runners-scale-up fails with 'AuthFailure.ServiceLinkedRoleCreationNotPermitted' about terraform-aws-github-runner HOT 5 CLOSED

I am quite sure it is an IAM issue. In this repo you find a bit more infor how to create the required service linked roles. When time I will add them also to this repo.

See, you only will need the one for spot https://github.com/npalm/terraform-aws-gitlab-runner#service-linked-roles

Via terraform you create the services link role as follow:

resource "aws_iam_service_linked_role" "spot" {
  aws_service_name = "spot.amazonaws.com"
}
``

Another quick fix would be first to create manaully via the AWS console a spot instance and remove it. You will see that AWS will create the required role for you.

from terraform-aws-github-runner.

Hey @compiaffe ,

Assume that you are using the v0.2.0 tag?
And, curious if you always see this error now?

• i.e.: can you terraform destroy, delete ./.terraform dir, and then terraform init/plan/apply again a few times and validate that you always get this error?

• I don't see the error you noted--although the effect is the same for both of us, as we are not seeing any EC2 spot instances deployed (ref: #100 (comment) ). And I definitely have terraform destroyed/applied probably ten or so times in the past couple of days.

• For the record, I'm using terraform 0.12.28 on macos, curious what TF version you are using?

I ended up importing the project as I needed to make changes to some submodules code with things like the hard coded tags, etc. in case its helpful, here is how I have my internal module structure, based on the default/example from this project

tree
.
├── README.md
├── lambdas-download
│   ├── main.tf
│   ├── runner-binaries-syncer.zip
│   ├── runners.zip
│   ├── terraform.tfstate
│   └── webhook.zip
├── main.tf
├── outputs.tf
├── providers.tf
├── terraform-aws-github-runner.tfvars
├── terraform.secret.auto.tfvars
├── terraform.tf
└── variables.tf

1 directory, 13 files
cmcc@cmcc:default $ cat ../../.terraform-version
0.12.28

I found this curious seeing that this has apparently been an intermittent issue for folks in the past with other projects:
LeanerCloud/AutoSpotting#187

This issue notes how they apparently took their fix and made it less permissive and were able to get it resolved:
LeanerCloud/AutoSpotting#416 (comment)

from terraform-aws-github-runner.

@npalm Thanks for the info, will try it out. Due to upcoming holidays might not report back before October.

from terraform-aws-github-runner.

I was having the same issue and adding

resource "aws_iam_service_linked_role" "spot" {
  aws_service_name = "spot.amazonaws.com"
}

Did indeed fix it. Thanks!

from terraform-aws-github-runner.

Docs are updated via #229

from terraform-aws-github-runner.