Forge — Administrator & Developer Guide

1. Architecture Overview

Forge is Cisco's open-source Infrastructure-as-Code (IaC) framework for deploying and operating multi-tenant, self-hosted GitHub Actions runners on AWS. It provides a modular Terraform/Terragrunt architecture that provisions both EC2-based and Kubernetes-based (ARC) runner backends, along with comprehensive observability, security, and lifecycle management infrastructure.

The framework is designed around three architectural layers:

• Core — GitHub Actions Runner Controller (ARC) on EKS, including scale set management and Helm-based deployment
• Infrastructure — Foundational AWS resources: EKS clusters, ECR registries, S3 storage, AMI lifecycle policies, CloudFormation stacks, and cross-account subscription roles
• Platform — Runner orchestration: EC2 and ARC deployment, GitHub App management, webhook relay, job log archival, trust validation, and dead-letter queue redriving
• Integrations — Third-party services: Splunk Cloud (data ingestion, dashboards, props/transforms), Splunk Observability (SignalFx, OTel), Teleport (secure access), and GitHub webhook relay (EventBridge cross-account forwarding with Webex notification support)

Architecture Diagram

┌──────────────────────────────────────────────────────────────────────┐
│                        GitHub (GHES / github.com)                    │
│  ┌─────────┐   ┌──────────┐   ┌───────────────┐                    │
│  │ Webhooks │   │ Runner   │   │ GitHub App    │                    │
│  │          │   │ Groups   │   │ (JWT + Install│                    │
│  └────┬─────┘   └─────┬────┘   │  Token Auth)  │                    │
│       │               │        └───────┬───────┘                    │
└───────┼───────────────┼────────────────┼────────────────────────────┘
        │               │                │
        ▼               │                ▼
┌───────────────────────┼──────────────────────────────────────────────┐
│  AWS Account          │                                              │
│                       │                                              │
│  ┌──────────────┐     │     ┌─────────────────────────────────────┐  │
│  │ API Gateway  │─────┼────▶│ Webhook Relay Lambda               │  │
│  │ (webhook     │     │     │ (validate_signature.py)            │  │
│  │  ingress)    │     │     └──────────────┬──────────────────────┘  │
│  └──────────────┘     │                    │                         │
│                       │                    ▼                         │
│                       │     ┌─────────────────────────────────────┐  │
│                       │     │ EventBridge                         │  │
│                       │     │ ┌─────────┐  ┌──────────────────┐  │  │
│                       │     │ │ Source   │─▶│ Destination Bus  │  │  │
│                       │     │ │ Rules    │  │ (cross-account)  │  │  │
│                       │     │ └─────────┘  └──────┬───────────┘  │  │
│                       │     └─────────────────────┼──────────────┘  │
│                       │                           │                  │
│           ┌───────────┴───────────┐               ▼                  │
│           │                       │    ┌──────────────────┐          │
│  ┌────────▼─────┐  ┌─────────────▼┐   │ Webex Relay      │          │
│  │ EC2 Runners  │  │ ARC Runners  │   │ Lambda           │          │
│  │ (ASG/Fleet)  │  │ (EKS Pods)   │   └──────────────────┘          │
│  │ ┌──────────┐ │  │ ┌──────────┐ │                                  │
│  │ │ Linux    │ │  │ │ DinD     │ │   ┌──────────────────────────┐  │
│  │ │ macOS    │ │  │ │ K8s Mode │ │   │ Support Lambdas          │  │
│  │ │ Windows  │ │  │ └──────────┘ │   │ ┌──────────────────────┐ │  │
│  │ └──────────┘ │  └──────────────┘   │ │ trust_validator      │ │  │
│  └──────────────┘                     │ │ ssm_ami_updater      │ │  │
│                                       │ │ runner_tag_updater   │ │  │
│  ┌────────────────────────────────┐   │ │ global_lock_cleaner  │ │  │
│  │ EKS Cluster                   │   │ │ app_runner_group     │ │  │
│  │ ┌────────┐ ┌────────────────┐ │   │ │ job_log_archiver     │ │  │
│  │ │Karpenter│ │ARC Controller │ │   │ │ job_log_dispatcher   │ │  │
│  │ │        │ │(Helm)         │ │   │ │ redrive_deadletter   │ │  │
│  │ └────────┘ └────────────────┘ │   │ └──────────────────────┘ │  │
│  └────────────────────────────────┘   └──────────────────────────┘  │
│                                                                      │
│  ┌───────────────────────────────────────────────────────────────┐   │
│  │ Observability (Splunk)                                        │   │
│  │ ┌──────────┐ ┌──────────┐ ┌─────────┐ ┌────────────────────┐│   │
│  │ │Data Mgr  │ │O11y/SFx  │ │OTel EKS │ │Billing (CUR→HEC)  ││   │
│  │ │(CloudFmt)│ │(Dashbds) │ │(Helm)   │ │(S3→Lambda→Splunk) ││   │
│  │ └──────────┘ └──────────┘ └─────────┘ └────────────────────┘│   │
│  └───────────────────────────────────────────────────────────────┘   │
│                                                                      │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐               │
│  │ ECR      │ │ S3       │ │ SSM      │ │ Secrets  │               │
│  │ (images) │ │ (logs,   │ │ (params) │ │ Manager  │               │
│  │          │ │  billing)│ │          │ │          │               │
│  └──────────┘ └──────────┘ └──────────┘ └──────────┘               │
└──────────────────────────────────────────────────────────────────────┘

