<p>If the running is aware of it's IP, you could run  github action step which takes that as an input var to aws cli or Terraform to update the security group applied to the instance you're targetting, then delete the rule when the run is done.</p>

CC BY-SA 4.0
2021-09-16T21:41:54.823Z
I ended up doing my third option which is about the same as you've suggested. I wasn't sure if this was considered good practice or not.
RichardM
CC BY-SA 4.0
2021-09-16T17:19:54.067Z
2021-09-16T17:19:54.067Z
Bruce Becker
<p>I have a GitHub Actions workflow to deploy a service to an EC2 instance. I have currently opened the SSH access to all IPs but I want to restrict this to IPs used by GitHub Actions runners.</p>
<p>However, by default <a href="https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-security-groups" rel="nofollow noreferrer">AWS limits the inbound rules to 60 IP address ranges</a> or you can request an increase to a maximum of 1000 ranges.</p>
<p>The <a href="https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#ip-addresses" rel="nofollow noreferrer">IP list for GitHub Actions</a> is currently ~1900 ranges, so even increasing the limit to 1000 won't help.</p>
<p>How have others solved this problem? Create multiple security groups with 60 different IP ranges? Create fewer security groups with up to 1000 IP ranges? Dynamically create the inbound rule for the specific runner IP address and remove it after?</p>

<amazon-ec2><github-actions>
How to configure EC2 inbound rules for GitHub Actions deploy
RichardM
# How to configure EC2 inbound rules for GitHub Actions deploy

(Asked by: username_0 on 2021-09-16)

I have a GitHub Actions workflow to deploy a service to an EC2 instance. I have currently opened the SSH access to all IPs but I want to restrict this to IPs used by GitHub Actions runners.

However, by default [AWS limits the inbound rules to 60 IP address ranges](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-security-groups) or you can request an increase to a maximum of 1000 ranges.

The [IP list for GitHub Actions](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#ip-addresses) is currently ~1900 ranges, so even increasing the limit to 1000 won't help.

How have others solved this problem? Create multiple security groups with 60 different IP ranges? Create fewer security groups with up to 1000 IP ranges? Dynamically create the inbound rule for the specific runner IP address and remove it after?

**Tags:** amazon-ec2, github-actions


---

## 1 answers

### Answer by username_1 on 2021-09-16. Score: 1 | Accepted answer

If the running is aware of it's IP, you could run github action step which takes that as an input var to aws cli or Terraform to update the security group applied to the instance you're targetting, then delete the rule when the run is done.

> **Comments:**
> **username_0**: I ended up doing my third option which is about the same as you've suggested. I wasn't sure if this was considered good practice or not.  

---

