fix(microvm): reuse runner configuration path

Author: edersonbrilhante

lambdas/libs/compute-providers/aws/microvm/README.md

@@ -7,27 +7,28 @@ The MicroVM image `/run` hook receives this `runHookPayload`:
 ```json
 {
   "version": 1,
-  "runnerConfigSsmArn": "arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/example/runners/config",
+  "runnerConfigSsmPath": "/github-action-runners/example/runners/config",
   "runnerTokenSsmPath": "/github-action-runners/example/runners/tokens"
 }
 ```
 
-Lambda adds `microvmId` beside that payload. The image must poll the SecureString parameter at `<runnerTokenSsmPath>/<microvmId>`, start the GitHub runner with its encoded JIT configuration, delete the parameter after reading it, and exit its lifecycle entrypoint after the job completes. `runnerConfigSsmArn` is the configuration ARN prefix; the image reads its own non-secret metadata at `<runnerConfigSsmArn>/microvm-metadata/<microvmId>`. Neither identifier contains the JIT configuration value. Trusted control-plane cleanup and the fixed lifetime remain termination backstops.
+Lambda adds `microvmId` beside that payload. The image must poll the SecureString parameter at `<runnerTokenSsmPath>/<microvmId>`, start the GitHub runner with its encoded JIT configuration, delete the parameter after reading it, and exit its lifecycle entrypoint after the job completes. The image reads its own non-secret metadata at `<runnerConfigSsmPath>/microvm-metadata/<microvmId>`. Neither path contains the JIT configuration value. Trusted control-plane cleanup and the fixed lifetime remain termination backstops.
 
 Runner ownership and lifecycle state are stored separately as non-secret `String`
 parameters under `<MICROVM_METADATA_SSM_PATH>/<microvmId>`. The immutable base
 record and independent state parameters prevent concurrent GitHub ID, orphan,
 and cleanup updates from overwriting one another. Deleting the JIT SecureString
 does not delete this metadata. Use a dedicated metadata prefix that does not
-overlap the JIT path, and do not grant the MicroVM execution role access to it.
-The control plane retries pending cleanup, removes metadata after termination,
-and reconciles expired records during inventory.
+overlap the JIT path, and grant the MicroVM execution role only the exact
+value-read access described below, without path-listing permissions. The control
+plane retries pending cleanup, removes metadata after termination, and reconciles
+expired records during inventory.
 
 The immutable base metadata parameter is also the canonical tag surface for a
-runner. It merges `SSM_PARAMETER_STORE_TAGS` with the Terraform-generated
-`MICROVM_METADATA_TAGS`. Terraform supplies `Name`, `ghr:environment`,
-`ghr:ssm_config_path`, and `ghr:runner_name_prefix`; the Lambda then adds
-authoritative runtime tags:
+runner. It starts with `SSM_PARAMETER_STORE_TAGS`, omits `Name`, and derives
+`ghr:environment`, `ghr:ssm_config_path`, and `ghr:runner_name_prefix` from
+the existing `ENVIRONMENT`, `SSM_CONFIG_PATH`, and `RUNNER_NAME_PREFIX`
+settings. The Lambda then adds authoritative runtime tags:
 `ghr:Application`, `ghr:created_by`, `ghr:environment`, `ghr:Owner`,
 `ghr:Type`, `ghr:microvm_id`, `ghr:microvm_image_arn`, and, when available,
 `ghr:microvm_image_version`. After JIT registration, the control plane adds
@@ -44,8 +45,6 @@ The control-plane Lambda requires these provider environment variables:
 - `MICROVM_INGRESS_NETWORK_CONNECTORS` (optional JSON array or comma-separated list)
 - `MICROVM_EGRESS_NETWORK_CONNECTORS` (optional JSON array or comma-separated list)
 - `MICROVM_METADATA_SSM_PATH` (dedicated SSM path for control-plane metadata)
-- `MICROVM_METADATA_TAGS` (optional JSON array of base tags for the canonical metadata parameter)
-- `MICROVM_RUNNER_CONFIG_SSM_ARN` (runner configuration SSM ARN prefix passed to the image hook)
 - `MICROVM_LOG_GROUP` (optional)
 
 Each runner is launched with a fixed lifetime of 28,800 seconds (8 hours).
@@ -64,8 +63,8 @@ that action does not currently support resource-level permissions, enforce the
 connector boundary with the explicit dynamic-label allowlist described below.
 