Component Inventory

Technology Stack

2. System Requirements

AWS Account Prerequisites

GitHub App Requirements

The GitHub App must have these permissions:

Important

The GitHub App must be installed on the target organization. The installation ID, app ID, client ID, and base64-encoded private key must be available for Terraform to store in SSM.

Toolchain

3. Configuration Reference

Global Settings (_global_settings/)

_global.yaml — shared values inherited by all environments:

# Example from templates/tenant/_global_settings/_global.yaml
# Contains: aws_profile, aws_region, default_tags, product metadata

_global.hcl — shared HCL configuration for provider setup, backend, and default inputs.

Per-module .hcl files — each module has a dedicated HCL file (e.g., tenant.hcl, eks.hcl, storage.hcl) that specifies the module source path and version:

# Example: _global_settings/eks.hcl
locals {
  source = "${get_repo_root()}/modules/infra/eks"
}

Environment Settings (_environment_wide_settings/)

_environment.yaml — environment-specific overrides (e.g., dev vs. prod instance sizes, scaling limits).

_environment.hcl — environment-level HCL (e.g., different AWS profiles per environment).

Region Settings (_region_wide_settings/)

_region.hcl — region-specific configuration (subnet IDs, VPC IDs, availability zones).

VPC Settings (_vpc_wide_settings/)

_vpc.yaml / _vpc.hcl — VPC-level configuration for multi-VPC deployments, including subnet assignments and security group references.

Forge Runners Module — Key Variables

The forge_runners module (modules/platform/forge_runners/) is the main orchestration module. Key input variables:

deployment_config

variable "deployment_config" {
  type = object({
    deployment_prefix = string
    secret_suffix     = string
    env               = string
    github_app = object({
      id              = string
      client_id       = string
      installation_id = string
      name            = string
    })
    github = object({
      ghes_org             = string
      ghes_url             = string
      repository_selection = string  # "all" or "selected"
      runner_group_name    = string
    })
    tenant = object({
      name                         = string
      iam_roles_to_assume          = optional(list(string), [])
      ecr_registries               = optional(list(string), [])
      github_logs_reader_role_arns = optional(list(string), [])
    })
  })
}

Important

The deployment_prefix is used to namespace all SSM parameters, log groups, and resource names. It must be unique per tenant deployment within an AWS account.

ec2_deployment_specs

variable "ec2_deployment_specs" {
  type = object({
    lambda_subnet_ids = list(string)
    subnet_ids        = list(string)
    lambda_vpc_id     = string
    vpc_id            = string
    scale_errors      = optional(list(string), [])
    runner_specs = map(object({
      ami_filter                    = object({ name = list(string), state = list(string) })
      ami_kms_key_arn               = string
      ami_owners                    = list(string)
      runner_labels                 = list(string)
      runner_os                     = string    # "linux", "osx", "windows"
      runner_architecture           = string    # "x86_64", "arm64"
      extra_labels                  = list(string)
      max_instances                 = number
      min_run_time                  = number
      instance_types                = list(string)
      pool_config                   = list(object({
        size                         = number
        schedule_expression          = string
        schedule_expression_timezone = string
      }))
      runner_user                   = string
      enable_userdata               = bool
      instance_target_capacity_type = string  # "spot" or "on-demand"
      block_device_mappings         = list(object({...}))
    }))
  })
}

