Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.
How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.
Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.