Skip to content

Commit c58a145

Browse files
chrisshipletchrisshiplet
authored
Merge branch 'main' into use-tagged-rds-module
2 parents e7ab035 + bc68407 commit c58a145

13 files changed

+238
-12
lines changed

‎.github/workflows/documentation.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Generate terraform docs
2+
on:
3+
workflow_call:
4+
5+
jobs:
6+
docs:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
with:
11+
ref: ${{ github.event.pull_request.head.ref }}
12+
13+
- name: Render terraform docs inside the README.md and push changes back to PR branch
14+
uses: terraform-docs/[email protected]
15+
with:
16+
working-dir: .
17+
output-file: README.md
18+
output-method: inject
19+
git-push: "true"

‎.github/workflows/terraform.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: "Terraform"
2+
on:
3+
pull_request:
4+
branches:
5+
- "*"
6+
- "*/*"
7+
- "**"
8+
9+
jobs:
10+
terraform-format-test:
11+
uses: ./.github/workflows/terraform_format.yml
12+
tfsec-pr-commenter:
13+
uses: ./.github/workflows/tfsec_pr_commenter.yml
14+
terraform-docs:
15+
needs: [terraform-format-test, tfsec-pr-commenter]
16+
uses: ./.github/workflows/documentation.yml

‎.github/workflows/terraform_format.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: "Terraform Format Check"
2+
on:
3+
workflow_call:
4+
5+
jobs:
6+
terraform:
7+
name: "Terraform Format Check"
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Checkout
12+
uses: actions/checkout@v2
13+
14+
- name: test
15+
run: pwd
16+
17+
- name: Setup Terraform
18+
uses: hashicorp/setup-terraform@v1
19+
with:
20+
terraform_version: 1.3.7
21+
22+
- name: Terraform Format
23+
id: fmt
24+
run: terraform fmt -check

‎.github/workflows/tfsec_pr_commenter.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: tfsec-pr-commenter
2+
on:
3+
workflow_call:
4+
jobs:
5+
tfsec:
6+
name: tfsec PR commenter
7+
runs-on: ubuntu-latest
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
steps:
14+
- name: Clone repo
15+
uses: actions/checkout@master
16+
- name: tfsec
17+
uses: aquasecurity/[email protected]
18+
with:
19+
tfsec_args: --soft-fail
20+
working_directory: "" # Workaround for PR https://github.com/aquasecurity/tfsec-pr-commenter-action/issues/90
21+
github_token: ${{ github.token }}

‎.gitignore

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
11+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
12+
# .tfvars files are managed as part of configuration and so should be included in
13+
# version control.
14+
#
15+
# example.tfvars
16+
17+
# Ignore override files as they are usually used to override resources locally and so
18+
# are not checked in
19+
override.tf
20+
override.tf.json
21+
*_override.tf
22+
*_override.tf.json
23+
24+
# Include override files you do wish to add to version control using negated pattern
25+
#
26+
# !example_override.tf
27+
28+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
29+
# example: *tfplan*

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2023 Synapse Studios
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 77 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,79 @@
11
# terraform-aws-ecs-service
22