 All MicroVMs using one execution role, JIT prefix, and metadata prefix share a
-trust boundary. Grant that role only `ssm:GetParameter` on
-`<runnerConfigSsmArn>/microvm-metadata/*`, `ssm:GetParameter` and
+trust boundary. Grant that role only `ssm:GetParameter` on the Parameter Store
+ARN corresponding to `<runnerConfigSsmPath>/microvm-metadata/*`, `ssm:GetParameter` and
 `ssm:DeleteParameter` on the lane-scoped JIT prefix, and the runtime log
 permissions described above. The image must address its own metadata with its
 AWS-provided `microvmId` and must not receive path-listing access. IAM cannot

lambdas/libs/compute-providers/aws/microvm/src/control-plane/config.test.ts

@@ -9,9 +9,6 @@ beforeEach(() => {
   process.env.MICROVM_IMAGE_ARN = 'arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner';
   process.env.MICROVM_EXECUTION_ROLE_ARN = 'arn:aws:iam::123456789012:role/microvm-runner';
   process.env.MICROVM_METADATA_SSM_PATH = '/github-action-runners/unit-test/microvm-metadata/';
-  process.env.MICROVM_RUNNER_CONFIG_SSM_ARN =
-    'arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/unit-test/config';
-  delete process.env.MICROVM_METADATA_TAGS;
   delete process.env.MICROVM_IMAGE_VERSION;
   delete process.env.MICROVM_INGRESS_NETWORK_CONNECTORS;
   delete process.env.MICROVM_EGRESS_NETWORK_CONNECTORS;
@@ -27,8 +24,6 @@ describe('loadMicrovmProviderConfig', () => {
       ingressNetworkConnectors: undefined,
       egressNetworkConnectors: undefined,
       metadataSsmPath: '/github-action-runners/unit-test/microvm-metadata',
-      metadataTags: [],
-      runnerConfigSsmArn: process.env.MICROVM_RUNNER_CONFIG_SSM_ARN,
       logging: undefined,
     });
   });
@@ -38,19 +33,11 @@ describe('loadMicrovmProviderConfig', () => {
     process.env.MICROVM_INGRESS_NETWORK_CONNECTORS = '["arn:ingress:one","arn:ingress:two"]';
     process.env.MICROVM_EGRESS_NETWORK_CONNECTORS = 'arn:egress:one, arn:egress:two';
     process.env.MICROVM_LOG_GROUP = ' /aws/lambda-microvms/runner ';
-    process.env.MICROVM_METADATA_TAGS = JSON.stringify([
-      { Key: 'Name', Value: 'unit-test-runner' },
-      { Key: 'ghr:environment', Value: 'unit-test' },
-    ]);
 
     expect(loadMicrovmProviderConfig()).toMatchObject({
       imageVersion: '3.0',
       ingressNetworkConnectors: ['arn:ingress:one', 'arn:ingress:two'],
       egressNetworkConnectors: ['arn:egress:one', 'arn:egress:two'],
-      metadataTags: [
-        { Key: 'Name', Value: 'unit-test-runner' },
-        { Key: 'ghr:environment', Value: 'unit-test' },
-      ],
       logging: { cloudWatch: { logGroup: '/aws/lambda-microvms/runner' } },
     });
   });
@@ -59,7 +46,6 @@ describe('loadMicrovmProviderConfig', () => {
     ['MICROVM_IMAGE_ARN', 'MICROVM_IMAGE_ARN'],
     ['MICROVM_EXECUTION_ROLE_ARN', 'MICROVM_EXECUTION_ROLE_ARN'],
     ['MICROVM_METADATA_SSM_PATH', 'MICROVM_METADATA_SSM_PATH'],
-    ['MICROVM_RUNNER_CONFIG_SSM_ARN', 'MICROVM_RUNNER_CONFIG_SSM_ARN'],
   ])('requires %s', (environmentVariable, expectedName) => {
     delete process.env[environmentVariable];
 