arc_deployment_specs

variable "arc_deployment_specs" {
  type = object({
    cluster_name    = string
    migrate_cluster = optional(bool, false)
    runner_specs = map(object({
      runner_size = object({
        max_runners = number
        min_runners = number
      })
      scale_set_name               = string
      scale_set_type               = string  # "k8s" or "dind"
      container_actions_runner     = string
      container_limits_cpu         = string
      container_limits_memory      = string
      container_requests_cpu       = string
      container_requests_memory    = string
      volume_requests_storage_size = string
      volume_requests_storage_type = string
    }))
  })
}

github_webhook_relay

variable "github_webhook_relay" {
  type = object({
    enabled                     = bool
    destination_account_id      = optional(string)
    destination_event_bus_name  = optional(string)
    destination_region          = optional(string)
    destination_reader_role_arn = optional(string)
  })
  default = { enabled = false }
}

EKS Module — Key Variables

Common Variables (shared across modules)

Splunk Configuration Variables

Note

All Splunk secrets (HEC tokens, API tokens, Splunk Cloud credentials) are stored in AWS Secrets Manager and referenced by the modules via aws_secretsmanager_secret data sources. Never hardcode credentials in Terraform variables.

4. Deployment & Scaling

Deployment Order

Forge deployments follow a strict dependency order:

1. infra-forge — Foundation: EKS, ECR, storage, AMI policies, service-linked roles, opt-in regions
2. forge-extras — Optional: Cloud Custodian, additional ECR repos, Forge subscription (cross-account)
3. forge-eks — EKS cluster with Karpenter and Calico (if using ARC runners)
4. forge-integrations — Splunk Cloud configuration (props, transforms, dashboards)
5. splunk-deployment — Splunk O11y, OTel, Data Manager, billing pipeline
6. forge-tenant — Per-tenant runner deployment (last, depends on all above)

Deploying a Full Stack

# 1. Foundation
cd examples/infra-forge/terragrunt/environments/dev
terragrunt run-all apply

# 2. EKS cluster (if using ARC)
cd examples/deployments/forge-eks/terragrunt/environments/prod
terragrunt run-all apply

# 3. Integrations
cd examples/deployments/forge-integrations/terragrunt/environments/prod
terragrunt run-all apply

# 4. Splunk
cd examples/deployments/splunk-deployment/terragrunt/environments/prod
terragrunt run-all apply

# 5. Tenants
cd examples/deployments/forge-tenant/terragrunt/environments/prod
terragrunt run-all apply

Scaling EC2 Runners

EC2 runner pools scale via two mechanisms:

1. Reactive scaling — The upstream terraform-aws-github-runner module responds to GitHub Actions webhook events to launch/terminate instances based on demand.

2. Scheduled scaling — The pool_config variable defines baseline capacity on a cron schedule:

pool_config = [
  {
    size                         = 2
    schedule_expression          = "cron(0 8 ? * MON-FRI *)"
    schedule_expression_timezone = "America/New_York"
  },
  {
    size                         = 0
    schedule_expression          = "cron(0 20 ? * MON-FRI *)"
    schedule_expression_timezone = "America/New_York"
  }
]

Key scaling parameters per runner spec:

Scaling ARC Runners

ARC runner pools scale via the GitHub Actions Runner Controller:

Karpenter manages the underlying EKS node capacity, provisioning nodes as pods demand increases.

Tip

Set min_runners to at least 1 for latency-sensitive workflows. Cold starts (launching a new runner pod + node) can add 2-5 minutes to job startup.

ARC Cluster Migration

Set migrate_arc_cluster = true when performing a blue/green cluster cutover. This flag is propagated to the scale set controller and scale set modules to coordinate the migration.

5. Operations

Lambda Functions

Forge deploys several operational Lambda functions:

Note

All Lambda functions use a configurable log_level variable (default INFO) and logging_retention_in_days for CloudWatch log group retention. Common values: 3 days for integration Lambdas, 30 days for platform Lambdas.

