actions-marketplace-validations/Deploy Docker to AWS (EC2)
Deploy a Docker app to an AWS Virtual Machine (EC2) with Docker Compose
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Jan 6, 2026
- License
- MIT
Pinned Snippet
uses: actions-marketplace-validations/bitovi_github-actions-deploy-docker-to-ec2@fa96354cf831d960451f41b8bc0e834e6e4b64b0 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| aws_access_key_id | AWS access key ID | no | — |
| aws_secret_access_key | AWS secret access key | no | — |
| aws_session_token | AWS session token | no | — |
| aws_default_region | AWS default region | no | us-east-1 |
| aws_resource_identifier | Set to override the AWS resource identifier for the deployment. Defaults to `${org}-{repo}-{branch}`. Use with destroy to destroy specific resources. | no | — |
| aws_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| checkout | Specifies if this action should checkout the code | no | true |
| bitops_code_only | Will run only the generation phase of BitOps, where the Terraform and Ansible code is built. | no | — |
| bitops_code_store | Store BitOps code as a GitHub artifact | no | — |
| tf_stack_destroy | Set to "true" to Destroy the stack through Terraform. | no | — |
| tf_state_file_name | Change this to be anything you want to. Carefull to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. | no | — |
| tf_state_file_name_append | Append a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. Can co-exist with the tf_state_file_name variable. | no | — |
| tf_state_bucket | AWS S3 bucket to use for Terraform state. Defaults to `${org}-${repo}-{branch}-tf-state` | no | — |
| tf_state_bucket_destroy | Force purge and deletion of S3 bucket defined. Only evaluated when `tf_stack_destroy` is also true, so it is safe to leave this enabled when standing up your stack. | no | — |
| tf_targets | A list of targets to create before the full stack creation. | no | — |
| ansible_skip | Skip Ansible execution after Terraform excecution. | no | — |
| ansible_ssh_to_private_ip | Make Ansible connect to the private IP of the instance. Only usefull if using a hosted runner in the same network. | no | — |
| ansible_start_docker_timeout | Ammount of time in seconds it takes Ansible to mark as failed the startup of docker. Defaults to `300` | no | — |
| env_aws_secret | Secret name to pull env variables from AWS Secret Manager, could be a comma separated list, read in order. Expected JSON content. | no | — |
| env_repo | File containing environment variables to be used with the app | no | — |
| env_ghs | GitHub Secret Name containing `.env` file style to be used with the app. | no | — |
| env_ghv | GitHub Variable Name containing `.env` file style to be used with the app. | no | — |
| aws_ec2_instance_create | Define if an EC2 instance should be created | no | true |
| aws_ec2_ami_filter | AWS AMI Filter string. Will be used to lookup for lates image based on the string. Defaults to `ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*`. | no | — |
| aws_ec2_ami_owner | Owner of AWS AMI image. This ensures the provider is the one we are looking for. Defaults to `099720109477`, Canonical (Ubuntu). | no | — |
| aws_ec2_ami_id | AWS AMI ID. Will default to lookup for latest image of the `aws_ec2_ami_filter` string. This will override `aws_ec2_ami_filter` lookup. | no | — |
| aws_ec2_ami_update | Set this to true if you want to recreate the EC2 instance if there is a newer version of the AMI. | no | — |
| aws_ec2_iam_instance_profile | The AWS IAM instance profile to use for the EC2 instance | no | — |
| aws_ec2_instance_type | The AWS Instance type | no | — |
| aws_ec2_instance_root_vol_size | Define the volume size (in GiB) for the root volume on the AWS Instance. | no | — |
| aws_ec2_instance_root_vol_preserve | Set this to true to avoid deletion of root volume on termination. Defaults to false. | no | — |
| aws_ec2_security_group_name | The name of the EC2 security group | no | — |
| aws_ec2_create_keypair_sm | Generates and manages a secret manager entry that contains the public and private keys created for the ec2 instance. | no | — |
| aws_ec2_instance_public_ip | Add a public IP to the instance or not. (Not an Elastic IP) | no | true |
