Example setup for agency-hosted runners

In the below example diagram (referenced from an AWS DevOps Blog), you can see the use of an AWS CloudFormation template to set up a Docker-based runner on 2 different AWS account environments. This architecture also uses ASG to allow the ease of scaling up the runner. You can also attach different IAM roles/Security group to the runners according to your setup.

With this setup, the runner will easily have the required network/roles access that it needs for the build job because it is already hosted in the environment for which it requires the access.

Few additional examples are provided below for your reference.

Example: Azure

The above recommended architecture provisions SHIP-HATS’s private link endpoints in the tenant’s common VNet. These endpoints are then shared with different VNets across various environments through VNet peering, avoiding the need for duplicate private link endpoints.

Example: AWS