sourcefuse/terraform-aws-refarch-github-runner
  go get github.com/gruntwork-io/terratest/modules/terraform

• Now execute the test

  go test -timeout  30m

The ARC IaC MCP Server is a hosted Model Context Protocol service that lets AI assistants browse, search, scaffold, compare, and security-scan any of the SourceFuse ARC Terraform modules — directly from natural language.

What you can do with it:

• Discover — search and filter modules by keyword or AWS resource type.
• Understand — get inputs, outputs, and resources for any module without leaving your editor.
• Scaffold — generate production-ready, multi-file Terraform with cross-module wiring already done.
• Secure — scan generated or existing HCL for misconfigurations before it hits a PR.
• Compare — diff modules side-by-side to make informed architectural decisions.

The MCP endpoint is https://arc-iac-mcp.sourcef.us/mcp. Pick your client:

Claude Code CLI:

claude mcp add arc-iac --transport http https://arc-iac-mcp.sourcef.us/mcp

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "arc-iac": {
      "url": "https://arc-iac-mcp.sourcef.us/mcp"
    }
  }
}

Cursor / Windsurf / Kiro — add the same block to .cursor/mcp.json (or the equivalent for your client).

• "List all ARC modules sorted by downloads"
• "What inputs does arc-ecs require?"
• "Scaffold a production-ready arc-db Aurora setup with Secrets Manager"
• "Compare arc-eks and arc-ecs for running 10 microservices"
• "Scan this Terraform before I raise a PR: <paste HCL>"

See the ARC IaC MCP repo for the full tool reference, troubleshooting tips, and local-development instructions.

See CONTRIBUTING.md for commit conventions and development setup.

This project is authored by:

• SourceFuse ARC Team