| aws_ec2_port_list | List of ports to be enabled as an ingress rule in the EC2 SG, in a [xx,yy] format - Not the ELB | no | — |
| aws_ec2_user_data_file | Relative path in the repo for a user provided script to be executed with Terraform EC2 Instance creation. | no | — |
| aws_ec2_user_data_replace_on_change | If user_data file changes, instance will stop and start. Hence public IP will change. Defaults to true. | no | — |
| aws_ec2_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_vpc_create | Define if a VPC should be created | no | — |
| aws_vpc_name | Set a specific name for the VPC | no | — |
| aws_vpc_cidr_block | Define Base CIDR block which is divided into subnet CIDR blocks. Defaults to 10.0.0.0/16. | no | — |
| aws_vpc_public_subnets | Comma separated list of public subnets. Defaults to 10.10.110.0/24 | no | — |
| aws_vpc_private_subnets | Comma separated list of private subnets. If none, none will be created. | no | — |
| aws_vpc_availability_zones | Comma separated list of availability zones. Defaults to `aws_default_region. | no | — |
| aws_vpc_id | AWS VPC ID. Accepts `vpc-###` values. | no | — |
| aws_vpc_subnet_id | Specify a Subnet to be used with the instance. If none provided, will pick one. | no | — |
| aws_vpc_enable_nat_gateway | Enables NAT gateway | no | — |
| aws_vpc_single_nat_gateway | Creates only one NAT gateway | no | — |
| aws_vpc_external_nat_ip_ids | Comma separated list of IP IDS to reuse in the NAT gateways | no | — |
| aws_vpc_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_r53_enable | Enables the usage of Route53 to manage DNS records. | no | — |
| aws_r53_domain_name | Define the root domain name for the application. e.g. app.com | no | — |
| aws_r53_sub_domain_name | Define the sub-domain part of the URL. Defaults to `${org}-${repo}-{branch}` | — | — |
| aws_r53_root_domain_deploy | Deploy to root domain. Will generate two DNS recrods, one for root, another for www | no | — |
| aws_r53_enable_cert | Makes the application use a certificate by enabling a certificate lookup. | no | true |
| aws_r53_cert_arn | Define the certificate ARN to use for the application | no | — |
| aws_r53_create_root_cert | Generates and manage the root cert for the application | no | — |
| aws_r53_create_sub_cert | Generates and manage the sub-domain certificate for the application | no | — |
| aws_r53_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_elb_create | Create a load balancer and map ports to the EC2 instance. | no | true |
| aws_elb_security_group_name | The name of the ELB security group | no | — |
| aws_elb_app_port | Port to expose for the app | no | 3000 |
| aws_elb_app_protocol | Protocol to enable. Could be HTTP, HTTPS, TCP or SSL. Defaults to TCP. | no | — |
| aws_elb_listen_port | Load balancer listening port. Defaults to 80 if NO FQDN provided, 443 if FQDN provided | no | — |
| aws_elb_listen_protocol | Protocol to enable. Could be HTTP, HTTPS, TCP or SSL. Defaults to TCP if NO FQDN provided, SSL if FQDN provided | no | — |
| aws_elb_healthcheck | Load balancer health check string. Defaults to TCP:22 | no | — |
| aws_elb_access_log_bucket_name | S3 bucket name to store the ELB access logs. | no | — |
| aws_elb_access_log_expire | Delete the access logs after this amount of days. Defaults to 90. | no | — |
| aws_elb_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_alb_create | Global toggle for ALB creation | no | — |
| aws_alb_security_group_name | Name of the security group to use for ALB | no | — |
| aws_alb_app_port | Comma-separated list of application ports for ALB target group | no | — |
| aws_alb_app_protocol | Comma-separated list of protocols for ALB target group (HTTP/HTTPS) | no | — |
| aws_alb_listen_port | Comma-separated list of listener ports for ALB | no | — |
| aws_alb_listen_protocol | Comma-separated list of listener protocols for ALB (HTTP/HTTPS) | no | — |
| aws_alb_redirect_enable | Enable HTTP to HTTPS redirection on ALB | no | — |
| aws_alb_www_to_apex_redirect | Enable www to apex domain redirection on ALB | no | — |
| aws_alb_healthcheck_path | Health check path for ALB target group | no | — |
| aws_alb_healthcheck_protocol | Health check protocol for ALB target group | no | — |
| aws_alb_ssl_policy | SSL policy for HTTPS listeners | no | — |