3-
This is a highly-opinionated ECS Service module for the Synapse Platform. It currently does NOT support blue-green deploys, autoscaling, customizing container sizes, or sidecar containers. It is also overly restrictive with the task role permissions.
3+
This is a highly-opinionated ECS Service module for the Synapse Platform. It currently does NOT support blue-green deploys, autoscaling, customizing container sizes, or sidecar containers. It is also overly restrictive with the task role permissions.
4+
5+
# Known Issues:
6+
7+
Currently we're aware of a bug occurring when trying to change container ports. If you change the container port, the service will not be able to start up due to an association bug between the load balancer target group health check and the ECS service. To correctly update the container port, you must first destroy the service, then update the container port, then re-create the service manually. This is a known issue with Terraform and AWS.
8+
9+
You can do this by commenting out the entire module, running a terraform apply, then uncommenting the module and running a terraform apply again after you've updated the container port.
10+
11+
<!-- BEGIN_TF_DOCS -->
12+
## Requirements
13+
14+
| Name | Version |
15+
|------|---------|
16+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
17+
18+
## Providers
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
23+
24+
## Modules
25+
26+
| Name | Source | Version |
27+
|------|--------|---------|
28+
| <a name="module_database"></a> [database](#module\_database) | git::https://github.com/synapsestudios/terraform-aws-rds-aurora-cluster.git | v0.0.7 |
29+
| <a name="module_service_container_definition"></a> [service\_container\_definition](#module\_service\_container\_definition) | cloudposse/ecs-container-definition/aws | 0.58.1 |
30+
31+
## Resources
32+
33+
| Name | Type |
34+
|------|------|
35+
| [aws_cloudwatch_log_group.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
36+
| [aws_ecs_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
37+
| [aws_ecs_task_definition.service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource |
38+
| [aws_iam_role.ecs_task_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
39+
| [aws_iam_role.ecs_task_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
40+
| [aws_iam_role_policy_attachment.cognito](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
41+
| [aws_iam_role_policy_attachment.ecs_task_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
42+
| [aws_iam_role_policy_attachment.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
43+
| [aws_iam_role_policy_attachment.secrets_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
44+
| [aws_iam_role_policy_attachment.ses](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
45+
| [aws_lb_listener_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener_rule) | resource |
46+
| [aws_lb_target_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
47+
| [aws_security_group.ecs_task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
48+
| [aws_security_group_rule.ecs_task_alb_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
49+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
50+
| [aws_iam_policy_document.assume_ecs_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
51+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
52+
53+
## Inputs
54+
55+
| Name | Description | Type | Default | Required |
56+
|------|-------------|------|---------|:--------:|
57+
| <a name="input_alb_security_group_id"></a> [alb\_security\_group\_id](#input\_alb\_security\_group\_id) | Security Group ID for the ALB | `string` | n/a | yes |
58+
| <a name="input_azs"></a> [azs](#input\_azs) | Availability zones | `list(string)` | n/a | yes |
59+
| <a name="input_cluster_arn"></a> [cluster\_arn](#input\_cluster\_arn) | ECS cluster to deploy into | `string` | n/a | yes |
60+
| <a name="input_command"></a> [command](#input\_command) | Container startup command | `list(string)` | n/a | yes |
61+
| <a name="input_container_port"></a> [container\_port](#input\_container\_port) | Port exposed by the container | `number` | n/a | yes |
62+
| <a name="input_container_secrets"></a> [container\_secrets](#input\_container\_secrets) | The Secrets to Pass to the container. | <pre>list(object({<br> name = string<br> valueFrom = string<br> }))</pre> | `[]` | no |
63+
| <a name="input_ecr_host"></a> [ecr\_host](#input\_ecr\_host) | Hostname of the ECR repository with no trailing slash | `string` | n/a | yes |
64+
| <a name="input_ecs_desired_count"></a> [ecs\_desired\_count](#input\_ecs\_desired\_count) | How many tasks to launch in ECS service | `number` | `1` | no |
65+
| <a name="input_environment_variables"></a> [environment\_variables](#input\_environment\_variables) | The environment variables to pass to the container. This is a list of maps. | <pre>list(object({<br> name = string<br> value = string<br> }))</pre> | `[]` | no |
66+
| <a name="input_health_check_path"></a> [health\_check\_path](#input\_health\_check\_path) | Path to use for health checks | `string` | n/a | yes |
67+
| <a name="input_host_port"></a> [host\_port](#input\_host\_port) | Port exposed by the host | `number` | `null` | no |
68+
| <a name="input_hostname"></a> [hostname](#input\_hostname) | Hostname to use for listener rule | `string` | n/a | yes |
69+
| <a name="input_listener_arn"></a> [listener\_arn](#input\_listener\_arn) | ALB listener ARN to add listener rule to | `string` | n/a | yes |
70+
| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | Service directory in the application git repo | `string` | n/a | yes |
71+
| <a name="input_subnets"></a> [subnets](#input\_subnets) | List of subnet names the service will reside on. | `list(string)` | n/a | yes |
72+
| <a name="input_use_database_cluster"></a> [use\_database\_cluster](#input\_use\_database\_cluster) | Whether or not we should create a DB cluster and inject the database connection string into the container | `bool` | n/a | yes |
73+
| <a name="input_use_hostname"></a> [use\_hostname](#input\_use\_hostname) | Whether or not we should create a target group and listener to attach this service to a load balancer | `bool` | n/a | yes |
74+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC to deploy into | `string` | n/a | yes |
75+
76+
## Outputs
77+
78+
No outputs.
79+
<!-- END_TF_DOCS -->

