How can I find the right inbound rule for my Github action to deploy on my AWS EC2 server?

user_5074301 0
Viewed 1408

I just created the action on my project and configured everything over there, but unfortunately I'm getting a message like this into the 'deploy file' section> ssh: connect to host ec2-MYIP.us-east-2.compute.amazonaws.com port 22: Operation timed out

Error due to EC2 security

Good thing is that I know what's happening. I have to allow as an Inbound Rule the following:

Type: SSH / Protocol: TCP / Post range: 22 / Source: ::/0;

EC2 inbound rules to make it work

As you can see here, it works fine without limiting the source IP > When I don't specify any source for the TCP port 22

But obviously I don't want to do that for security reasons, so I need to find out the source I need to put there. I've tried a lot of Github IP addresses already, but all of them were unsuccessful.

Does anyone here know what's the right source for it to work in a protected way or how can I find it?

Action I am using > https://github.com/wlixcc/SFTP-Deploy-Action

github-actions amazon-ec2 deployment tcp github
2 Answers

The IP addresses of GitHub hosted runners are documented here: https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners#ip-addresses

Windows and Ubuntu runners are hosted in Azure and have the same IP address ranges as Azure Data centers.
[...]
Microsoft updates the Azure IP address ranges weekly in a JSON file that you can download from the Azure IP Ranges and Service Tags - Public Cloud website. You can use this range of IP addresses if you require an allow-list to prevent unauthorized access to your internal resources.

user_32412430

An improved answer over riQQ's: Dynamically retrieve the Github Action runner's IP address during your workflow using the public-ip action and update your EC2 server's security group ingress rules before and after your SSH steps.

Your EC2 instance will never be exposed to public IP addresses on your SSH port.

Note: You will need to also set AWS credentials on your runner with permissions to update the associated EC2 security group.

Your workflow should look something like this:

  deploy:
    name: deploy
    runs-on: ubuntu-latest
    env:
      AWS_INSTANCE_SG_ID: <your-ec2-security-group-id>
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: <your-ci-aws-access-key>
          aws-secret-access-key: <your-ci-aws-secret-key>
          aws-region: <your-ec2-aws-region>
      - name: get runner ip address
        id: ip
        uses: haythem/public-ip@v1.2
      - name: whitelist runner ip address
        run: |
          aws ec2 authorize-security-group-ingress \
            --group-id $AWS_INSTANCE_SG_ID \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32
      - name: ssh into your ec2 and do whatever
        run: |
          ...do whatever you need to do...
      - name: revoke runner ip address
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id $AWS_INSTANCE_SG_ID \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32
user_124883910
Related