StepSecurity Brings Runtime EDR Defenses to AWS CodeBuild-Hosted GitHub Actions

StepSecurity has extended its runtime security agent, Harden-Runner, to support GitHub Actions workflows executed on AWS CodeBuild-hosted ephemeral runners. Starting across releases v2.20.1 and v2.21.0, the integration covers both standard EC2 compute and custom Linux container images running within AWS CodeBuild. The agent inspects process executions, monitors file integrity, and tracks outbound network egress in real time, alerting on or actively blocking suspicious activities such as memory dumping and credential exfiltration directly at the runner layer. This development directly addresses a high-stakes blind spot in hybrid CI/CD architectures. When organizations route GitHub Actions jobs to AWS CodeBuild, runner instances execute within the company’s internal VPC and inherit associated AWS IAM service roles. While this enables seamless access to internal VPC resources and avoids GitHub-hosted runner billing caps, a compromised third-party Action or malicious pull request can access long-lived AWS privileges or internal services rather than merely repository-scoped secrets. Providing endpoint-detection-and-response style visibility directly inside CodeBuild environments ensures that pipeline execution does not become an ungoverned pivot point for lateral movement. The update fits into a broader industry-wide movement toward zero-trust CI/CD and immutable build environments. Software supply chain compromises—such as memory-dump attacks and ecosystem-wide credential sweeps—have highlighted that static workflow configurations and build-time scans are no longer sufficient to ensure pipeline safety. As major cloud providers allow deeper federation between version control platforms and cloud compute, security boundaries are shifting from static perimeter firewalls to continuous runtime behavior auditing on ephemeral worker nodes. In practice, platform teams adopting CodeBuild-backed runners must evaluate specific configuration requirements. To enable Harden-Runner's kernel-level inspection, CodeBuild projects must be configured with host kernel version 6 (kernel-6) and run in privileged mode at the AWS project level. Once configured, engineering teams can insert the standard Harden-Runner GitHub Action step at the start of their existing workflow YAML files without re-architecting buildspecs or changing webhook event handlers. Teams should begin in audit mode to establish automated network and process baselines before enforcing strict egress blocking policies in production deployment pipelines.