@@ -84,32 +70,4 @@ describe('loadMicrovmProviderConfig', () => {
       );
     },
   );
-
-  it.each([
-    '/github-action-runners/unit-test/config',
-    'arn:aws:ssm:eu-west-1:123456789012:parameter',
-    'arn:aws:s3:eu-west-1:123456789012:parameter/github-action-runners/unit-test/config',
-    'arn:custom:ssm:eu-west-1:123456789012:parameter/github-action-runners/unit-test/config',
-    'arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners//config',
-    'arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/../config',
-  ])('rejects malformed runner configuration SSM ARN %s', (runnerConfigSsmArn) => {
-    process.env.MICROVM_RUNNER_CONFIG_SSM_ARN = runnerConfigSsmArn;
-
-    expect(() => loadMicrovmProviderConfig()).toThrow(
-      'MICROVM_RUNNER_CONFIG_SSM_ARN must be a valid SSM parameter ARN prefix',
-    );
-  });
-
-  it.each([
-    '[not-json',
-    '{}',
-    '[{"Key":"Name"}]',
-    '[{"Key":"","Value":"runner"}]',
-    '[{"Key":"Name","Value":1}]',
-    '[{"Key":"Name","Value":"one"},{"Key":"Name","Value":"two"}]',
-  ])('rejects malformed metadata tags %s', (tags) => {
-    process.env.MICROVM_METADATA_TAGS = tags;
-
-    expect(() => loadMicrovmProviderConfig()).toThrow(/MICROVM_METADATA_TAGS must/);
-  });
 });

lambdas/libs/compute-providers/aws/microvm/src/control-plane/config.ts

@@ -1,10 +1,5 @@
 import type { Logging, RunMicrovmCommandInput } from '@aws-sdk/client-lambda-microvms';
 
-export interface MicrovmMetadataTag {
-  Key: string;
-  Value: string;
-}
-
 export interface MicrovmProviderConfig {
   egressNetworkConnectors?: string[];
   executionRoleArn: string;
@@ -13,8 +8,6 @@ export interface MicrovmProviderConfig {
   ingressNetworkConnectors?: string[];
   logging?: Logging;
   metadataSsmPath: string;
-  metadataTags: MicrovmMetadataTag[];
-  runnerConfigSsmArn: string;
 }
 
 function requiredEnvironmentValue(name: string, value: string | undefined): string {
@@ -38,18 +31,6 @@ function parseMetadataSsmPath(value: string | undefined): string {
   return path;
 }
 
-function parseRunnerConfigSsmArn(value: string | undefined): string {
-  const arn = requiredEnvironmentValue('MICROVM_RUNNER_CONFIG_SSM_ARN', value);
-  if (
-    !/^arn:aws(?:-[a-z0-9-]+)?:ssm:[A-Za-z0-9-]+:\d{12}:parameter\/[A-Za-z0-9_.\-/]+$/.test(arn) ||
-    arn.includes('//') ||
-    arn.split('/').includes('..')
-  ) {
-    throw new Error('MICROVM_RUNNER_CONFIG_SSM_ARN must be a valid SSM parameter ARN prefix');
-  }
-  return arn;
-}
-
 function parseNetworkConnectors(name: string, value: string | undefined): string[] | undefined {
   const configuredValue = optionalEnvironmentValue(value);
   if (!configuredValue) return undefined;
@@ -74,41 +55,6 @@ function parseNetworkConnectors(name: string, value: string | undefined): string
   return connectors.map((connector) => connector.trim());
 }
 
-function parseMetadataTags(value: string | undefined): MicrovmMetadataTag[] {
-  const configuredValue = optionalEnvironmentValue(value);
-  if (!configuredValue) return [];
-
-  let tags: unknown;
-  try {
-    tags = JSON.parse(configuredValue);
-  } catch (error) {
-    throw new Error('MICROVM_METADATA_TAGS must be a JSON array of SSM tag objects', { cause: error });
-  }
-
-  if (
-    !Array.isArray(tags) ||
-    tags.some(
-      (tag) =>
-        typeof tag !== 'object' ||
-        tag === null ||
-        !('Key' in tag) ||
-        typeof tag.Key !== 'string' ||
-        tag.Key.length === 0 ||
-        !('Value' in tag) ||
-        typeof tag.Value !== 'string',
-    )
-  ) {
-    throw new Error('MICROVM_METADATA_TAGS must be a JSON array of SSM tag objects');
-  }
-
-  const typedTags = tags as MicrovmMetadataTag[];
-  if (new Set(typedTags.map((tag) => tag.Key)).size !== typedTags.length) {
-    throw new Error('MICROVM_METADATA_TAGS must not contain duplicate tag keys');
-  }
-
-  return typedTags;
-}
-
 export function loadMicrovmProviderConfig(): MicrovmProviderConfig {
   const logGroup = optionalEnvironmentValue(process.env.MICROVM_LOG_GROUP);
 