GitHub Actions Job Log Archival

The job log archiver supports two modes:

Queue Pipeline (default, recommended):

GitHub Webhook → EventBridge → Dispatcher Lambda → SQS → Archiver Lambda → S3

• Better isolation, retry semantics, and backpressure handling
• SQS dead-letter queue for failed downloads
• Configurable batch size (downloader_batch_size) and concurrency (downloader_max_concurrency)

Direct Mode (fallback):

GitHub Webhook → EventBridge → Archiver Lambda → S3

• Simpler, fewer moving parts
• Set enable_queue_pipeline = false to use

Logs are stored at: s3://<bucket>/<workflow_name>/<run_attempt>/<job_id>.zip

Monitoring

Forge provides built-in monitoring through Splunk Observability (SignalFx) dashboards:

Each dashboard supports dynamic variables for filtering by tenant via the dashboard_variables input.

Tip

The Splunk Cloud Conf module (splunk_cloud_conf_shared) provisions three Splunk dashboards (CI Jobs, Tenant, Trust Relationship Validation) as saved searches using splunk_data_ui_views resources.

Secrets Management

Warning

The Webex webhook relay Lambda expects a Secrets Manager secret at /cicd/common/webex_webhook_relay_bot_token containing JSON with token and room_id keys. Both are required. The Lambda auto-prepends Bearer to the token if not present.

Operational Scripts

6. Performance

EKS Cluster Sizing

The EKS module exposes cluster_size for the self-managed node group:

cluster_size = {
  instance_type = "m5.large"
  min_size      = 2
  max_size      = 10
  desired_size  = 3
}

And cluster_volume for EBS configuration:

cluster_volume = {
  size       = 100
  iops       = 3000
  throughput = 125
  type       = "gp3"
}

Karpenter handles additional node provisioning beyond the base node group, using NodePool and EC2NodeClass custom resources applied via null_resource provisioners.

ARC Scale Set Resource Tuning

Each ARC runner pod's resources are individually configurable:

EC2 Runner Instance Selection

Configure instance types per runner pool for cost/performance optimization:

instance_types = ["m5.xlarge", "m5a.xlarge", "m5d.xlarge"]
instance_target_capacity_type = "spot"  # or "on-demand"

Tip

Use multiple instance types in the instance_types list when using spot capacity to improve availability. The runner module selects from the list based on current spot pricing and capacity.

7. Security

IAM Architecture

Forge implements a layered IAM model:

• Runner IAM roles — Each tenant's runners assume a dedicated IAM role (role_for_forge_runners) with scoped permissions for S3, Secrets Manager, ECR, and Packer operations
• Forge trust validator — A scheduled Lambda that validates IAM trust policies on runner roles, ensuring no unauthorized principals can assume them
• ECR access policies — Per-tenant ECR repository policies granting pull access only to authorized runner roles
• Cross-account roles — The forge_subscription module creates IAM roles and ECR policies for subscriber accounts

Trust Validation

The forge_trust_validator Lambda (modules/platform/forge_runners/forge_trust_validator/lambda/forge_trust_validator.py) runs on a schedule and:

1. Reads the trust policy of each configured Forge IAM role
2. Validates that only expected principals appear in the trust relationship
3. Reports violations (the Splunk Cloud Conf module provides a Trust Relationship Validation dashboard)

Webhook Signature Validation

The GitHub webhook relay source Lambda (modules/integrations/github_webhook_relay_source/lambda/validate_signature.py) validates incoming webhook payloads using HMAC-SHA256 with the GitHub App webhook secret before forwarding events to EventBridge.

Encryption

Caution

The ami_policy module enables EBS encryption by default at the account level via aws_ebs_encryption_by_default. This affects ALL EBS volumes in the region, not just Forge resources. Coordinate with other teams before applying.

Network Security

• EC2 runners are deployed in private subnets with security groups managed by the ec2_deployment module
• EKS clusters default to cluster_endpoint_public_access = false (private API endpoint)
• external_access_cidr_blocks must be explicitly configured for any external access to the K8s API
• Calico network policies are applied via the EKS module for pod-level network segmentation