| aws_alb_access_log_enabled | Enable ALB access logs | no | — |
| aws_alb_access_log_bucket_name | S3 bucket name to store the ALB access logs | no | — |
| aws_alb_access_log_expire | Delete the access logs after this amount of days | no | — |
| aws_alb_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_waf_enable | Enable WAF for load balancer. | no | — |
| aws_waf_logging_enable | Enable WAF logging to CloudWatch. | no | — |
| aws_waf_log_retention_days | CloudWatch log retention period for WAF logs. | no | — |
| aws_waf_rule_rate_limit | Rate limit for WAF rules. | no | — |
| aws_waf_rule_rate_limit_priority | Priority for rate limit rule. | no | — |
| aws_waf_rule_managed_rules | Enable common managed rule groups to use. | no | — |
| aws_waf_rule_managed_rules_priority | Priority for managed rules group. | no | — |
| aws_waf_rule_managed_bad_inputs | Enable managed rule for bad inputs. | no | — |
| aws_waf_rule_managed_bad_inputs_priority | Priority for bad inputs managed rule. | no | — |
| aws_waf_rule_ip_reputation | Enable managed rule for IP reputation. | no | — |
| aws_waf_rule_ip_reputation_priority | Priority for IP reputation managed rule. | no | — |
| aws_waf_rule_anonymous_ip | Enable managed rule for anonymous IP. | no | — |
| aws_waf_rule_anonymous_ip_priority | Priority for anonymous IP managed rule. | no | — |
| aws_waf_rule_bot_control | Enable managed rule for bot control (costs extra). | no | — |
| aws_waf_rule_bot_control_priority | Priority for bot control managed rule. | no | — |
| aws_waf_rule_geo_block_countries | Comma separated list of countries to block. | no | — |
| aws_waf_rule_geo_block_countries_priority | Priority for geo block countries managed rule. | no | — |
| aws_waf_rule_geo_allow_only_countries | Comma separated list of countries to allow. | no | — |
| aws_waf_rule_geo_allow_only_countries_priority | Priority for geo allow only countries managed rule. | no | — |
| aws_waf_rule_sqli | Enable managed rule for SQL injection. | no | — |
| aws_waf_rule_sqli_priority | Priority for SQL injection managed rule. | no | — |
| aws_waf_rule_linux | Enable managed rule for Linux. | no | — |
| aws_waf_rule_linux_priority | Priority for Linux managed rule. | no | — |
| aws_waf_rule_unix | Enable managed rule for Unix. | no | — |
| aws_waf_rule_unix_priority | Priority for Unix managed rule. | no | — |
| aws_waf_rule_admin_protection | Enable managed rule for admin protection. | no | — |
| aws_waf_rule_admin_protection_priority | Priority for admin protection managed rule. | no | — |
| aws_waf_rule_user_arn | ARN of the user rule. | no | — |
| aws_waf_rule_user_arn_priority | Priority for user defined rule. | no | — |
| aws_waf_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| docker_install | Define if docker should be installed. After this, docker-compose up will be excecuted. | no | true |
| docker_remove_orphans | Toggle --remove-orphans flag. Defaults to false. | no | — |
| docker_full_cleanup | Set to true to run docker-compose down and docker system prune --all --force --volumes after. | no | — |
| docker_repo_app_directory | Relative path for the directory of the app (i.e. where `Dockerfile` and `docker-compose.yaml` files are located). This is the directory that is copied to the compute instance (EC2). Default is the root of the repo. Add a .gha-ignore file with a list of files to be exluded. | no | — |
| docker_repo_app_directory_cleanup | Will generate a timestamped compressed file and delete the app repo directory. | no | — |
| docker_backup_retention | Number of old backups to retain. Default is unlimited. | no | — |
| docker_efs_mount_target | Directory path within docker env to mount directory to, default is `/data` | no | — |
| docker_cloudwatch_enable | Toggle cloudwatch creation for Docker containers. | no | — |
| docker_cloudwatch_lg_name | Log group name. Will default to aws_identifier if none. | no | — |
| docker_cloudwatch_skip_destroy | Toggle deletion or not when destroying the stack. | no | — |
| docker_cloudwatch_retention_days | Number of days to retain logs. 0 to never expire. | no | — |
| aws_efs_create | Toggle to indicate whether to create and EFS and mount it to the ec2 as a part of the provisioning. Note: The EFS will be managed by the stack and will be destroyed along with the stack. | no | — |
