[guicaulada]

Sensitive EC2 bootstrap content can prevent a v2 runner configuration from planning. We hit Invalid for_each argument for both aws_iam_role_policy.runner_provider and aws_iam_role_policy_attachment.runner when a bootstrap script contained a sensitive value. The IAM policy keys themselves were public.

Two expressions spread that sensitivity beyond the bootstrap value:

• Provider selection compares the provider configuration with null; a sensitive child marks the selection result and consequently lookups using that key.
• one(module.compute_aws_ec2[*].provider) promotes nested userdata sensitivity to the whole provider contract, including sibling policy maps.

Declassify only the boolean indicating whether the provider is configured, and access the selected module's contract directly using the plan-known provider key. Bootstrap contents and resource attributes retain their sensitivity; no policy documents or configuration objects are passed through nonsensitive().

Added mocked parent-module plans covering sensitive full userdata, pre-install scripts, and post-install scripts, with an assertion that launch-template userdata remains sensitive. The regression reproduces both IAM errors on unmodified main. With the fix, all 20 runner-config tests and 21 multi-runner tests pass, including the existing computed-IAM-input cases.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟢 Approval recommended

No active review issues were identified for the sensitive-bootstrap configuration changes.

No open issues 🎉

What changed in this PR

This PR fixes v2 runner configuration planning when EC2 bootstrap content is sensitive, while preserving sensitivity on userdata and keeping public IAM policy keys usable.

Changes:

• Declassifies only the provider-presence boolean used for selection.
• Accesses the selected provider contract directly to avoid spreading userdata sensitivity to sibling policies.
• Adds mocked plan regressions for sensitive full userdata, pre-install scripts, and post-install scripts, with userdata sensitivity assertions.

File	Description
modules/​runner-config/​tests/​sensitive-bootstrap.tftest.hcl	Adds three sensitive-bootstrap planning regressions.
modules/​runner-config/​tests/​fixtures/​sensitive-bootstrap/​README.md	Documents the test fixture’s module, input, and outputs.
modules/​runner-config/​tests/​fixtures/​sensitive-bootstrap/​main.tf	Defines the runner fixture and exposes sensitivity and provider-type checks.
modules/​runner-config/​compute-provider.tf	Limits sensitivity propagation during provider selection and contract access.

_{Review effort: Balanced}