Pre-Commit Security Hooks

8. Developer Internals

Repository Structure

cisco-open/forge/
├── modules/
│   ├── core/
│   │   └── arc/                    # ARC scale set controller + scale sets
│   │       ├── scale_set/          # Individual scale set (Helm + K8s + IAM)
│   │       ├── scale_set_controller/  # ARC controller (Helm + namespace + secret)
│   │       └── templates/          # Karpenter NodePool template
│   ├── infra/
│   │   ├── ami_policy/             # DLM lifecycle, EBS encryption
│   │   ├── ami_sharing/            # Cross-account AMI sharing
│   │   ├── cloud_custodian/        # Cost governance
│   │   ├── cloud_formation/        # CF stack management
│   │   ├── ecr/                    # Container registry
│   │   ├── eks/                    # EKS cluster + addons + Karpenter
│   │   ├── forge_subscription/     # Cross-account subscription
│   │   ├── opt_in_regions/         # AWS region opt-in
│   │   ├── service_linked_roles/   # SLR provisioning
│   │   └── storage/                # S3 buckets
│   ├── integrations/
│   │   ├── github_webhook_relay_source/        # Webhook ingress (API GW + Lambda)
│   │   ├── github_webhook_relay_destination/   # EventBridge destination bus
│   │   ├── github_webhook_relay_destination_receivers/  # Lambda receivers
│   │   ├── splunk_aws_billing/                 # CUR billing pipeline
│   │   ├── splunk_cloud_conf_shared/           # Splunk props/transforms/dashboards
│   │   ├── splunk_cloud_data_manager/          # CloudWatch data ingestion
│   │   ├── splunk_cloud_data_manager_common/   # Shared DM config
│   │   ├── splunk_cloud_s3_runner_logs/        # Runner log shipping
│   │   ├── splunk_o11y_aws_integration/        # AWS integration (CloudFormation)
│   │   ├── splunk_o11y_aws_integration_common/ # SignalFx API integration
│   │   ├── splunk_o11y_conf_shared/            # SignalFx dashboards (7 types)
│   │   ├── splunk_otel_eks/                    # OTel collector Helm
│   │   ├── splunk_secrets/                     # Secrets Manager entries
│   │   └── teleport/                           # Teleport agent + tenant RBAC
│   └── platform/
│       ├── arc_deployment/         # ARC deployment wrapper
│       ├── ec2_deployment/         # EC2 runners (AMI, SG, user data, Lambdas)
│       └── forge_runners/          # Main orchestration module
│           ├── forge_trust_validator/     # IAM trust validation Lambda
│           ├── github_actions_job_logs/   # Job log archiver (dispatcher + archiver)
│           ├── github_app_runner_group/   # Runner group management Lambda
│           ├── github_global_lock/        # Global lock cleanup Lambda
│           ├── github_webhook_relay/      # Webhook relay orchestration
│           ├── redrive_deadletter/        # DLQ redrive Lambda
│           └── scripts/                   # GitHub App patching script
├── examples/
│   ├── deployments/                # Full deployment examples per stack
│   │   ├── forge-eks/
│   │   ├── forge-extras/
│   │   ├── forge-integrations/
│   │   ├── forge-tenant/
│   │   └── splunk-deployment/
│   ├── infra-forge/                # Foundation infrastructure deployment
│   └── templates/                  # Configuration templates per stack type
├── docs/                           # Internal documentation
│   ├── configurations/             # Deployment configuration guides
│   └── tenant-usage/               # Tenant onboarding and Renovate
├── scripts/                        # Operational scripts
├── .pre-commit-config.yaml         # 30+ pre-commit hooks
├── .terraform-docs.yml             # terraform-docs configuration
├── renovate.json                   # Renovate dependency management
├── .ansible-lint                   # Ansible linting config
└── .yamllint                       # YAML linting config

Module Composition Pattern

The forge_runners module demonstrates the primary composition pattern:

# modules/platform/forge_runners/
module "ec2_runners"              { source = "../ec2_deployment" }
module "arc_runners"              { source = "../arc_deployment" }
module "forge_trust_validator"    { source = "./forge_trust_validator" }
module "github_actions_job_logs"  { source = "./github_actions_job_logs" }
module "github_app_runner_group"  { source = "./github_app_runner_group" }
module "github_global_lock"       { source = "./github_global_lock" }
module "github_webhook_relay"     { source = "./github_webhook_relay" }
module "redrive_deadletter"       { source = "./redrive_deadletter" }

This single module composes all runner-related infrastructure, creating a cohesive deployment unit per tenant.

Code Patterns and Conventions

State management: Each module uses a backend.tf with S3 backend configuration. State paths follow the Terragrunt hierarchy.