| aws_efs_fs_id | ID of existing EFS | no | — |
| aws_efs_create_mount_target | Toggle to indicate whether we should create a mount target for the EFS volume. Accepts incoming fs_id with no mount targets too. | no | — |
| aws_efs_create_ha | Toggle to indicate whether the EFS resource should be highly available (mount points in all available zones within region). | no | — |
| aws_efs_vol_encrypted | Toggle encryption of the EFS volume. | no | — |
| aws_efs_kms_key_id | The ARN for the KMS encryption key. Default key will be used if none defined. | no | — |
| aws_efs_performance_mode | Toggle perfomance mode. Options are: generalPurpose or maxIO. | no | — |
| aws_efs_throughput_mode | Throughput mode for the file system. Defaults to bursting. Valid values: bursting, provisioned, or elastic. When using provisioned, also set provisioned_throughput_in_mibps. | no | — |
| aws_efs_throughput_speed | The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with throughput_mode set to provisioned. | no | — |
| aws_efs_security_group_name | The name of the EFS security group. Defaults to SG for aws_resource_identifier - EFS. | no | — |
| aws_efs_allowed_security_groups | Comma separated list of security groups to be added to the EFS SG. | no | — |
| aws_efs_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | — |
| aws_efs_create_replica | Toggle to indiciate whether a read-only replica should be created for the EFS primary file system | no | — |
| aws_efs_replication_destination | AWS Region to target for replication | no | — |
| aws_efs_enable_backup_policy | Toggle to indiciate whether the EFS should have a backup policy, default is `false` | no | — |
| aws_efs_transition_to_inactive | https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system#transition_to_ia | no | — |
| aws_efs_mount_target | Directory path in efs to mount to | no | — |
| aws_efs_ec2_mount_point | Directory path in application env to mount directory | no | — |
| aws_efs_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_rds_db_enable | Set to true to enable an RDS DB. | no | — |
| aws_rds_db_proxy | Set to true to add a RDS DB Proxy | no | — |
| aws_rds_db_identifier | Database identifier that will appear in the AWS Console. Defaults to aws_resource_identifier if none set. | no | — |
| aws_rds_db_name | The name of the database to create when the DB instance is created. | no | — |
| aws_rds_db_user | Username for the db. Defaults to dbuser. | no | — |
| aws_rds_db_engine | Which Database engine to use. Default is postgres | no | — |
| aws_rds_db_engine_version | Which Database engine version to use. | no | — |
| aws_rds_db_ca_cert_identifier | Certificate to use with the database. Defaults to rds-ca-ecc384-g1 | no | — |
| aws_rds_db_security_group_name | The name of the database security group. Defaults to SG for aws_resource_identifier - RDS. | no | — |
| aws_rds_db_allowed_security_groups | Comma separated list of security groups to add to the DB SG | no | — |
| aws_rds_db_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | — |
| aws_rds_db_publicly_accessible | Allow the database to be publicly accessible. | no | — |
| aws_rds_db_port | Port where the DB listens to. | no | — |
| aws_rds_db_subnets | Specify which subnets to use as a list of strings. | no | — |
| aws_rds_db_allocated_storage | Storage size. Defaults to 10. | no | — |
| aws_rds_db_max_allocated_storage | Max storage size. Defaults to 0 to disable auto-scaling. | no | — |
| aws_rds_db_instance_class | DB instance server type. Defaults to db.t3.micro. | no | — |
| aws_rds_db_storage_encrypted | Toogle storage encryption. Defatuls to false. | no | — |
| aws_rds_db_storage_type | Storage type. Like gp2 / gp3. Defaults to gp2. | no | — |
| aws_rds_db_kms_key_id | The ARN for the KMS encryption key. | no | — |
| aws_rds_db_final_snapshot | Generates a snapshot of the database before deletion. | no | — |
| aws_rds_db_restore_snapshot_identifier | Name of the snapshot to restore the database from. | no | — |
| aws_rds_db_cloudwatch_logs_exports | Set of log types to enable for exporting to CloudWatch logs. | no | — |
| aws_rds_db_multi_az | Specifies if the RDS instance is multi-AZ | no | — |