@@ -125,8 +71,6 @@ export function loadMicrovmProviderConfig(): MicrovmProviderConfig {
       process.env.MICROVM_EGRESS_NETWORK_CONNECTORS,
     ),
     metadataSsmPath: parseMetadataSsmPath(process.env.MICROVM_METADATA_SSM_PATH),
-    metadataTags: parseMetadataTags(process.env.MICROVM_METADATA_TAGS),
-    runnerConfigSsmArn: parseRunnerConfigSsmArn(process.env.MICROVM_RUNNER_CONFIG_SSM_ARN),
     logging: logGroup ? ({ cloudWatch: { logGroup } } satisfies RunMicrovmCommandInput['logging']) : undefined,
   };
 }

lambdas/libs/compute-providers/aws/microvm/src/control-plane/microvms.test.ts

@@ -41,8 +41,6 @@ const config: MicrovmProviderConfig = {
   executionRoleArn: 'arn:aws:iam::123456789012:role/microvm-runner',
   egressNetworkConnectors: ['arn:egress'],
   metadataSsmPath,
-  metadataTags: [{ Key: 'Name', Value: 'unit-test-runner' }],
-  runnerConfigSsmArn: 'arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/unit-test/config',
   logging: { cloudWatch: { logGroup: '/aws/lambda-microvms/runner' } },
 };
 const ssmParameterStoreTags = [{ Key: 'CostCenter', Value: '1234' }];
@@ -111,23 +109,19 @@ describe('runMicrovmRunner', () => {
       source: 'scale-up-lambda',
       imageArn,
       imageVersion: '3.1',
-      metadataTags: [{ Key: 'Name', Value: 'unit-test-runner' }],
       ssmParameterStoreTags,
     });
   });
 
   it('rejects invalid metadata tags before launching a MicroVM', async () => {
     await expect(
       runMicrovmRunner({
-        config: {
-          ...config,
-          metadataTags: [{ Key: 'aws:microvm:image-arn', Value: imageArn }],
-        },
+        config,
         environment: 'unit-test',
         runHookPayload: '{}',
         runnerOwner: 'Codertocat',
         runnerType: 'Org',
-        ssmParameterStoreTags: [],
+        ssmParameterStoreTags: [{ Key: 'aws:microvm:image-arn', Value: imageArn }],
         source: 'scale-up-lambda',
       }),
     ).rejects.toThrow('AWS-reserved tag prefix');

lambdas/libs/compute-providers/aws/microvm/src/control-plane/microvms.ts

@@ -88,7 +88,6 @@ export async function runMicrovmRunner(input: RunMicrovmRunnerInput): Promise<st
     source: input.source,
     imageArn: input.config.imageIdentifier,
     imageVersion: input.config.imageVersion ?? 'version-validation',
-    metadataTags: input.config.metadataTags,
     ssmParameterStoreTags: input.ssmParameterStoreTags,
   });
 
@@ -127,7 +126,6 @@ export async function runMicrovmRunner(input: RunMicrovmRunnerInput): Promise<st
       source: input.source,
       imageArn,
       imageVersion,
-      metadataTags: input.config.metadataTags,
       ssmParameterStoreTags: input.ssmParameterStoreTags,
     });
   } catch (error) {

lambdas/libs/compute-providers/aws/microvm/src/control-plane/runner-config.test.ts

@@ -20,10 +20,22 @@ vi.mock('./runner-metadata', async (importOriginal) => ({
 
 const imageArn = 'arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner';
 const metadataSsmPath = '/github-action-runners/unit-test/microvm-metadata';
-const runnerConfigSsmArn = 'arn:aws:ssm:eu-west-1:123456789012:parameter/github-action-runners/unit-test/config';
+const runnerConfigSsmPath = '/github-action-runners/unit-test/config';
 const githubClient = {} as Octokit;
 const createStartRunnerConfig = vi.fn<CreateStartRunnerConfig>();
-const ssmParameterStoreTags = [{ Key: 'CostCenter', Value: '1234' }];
+const ssmParameterStoreTags = [
+  { Key: 'CostCenter', Value: '1234' },
+  { Key: 'Name', Value: 'not-used-for-microvm-metadata' },
+  { Key: 'ghr:environment', Value: 'caller-cannot-override' },
+  { Key: 'ghr:runner_name_prefix', Value: 'caller-cannot-override' },
+  { Key: 'ghr:ssm_config_path', Value: 'caller-cannot-override' },
+];
+const microvmMetadataTags = [
+  { Key: 'CostCenter', Value: '1234' },
+  { Key: 'ghr:environment', Value: 'unit-test' },
+  { Key: 'ghr:runner_name_prefix', Value: 'unit-test-' },
+  { Key: 'ghr:ssm_config_path', Value: runnerConfigSsmPath },
+];
 
