Any suggestions on this?
# github-actionsd
Dhamodharan
09/22/2024, 8:45 AMAny suggestions on this?
r
RB
09/22/2024, 2:33 PMYou can deploy in an ec2
• using userdata on the launch template
• using an ami on the launch template
RB
09/22/2024, 2:34 PMYour method might require keeping a persistent ec2 running which is not the best approach (see pets vs cattle)
RB
09/22/2024, 2:34 PMBy using either of the above methods, you would spin up a new instance in your auto scaling group to run the latest Python code
d
Dhamodharan
09/23/2024, 11:45 AMHello @RB Sorry couldnt understand the approach, I am looking for the suggestions to deploy from GActions
g
Gabriela Campana (Cloud Posse)
09/23/2024, 6:44 PM@Yonatan Koren @Igor Rodionov
i
Igor Rodionov
09/23/2024, 7:40 PM@Dhamodharan Actually, nowadays, we primarily deploy containerized applications on EKS or ECS clusters.
The deployment strategy you are working on is old school, but it still works for small projects without strict requirements for downtime, availability and etc.
From a security perspective, I like your second approach - with ssm command.
Just be aware that IAM user behind the AWS creds have minimum permissions - ideally just to run ssm command for specific resource.
Also, you can check GHA OIDC auth on AWS that will generate short-live AWS creds for each run and will be restricted to specific IAM role with required permissions.
You can read more here
https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
Cloudposse also have open sourced terraform modules to provision all required resources for such auth method.