THE blog post discusses the implementation of hardened security for GitHub Actions running on AWS CodeBuild-hosted runners, offering protection from potential vulnerabilities like credential theft. It introduces the Harden-Runner tool, which now supports AWS CodeBuild, particularly focused on environments using EC2 compute. Key features include secure configurations using CodeBuild settings such as setting the host kernel and enabling privileged mode.
The post highlights the increased security risks associated with AWS CodeBuild due to its integration with IAM roles, and how Harden-Runner captures suspicious activities and enhances visibility into what occurs during a build. The approach ensures that security policies are consistent across all types of runners. The post encourages users to incorporate hardened security into their workflows.