fix: pin AWS workspaces to an explicit VPC subnet and security group - #169
Merged
Conversation
Both AWS templates set no subnet_id or security group, so RunInstances fell back to the region's default VPC. Accounts without one fail with VPCIdNotSpecified. Adds optional vpc_id/subnet_id variables (defaulting to the default VPC, so ai.coder.com is unaffected) plus an egress-only security group passed by ID. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
All six usages set dir to /home/coder, which is already the $HOME default, so removal is a no-op. Also drops the now-unused local.home_dir.
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/87dbe968-62a1-4563-addd-eeba031ce8a9 |
|
❌ Agent Validation FAILED for template
Workspace Build Logs (workspace:
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/cf4331ec-813c-4034-af6b-fab828bf1af3 |
|
🔍 Build Failure Analysis for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/e3a217f0-8c9b-4181-a984-64b08cf86306 |
|
❌ Agent Validation FAILED for template
Workspace Build Logs (workspace:
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/fb9c557c-d887-4a7d-bcec-945b32be2da3 |
|
🔍 Build Failure Analysis for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/101a41d9-17b6-4325-9759-42e126feaac6 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/f1ab70ab-c75c-4e72-a855-b7598e0b4eb3 |
|
✅ Agent Validation PASSED for template
|
The provisioner role has describe permissions only, so CreateSecurityGroup returned UnauthorizedOperation. Use the VPC's default group (all egress, which is all the agent needs) with a security_group_ids override.
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/d796e973-42a3-495a-b80f-3dc72e189fd4 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/bef78dff-8ac4-4079-af31-28c679a74d1d |
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/bb499017-4c64-4cf9-9bce-305ee525f105 |
|
❌ Agent Validation FAILED for template
Workspace Build Logs (workspace:
|
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/0d4d4696-8f6c-40a9-a07b-721ff0fafb9d |
|
🔍 Build Failure Analysis for template
|
|
Coder Agents Chat: failed The Coder API returned an unexpected error while polling the chat.
View the chat in the Coder deployment: https://ai.coder.com/agents/710e5bdd-d5d5-4870-bfe9-69ffbed843a8 |
|
Coder Agents Chat: failed The Coder API returned an unexpected error while polling the chat.
View the chat in the Coder deployment: https://ai.coder.com/agents/4dd819c2-a636-4515-97b8-07528ab881f0 |
|
Coder Agents Chat: failed The Coder API returned an unexpected error while polling the chat.
View the chat in the Coder deployment: https://ai.coder.com/agents/693f73cc-8680-439a-8256-8fa91cff38f3 |
|
❌ Agent Validation FAILED for template
|
|
❌ Agent Validation FAILED for template
|
|
❌ Agent Validation FAILED for template
|
Every matrix job shares github.run_id and resolves to the same Coder user, and the token name only had one-second resolution, so jobs starting in the same second requested a duplicate name and were rejected (curl exit 22). Include the matrix key and run_attempt at both callers for guaranteed uniqueness, and fall back to nanosecond resolution inside the action. run_attempt also stops re-runs from clashing with tokens the previous attempt still holds within their 3600s lifetime. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
🔍 Build Failure Analysis for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/97ec0a1d-9ca3-44c0-a94b-478b6e62d3eb |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/1c38da87-8036-4d7c-9fa3-8abbf59184ae |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/edaaccd0-d0a4-4c38-aef4-f81ef20fdad5 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/4412a286-b4e3-4043-9175-585605a2788a |
|
✅ Agent Validation PASSED for template
|
coder-selenium-demo declared its variable as workspace_namespace while every other Kubernetes template here uses namespace, which is also what CI passes when pushing templates (--var namespace=). The variable therefore kept its "" default in CI, so the Kubernetes provider issued cluster-scoped requests and the PVC was denied: persistentvolumeclaims is forbidden: User "system:serviceaccount:...:coder" cannot create resource "persistentvolumeclaims" at the cluster scope Production was unaffected because ai.coder.com.tf passed the old name, so this only ever failed validation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/284a10df-79a7-4e28-807b-eb36059fbaac |
|
❌ Agent Validation FAILED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/b35264ac-c641-4224-9e1a-b11463434942 |
|
❌ Agent Validation FAILED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/77689903-44c2-4c55-b0b6-c6301f3a80e0 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/e0c9446f-0bc2-4366-9b51-e31735a856e5 |
|
✅ Agent Validation PASSED for template
|
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/41add37a-95dc-40e2-94c9-8cfa53ac3a91 |
|
✅ Agent Validation PASSED for template
|
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/b75f66a1-1242-470e-aca0-822145236167 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/cb036cc4-9f3d-4c11-9626-e131a6c70178 |
|
✅ Agent Validation PASSED for template
|
jatcod3r
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ec2-win-vmanddevcontainersspecified nosubnet_idor security group, so AWS fell back to the region's default VPC. Accounts without a default VPC fail withVPCIdNotSpecified.vpc_id/subnet_idtemplate variables (both default""→ default VPC, so ai.coder.com behavior is unchanged) and an egress-only security group passed by ID.subnet_idis inignore_changesso existing workspaces and the Windows prebuild are not force-replaced.coder_agent.dirattribute from all six templates that set it; every one was already$HOME.Testing
terraform validatepasses onec2-win-vmanddevcontainersterraform fmt -check -recursive deployments/clean