 function runnerConfig(overrides: Partial<CreateGitHubRunnerConfig> = {}): CreateGitHubRunnerConfig {
   return {
@@ -49,8 +61,6 @@ beforeEach(() => {
     imageIdentifier: imageArn,
     executionRoleArn: 'arn:aws:iam::123456789012:role/microvm-runner',
     metadataSsmPath,
-    metadataTags: [{ Key: 'Name', Value: 'unit-test-runner' }],
-    runnerConfigSsmArn,
   });
   vi.mocked(runMicrovmRunner).mockResolvedValue('mvm-1');
   vi.mocked(setMicrovmGithubRunnerMetadata).mockResolvedValue();
@@ -60,17 +70,17 @@ beforeEach(() => {
 });
 
 describe('createMicrovmRunHookPayload', () => {
-  it('contains the versioned runner token path and configuration ARN', () => {
+  it('contains the versioned runner token and configuration paths', () => {
     expect(
       JSON.parse(
         createMicrovmRunHookPayload({
-          runnerConfigSsmArn,
+          runnerConfigSsmPath,
           runnerTokenSsmPath: '/runner/token',
         }),
       ),
     ).toEqual({
       version: 1,
-      runnerConfigSsmArn,
+      runnerConfigSsmPath,
       runnerTokenSsmPath: '/runner/token',
     });
   });
@@ -102,13 +112,25 @@ describe('createMicrovmRunners', () => {
     expect(runMicrovmRunner).not.toHaveBeenCalled();
   });
 
+  it('requires an SSM config path', async () => {
+    await expect(
+      createMicrovmRunners(
+        runnerConfig({ ssmConfigPath: '' }),
+        1,
+        githubClient,
+        createStartRunnerConfig,
+        'scale-up-lambda',
+      ),
+    ).resolves.toEqual({ instances: [], retryableErrorCount: 0, nonRetryableErrorCount: 1 });
+
+    expect(runMicrovmRunner).not.toHaveBeenCalled();
+  });
+
   it('rejects a metadata path that overlaps the JIT token path', async () => {
     vi.mocked(loadMicrovmProviderConfig).mockReturnValue({
       imageIdentifier: imageArn,
       executionRoleArn: 'arn:aws:iam::123456789012:role/microvm-runner',
       metadataSsmPath: '/github-action-runners/unit-test/token/metadata',
-      metadataTags: [],
-      runnerConfigSsmArn,
     });
 
     await expect(
@@ -145,12 +167,12 @@ describe('createMicrovmRunners', () => {
       config: expect.objectContaining({ imageIdentifier: imageArn }),
       environment: 'unit-test',
       runHookPayload: createMicrovmRunHookPayload({
-        runnerConfigSsmArn,
+        runnerConfigSsmPath,
         runnerTokenSsmPath: '/github-action-runners/unit-test/token',
       }),
       runnerOwner: 'Codertocat',
       runnerType: 'Org',
-      ssmParameterStoreTags,
+      ssmParameterStoreTags: microvmMetadataTags,
       source: 'pool-lambda',
     });
     expect(createStartRunnerConfig).toHaveBeenCalledTimes(2);
@@ -184,17 +206,15 @@ describe('createMicrovmRunners', () => {
         imageVersion: '3.0',
         executionRoleArn: 'arn:aws:iam::123456789012:role/microvm-runner',
         metadataSsmPath,
-        metadataTags: [{ Key: 'Name', Value: 'unit-test-runner' }],
-        runnerConfigSsmArn,
       },
       environment: 'unit-test',
       runHookPayload: createMicrovmRunHookPayload({
-        runnerConfigSsmArn,
+        runnerConfigSsmPath,
         runnerTokenSsmPath: '/github-action-runners/unit-test/token',
       }),
       runnerOwner: 'Codertocat',
       runnerType: 'Org',
-      ssmParameterStoreTags,
+      ssmParameterStoreTags: microvmMetadataTags,
       source: 'scale-up-lambda',
     });
     expect(setMicrovmGithubRunnerMetadata).toHaveBeenCalledWith(metadataSsmPath, 'mvm-1', {