--- title: Runtime Security for AWS CodeBuild-Hosted GitHub Actions... description: StepSecurity's Harden-Runner now supports GitHub Actions jobs hosted on AWS CodeBuild running on EC2 compute, including custom Linux container images, starting... canonical: https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners | daily.dev og:description: StepSecurity's Harden-Runner now supports GitHub Actions jobs hosted on AWS CodeBuild running on EC2 compute, including custom Linux container images, starting... og:url: https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c og:image: https://api.daily.dev/og/posts/XYN1DbK2c.png og:image:alt: Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 4 min read · 0 upvotes · 0 comments ## Summary StepSecurity's Harden-Runner now supports GitHub Actions jobs hosted on AWS CodeBuild running on EC2 compute, including custom Linux container images, starting with Harden-Runner v2.20.1 and extended to custom images in v2.21.0. The release addresses risks unique to CodeBuild-hosted runners, where a compromised job inherits the IAM service role and VPC network reachability rather than just workflow secrets, referencing the CVE-2025-8217 memory-dump incident and the Team PCP campaign that exposed 78,330 CI/CD secrets. Setup requires configuring the CodeBuild project's host kernel (kernel-6) and privileged mode settings, then adding Harden-Runner as the first workflow step using the standard codebuild runner label. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I add Harden-Runner to a GitHub Actions job running on AWS CodeBuild? Add the step-security/harden-runner action as the first step of the job, using version 2.20.1 or later for EC2 compute, or 2.21.0 or later for custom Linux container images. The runs-on label uses the standard CodeBuild format: codebuild--${{ github.run_id }}-${{ github.run_attempt }}. No buildspec or webhook changes are required beyond the existing WORKFLOW_JOB_QUEUED webhook configuration. _daily.dev surfaces CI/CD security updates like this for teams hardening their AWS-hosted pipelines._ ### What CodeBuild project settings are required to run Harden-Runner on a CodeBuild GitHub Actions runner? Two project-level settings are required: the host kernel must be set to kernel-6, since the Harden-Runner agent needs kernel-level features only that kernel provides, and privileged mode must be enabled for the same reason. Both are configured on the CodeBuild project itself, not in the GitHub Actions workflow file. _Teams migrating CI runners to AWS CodeBuild track configuration gotchas like this on daily.dev._ ### Why is a compromised GitHub Actions job more dangerous on an AWS CodeBuild-hosted runner than on a GitHub-hosted runner? A compromised job on a GitHub-hosted runner only exposes secrets explicitly passed into it, but on a CodeBuild-hosted runner it also inherits the IAM service role assumed by the build environment and, if the project runs in a VPC, network reachability to internal registries, APIs, databases, and metadata endpoints. This mirrors the CVE-2025-8217 incident where a malicious pull request dumped build environment memory to steal a source repository access token, letting an attacker reach the AWS Toolkit for Visual Studio Code and AWS SDK for .NET repositories. _daily.dev helps engineers weighing runner architecture trade-offs stay ahead of incidents like these._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners","url":"https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c"},"datePublished":"2026-09-01T01:11:39.106Z","dateModified":"2026-09-01T01:42:34.769Z","description":"StepSecurity's Harden-Runner now supports GitHub Actions jobs hosted on AWS CodeBuild running on EC2 compute, including custom Linux container images, starting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7584d44f468a38c849f179b17c8d53a1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7584d44f468a38c849f179b17c8d53a1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,aws,github-actions","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/runtime-security-for-aws-codebuild-hosted-github-actions-runners-xyn1dbk2c#faq","mainEntity":[{"@type":"Question","name":"How do I add Harden-Runner to a GitHub Actions job running on AWS CodeBuild?","acceptedAnswer":{"@type":"Answer","text":"Add the step-security/harden-runner action as the first step of the job, using version 2.20.1 or later for EC2 compute, or 2.21.0 or later for custom Linux container images. The runs-on label uses the standard CodeBuild format: codebuild--${{ github.run_id }}-${{ github.run_attempt }}. No buildspec or webhook changes are required beyond the existing WORKFLOW_JOB_QUEUED webhook configuration. daily.dev surfaces CI/CD security updates like this for teams hardening their AWS-hosted pipelines."}},{"@type":"Question","name":"What CodeBuild project settings are required to run Harden-Runner on a CodeBuild GitHub Actions runner?","acceptedAnswer":{"@type":"Answer","text":"Two project-level settings are required: the host kernel must be set to kernel-6, since the Harden-Runner agent needs kernel-level features only that kernel provides, and privileged mode must be enabled for the same reason. Both are configured on the CodeBuild project itself, not in the GitHub Actions workflow file. Teams migrating CI runners to AWS CodeBuild track configuration gotchas like this on daily.dev."}},{"@type":"Question","name":"Why is a compromised GitHub Actions job more dangerous on an AWS CodeBuild-hosted runner than on a GitHub-hosted runner?","acceptedAnswer":{"@type":"Answer","text":"A compromised job on a GitHub-hosted runner only exposes secrets explicitly passed into it, but on a CodeBuild-hosted runner it also inherits the IAM service role assumed by the build environment and, if the project runs in a VPC, network reachability to internal registries, APIs, databases, and metadata endpoints. This mirrors the CVE-2025-8217 incident where a malicious pull request dumped build environment memory to steal a source repository access token, letting an attacker reach the AWS Toolkit for Visual Studio Code and AWS SDK for .NET repositories. daily.dev helps engineers weighing runner architecture trade-offs stay ahead of incidents like these."}}]} ```