Scoped to its own resources, nothing broader
AWS IAM permissions BYOC needs
Exactly which IAM permissions the runnerhut BYOC stack requires in your AWS account, and why each one is needed.
This is the page your security reviewer will ask for. Every permission below is scoped by resource tag or ARN prefix to the resources the module itself created.
| Permission group | Why it is needed | Scope |
|---|---|---|
| autoscaling:* | Create and adjust the runner ASG | Tagged runnerhut:managed=true |
| ec2:RunInstances / TerminateInstances | Start and stop runner instances | Launch template + subnets you supplied |
| ec2:DescribeInstances / DescribeSubnets | Read capacity and placement | Account-wide read, no write |
| s3:GetObject / PutObject / DeleteObject | Read and write cache objects | The cache bucket ARN only |
| ecr:BatchGetImage / GetAuthorizationToken | Pull-through image caching | The pull-through rule only |
| iam:PassRole | Attach the instance profile to runners | The single runner role ARN |
| logs:CreateLogStream / PutLogEvents | Ship runner diagnostics | The module's log group |
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.