Provider configuration: Providers are declared in providers.tf per module, with versions pinned in versions.tf.

Tagging: Every module accepts default_tags and tags variables. The AWS provider default_tags feature applies organization-wide tags, while tags adds module-specific tags.

Naming: Resources use a prefix or deployment_prefix variable for namespace isolation. SSM parameters follow /forge/<prefix>/<parameter_name> convention.

Lambda packaging: Lambda functions are Python 3.12, packaged in-module under lambda/ directories. The terraform-aws-modules/lambda/aws module (v8.7.0) handles packaging and deployment.

Template files: Terraform template files use .tftpl extension and live in template_files/ directories within their respective modules.

External data sources: Several modules use external_external data sources to call shell scripts (e.g., fetch_secret_value.sh, list_buckets.sh) for operations that lack native Terraform providers.

Webhook Relay Architecture

The webhook relay spans three modules:

1. Source (github_webhook_relay_source/) — API Gateway endpoint receives GitHub webhooks → Lambda validates HMAC signature → forwards valid events to EventBridge source bus

2. Destination (github_webhook_relay_destination/) — EventBridge destination bus in another account receives cross-account events → rules route to Lambda targets based on event patterns

3. Receivers (github_webhook_relay_destination_receivers/) — Lambda functions that process forwarded events. The included webex_webhook_relay receiver:

   • Filters for main branch failures (cancelled, failure, timed_out, timeout, startup_failure)
   • Builds a Slack-format card, converts to Webex Adaptive Card format
   • Sends to Webex via the Messages API using a bot token from Secrets Manager

Splunk Billing Pipeline

The billing integration (splunk_aws_billing/) implements a three-Lambda pipeline:

1. cur_per_resource — Triggered by S3 notifications when new CUR (Cost and Usage Report) parquet files arrive. Splits data by date and re-uploads to S3 for processing.

2. cur_per_resource_process — Groups billing data by resource, service, and application. Sends events to Splunk HEC in batches (respecting MAX_BATCH_COUNT and MAX_BATCH_SIZE_BYTES). Also sends metrics to SignalFx (forge.per_resource.cost_usd, forge.per_resource.net_cost_usd).

3. cur_per_service — Similar to per-resource but aggregated at the service level. Sends forge.per_service.cost_usd and forge.per_service.net_cost_usd metrics.

All three Lambdas use a shared common.py module for Splunk HEC/SignalFx communication and data preprocessing.

Testing Strategy

Forge relies on:

• Pre-commit validation — terraform validate, terraform fmt, tflint, tofu-validate run on every commit
• Terraform plan — terragrunt run-all plan serves as the primary integration test
• Safety hooks — safety_hook.sh provides environment-aware guardrails before apply

Code Quality Toolchain

The .pre-commit-config.yaml configures 30+ hooks across categories:

Dependency Management

Renovate (renovate.json) manages all dependency updates:

Custom regex managers extract versions from:

• .tf files (required_version)
• download_lambdas.sh references (GitHub runner version)
• Dockerfiles (with renovate comments)

Contributing

Forge follows conventional commits with gitmoji (enforced by commitizen pre-commit hook). Key practices:

• All Terraform code must pass terraform validate, terraform fmt, and tflint
• Shell scripts must pass shellcheck and shfmt
• Python code must pass flake8 (E501 ignored), autopep8, isort, and autoflake
• Module documentation is auto-generated — update source code, then run scripts/update-terraform-docs.sh
• YAML files are formatted with yamlfmt (2-space mapping, 4-space sequence, 2-space offset, 180 char width)

Potential Improvements

Based on open GitHub issues:

• Lifecycle field refactoring (#236) — Replace count conditionals with the lifecycle.enabled field for cleaner resource toggling
• Grafana/PagerDuty integration (#125, #124) — Add alerting pipeline from Grafana and Splunk Cloud to PagerDuty
• AWS IAM Roles Anywhere (#122) — Enable multi-cloud ephemeral runners via certificate-based authentication
• Open-source monitoring (#121) — Add Loki, Prometheus, and Grafana as alternatives to Splunk
• Cost safeguards (#296) — Default cost guardrails and hardening for runner environments

9. Integration Points

AWS Service Integration

Third-Party Integrations

Terraform Module Dependencies