| aws_rds_db_maintenance_window | The window to perform maintenance in. Eg: Mon:00:00-Mon:03:00 | no | — |
| aws_rds_db_apply_immediately | Specifies whether any database modifications are applied immediately, or during the next maintenance window | no | — |
| aws_rds_db_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_db_proxy_name | DB Proxy name | no | — |
| aws_db_proxy_client_password_auth_type | Auth type to use, will use the following, depending on DB the family. MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, and SQL_SERVER_AUTHENTICATION | no | — |
| aws_db_proxy_tls | Toogle TLS enforcement for connection | no | — |
| aws_db_proxy_security_group_name | Name for the proxy security group. Default to aws_resource_identifier if none. | no | — |
| aws_db_proxy_database_security_group_allow | Will add an incoming rule from every security group associated with the DB | no | — |
| aws_db_proxy_allowed_security_group | Comma separated list of SG Ids to add. | no | — |
| aws_db_proxy_allow_all_incoming | Allow all incoming traffic to the DB Proxy. Mind that the proxy is only available from the internal network except manually exposed. | no | — |
| aws_db_proxy_cloudwatch_enable | Toggle Cloudwatch logs. Will be stored in /aws/rds/proxy/rds_proxy.name | no | — |
| aws_db_proxy_cloudwatch_retention_days | Number of days to retain logs | no | — |
| aws_db_proxy_additional_tags | A list of strings that will be added to created resources | no | — |
| gh_deployment_input_terraform | Folder to store Terraform files to be included during Terraform execution. | no | — |
| gh_deployment_input_ansible | Folder where a whole Ansible structure is expected. If missing bitops.config.yaml a default will be generated. | no | — |
| gh_deployment_input_ansible_playbook | Main playbook to be looked for. | no | playbook.yml |
| gh_deployment_input_ansible_extra_vars_file | Relative path to file from project root to Ansible vars file to be applied. | no | — |
| gh_deployment_action_input_ansible_extra_vars_file | Relative path to file from project root to Ansible vars file to be applied into the Action Ansible execution. | no | — |
| aws_ami_id | — | no | — |
| repo_env | — | no | — |
| dot_env | — | no | — |
| ghv_env | — | no | — |
| aws_secret_env | — | no | — |
| app_directory | — | no | — |
| app_directory_cleanup | — | no | — |
| app_port | — | no | — |
| lb_port | — | no | — |
| lb_healthcheck | — | no | — |
| ec2_instance_profile | — | no | — |
| ec2_instance_type | — | no | — |
| ec2_volume_size | — | no | — |
| aws_create_efs | — | no | — |
| aws_create_ha_efs | — | no | — |
| aws_create_efs_replica | — | no | — |
| aws_enable_efs_backup_policy | — | no | — |
| aws_replication_configuration_destination | — | no | — |
| aws_mount_efs_id | — | no | — |
| aws_mount_efs_security_group_id | — | no | — |
| stack_destroy | — | no | — |
| domain_name | — | no | — |
| sub_domain | — | no | — |
| root_domain | — | no | — |
| cert_arn | — | no | — |
| create_root_cert | — | no | — |
| create_sub_cert | — | no | — |
| no_cert | — | no | — |
| targets | — | no | — |
| additional_tags | — | no | — |
| create_keypair_sm_entry | — | no | — |
| aws_enable_postgres | — | no | — |
| aws_postgres_engine | — | no | — |
| aws_postgres_engine_version | — | no | — |
| aws_postgres_instance_class | — | no | — |
| aws_postgres_subnets | — | no | — |
| aws_postgres_database_name | — | no | — |
| aws_postgres_database_port | — | no | — |
| aws_postgres_database_final_snapshot | — | no | — |
| application_mount_target | — | no | — |
| data_mount_target | — | no | — |
| efs_mount_target | — | no | — |
Outputs
| name | description |
|---|---|
| aws_vpc_id | The selected VPC ID used. |
| vm_url | The URL of the generated app |
| instance_endpoint | The URL of the generated ec2 instance |
| ec2_sg_id | SG ID for the EC2 instance |
| aws_efs_fs_id | EFS FS ID |
| aws_efs_replica_fs_id | EFS FS Replica ID |
| aws_efs_sg_id | EFS FS SG ID |
| db_endpoint | RDS Endpoint |
| db_secret_details_name | AWS Secret name containing db credentials |
| db_sg_id | SG ID for the RDS instance |
| db_proxy_rds_endpoint | Database proxy endpoint |
| db_proxy_secret_name_rds | AWS Secret name containing proxy credentials |
| db_proxy_sg_id_rds | SG ID for the RDS Proxy instance |