‎alb_target_group.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ resource "aws_lb_target_group" "this" {
77
vpc_id = var.vpc_id
88
# tags = var.tags # TODO
99

10+
lifecycle {
11+
create_before_destroy = true
12+
}
13+
1014
health_check {
1115
enabled = true
1216
interval = 5
@@ -39,4 +43,4 @@ resource "aws_lb_listener_rule" "this" {
3943
values = [var.hostname]
4044
}
4145
}
42-
}
46+
}

‎db.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ module "database" {
88
name = "backend"
99
vpc_id = var.vpc_id
1010
database_name = "backend"
11-
}
11+
}

‎ecs_service.tf

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ resource "aws_ecs_service" "this" {
2828
]
2929
}
3030

31-
deployment_controller {
32-
type = "ECS"
31+
deployment_circuit_breaker {
32+
enable = true
33+
rollback = true
3334
}
34-
}
35+
}

‎ecs_task_definitions.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ module "service_container_definition" {
2121
version = "0.58.1"
2222

2323
container_name = var.service_name
24-
container_image = "${var.ecr_host}/${var.service_name}:60"
24+
container_image = "${var.ecr_host}/${var.service_name}:latest"
2525
container_memory = 2048
2626
essential = true
2727
environment = var.environment_variables
28-
port_mappings = [{ hostPort = var.container_port, containerPort = var.container_port, protocol = "tcp" }]
28+
port_mappings = var.host_port != null ? [{ hostPort = var.host_port, containerPort = var.container_port, protocol = "tcp" }] : [{ hostPort = var.container_port, containerPort = var.container_port, protocol = "tcp" }]
2929
command = var.command
3030
secrets = var.use_database_cluster ? concat([{
3131
name = "DATABASE_URL"
@@ -41,4 +41,4 @@ module "service_container_definition" {
4141
awslogs-stream-prefix = "ecs"
4242
}
4343
}
44-
}
44+
}

‎main.tf

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,11 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = ">= 4.0"
6+
}
7+
}
8+
}
9+
110
data "aws_caller_identity" "current" {}
2-
data "aws_region" "current" {}
11+
data "aws_region" "current" {}

‎variables.tf

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ variable "container_port" {
7171
description = "Port exposed by the container"
7272
}
7373

74+
variable "host_port" {
75+
type = number
76+
description = "Port exposed by the host"
77+
default = null
78+
}
79+
7480
variable "health_check_path" {
7581
type = string
7682
description = "Path to use for health checks"
@@ -82,12 +88,12 @@ variable "use_database_cluster" {
8288
}
8389

8490
variable "use_hostname" {
85-
type = bool
91+
type = bool
8692
description = "Whether or not we should create a target group and listener to attach this service to a load balancer"
8793
}
8894

8995
variable "ecs_desired_count" {
9096
type = number
9197
default = 1
9298
description = "How many tasks to launch in ECS service"
93-
}
99+
}

0 commit comments

Comments
 (0)