Skip to content

Commit eb19c90

Browse files
tobbietobbie
authored
Merge pull request #3 from tobbie/add-ecs-fargate
Add ecs-with-fargate project
2 parents ea0458b + 008ef5b commit eb19c90

File tree

18 files changed

+499
-9
lines changed

18 files changed

+499
-9
lines changed

‎.github/workflows/deploy.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,11 @@ jobs:
3636
docker compose run --rm terraform -chdir=network/ init
3737
docker compose run --rm terraform -chdir=network/ workspace select -or-create $workspace
3838
docker compose run --rm terraform -chdir=network/ apply --auto-approve
39+
docker compose run --rm terraform -chdir=ecs-with-fargate/ init
40+
docker compose run --rm terraform -chdir=ecs-with-fargate/ workspace select -or-create $workspace
41+
docker compose run --rm terraform -chdir=ecs-with-fargate/ plan
42+
# docker compose run --rm terraform -chdir=ecs-with-fargate/ apply --auto-approve
43+
3944

4045

4146

‎.github/workflows/destroy.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ jobs:
2525
export TF_WORKSPACE=${{ github.event.inputs.environment }}
2626
docker compose run --rm terraform -chdir=network/ init
2727
docker compose run --rm terraform -chdir=network/ destroy --auto-approve
28+
docker compose run --rm terraform -chdir=ecs-with-fargate/ init
29+
docker compose run --rm terraform -chdir=ecs-with-fargate/ destroy --auto-approve
2830
2931
3032

‎.github/workflows/test-and-lint.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,14 @@ jobs:
2424
- name: Run terraform checks
2525
run: |
2626
docker compose run --rm terraform -chdir=setup/ init -backend=false
27-
docker compose run --rm terraform -chdir=setup/ validate
2827
docker compose run --rm terraform -chdir=setup/ fmt -check
28+
docker compose run --rm terraform -chdir=setup/ validate
2929
docker compose run --rm terraform -chdir=network/ init -backend=false
30-
docker compose run --rm terraform -chdir=network/ validate
3130
docker compose run --rm terraform -chdir=network/ fmt -check
31+
docker compose run --rm terraform -chdir=network/ validate
32+
docker compose run --rm terraform -chdir=ecs-with-fargate/ init -backend=false
33+
docker compose run --rm terraform -chdir=ecs-with-fargate/ fmt -check
34+
docker compose run --rm terraform -chdir=ecs-with-fargate/ validate
35+
3236
3337

‎docker-compose.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,13 @@ services:
44
volumes:
55
- ./setup:/tf/setup
66
- ./network:/tf/network
7+
- ./ecs-with-fargate:/tf/ecs-with-fargate
78

89
working_dir: /tf # all commands will run from /tf in the container
910
environment:
1011
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
1112
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
1213
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
13-
- AWS_DEFAULT_REGION=us-east-1
14+
- AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION}
1415
- TF_WORKSPACE=${TF_WORKSPACE}
1516

‎ecs-with-fargate/.terraform.lock.hcl‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ecs-with-fargate/README.md‎

Whitespace-only changes.

‎ecs-with-fargate/acm.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
module "acm" {
2+
source = "terraform-aws-modules/acm/aws"
3+
version = "5.1.0"
4+
5+
domain_name = trimsuffix(data.aws_route53_zone.mydomain.name, ".") # trimsiffix added to handle cases here the domain name is a private one.
6+
zone_id = data.aws_route53_zone.mydomain.zone_id
7+
8+
9+
subject_alternative_names = [
10+
"*.${terraform.workspace}.${var.domain}"
11+
]
12+
13+
validation_method = "DNS"
14+
wait_for_validation = true
15+
16+
tags = {
17+
Name = "${terraform.workspace}.${var.domain}"
18+
}
19+
}

‎ecs-with-fargate/alb.tf‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
##########################################
2+
# Application Load Balancer #
3+
##########################################
4+
5+
module "alb" {
6+
source = "terraform-aws-modules/alb/aws"
7+
version = "~> 9.0"
8+
9+
name = "my-alb"
10+
vpc_id = data.terraform_remote_state.vpc.outputs.vpc_id
11+
subnets = data.terraform_remote_state.vpc.outputs.public_subnets
12+
enable_deletion_protection = false
13+
14+
# Security Groups
15+
security_group_ingress_rules = {
16+
all_http = {
17+
from_port = 80
18+
to_port = 80
19+
ip_protocol = "tcp"
20+
description = "HTTP web traffic"
21+
cidr_ipv4 = "0.0.0.0/0"
22+
}
23+
all_https = {
24+
from_port = 443
25+
to_port = 443
26+
ip_protocol = "tcp"
27+
description = "HTTPS web traffic"
28+
cidr_ipv4 = "0.0.0.0/0"
29+
}
30+
}
31+
32+
security_group_egress_rules = {
33+
all = {
34+
ip_protocol = "-1"
35+
cidr_ipv4 = data.terraform_remote_state.vpc.outputs.vpc_cidr_block //only allow outbound traffic to vpc_cidr block only
36+
}
37+
}
38+
39+
40+
41+
listeners = {
42+
#HTTP Listener no longer needed. Uncomment for testing purpose
43+
# http = {
44+
# port = 80
45+
# protocol = "HTTP"
46+
47+
# forward = {
48+
# target_group_key = "ror-frontend-service"
49+
# }
50+
# }
51+
52+
#HTTPS Redirect Listener
53+
http-https-redirect = {
54+
port = 80
55+
protocol = "HTTP"
56+
redirect = {
57+
port = "443"
58+
protocol = "HTTPS"
59+
status_code = "HTTP_301"
60+
}
61+
}
62+
63+
#HTTPS Listener
64+
https = {
65+
port = 443
66+
protocol = "HTTPS"
67+
certificate_arn = module.acm.acm_certificate_arn
68+
69+
forward = {
70+
target_group_key = "ror-frontend-service"
71+
}
72+
}
73+
}
74+
75+
target_groups = {
76+
ror-frontend-service = {
77+
name_prefix = "tg1"
78+
backend_protocol = "HTTP"
79+
backend_port = local.container_port
80+
target_type = "ip"
81+
deregistration_delay = 5
82+
load_balancing_cross_zone_enabled = true
83+
84+
health_check = {
85+
enabled = true
86+
interval = 30
87+
path = "/"
88+
port = "traffic-port"
89+
healthy_threshold = 3
90+
unhealthy_threshold = 3
91+
timeout = 6
92+
protocol = "HTTP"
93+
matcher = "200-399"
94+
}
95+
96+
# There's nothing to attach here in this definition. Instead,
97+
# ECS will attach the IPs of the tasks to this target group
98+
create_attachment = false
99+
100+
}
101+
}
102+
103+
104+
}

‎ecs-with-fargate/data-sources.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Terraform newtwork remote state data source
2+
data "terraform_remote_state" "vpc" {
3+
backend = "s3"
4+
config = {
5+
bucket = "aws-infra-repo-tfstate-25"
6+
key = "env:/${local.workspace}/tf-state-network"
7+
region = "us-east-1"
8+
dynamodb_table = "aws-infra-repo-tf-lock"
9+
}
10+
}
11+
12+
# Provides the current AWS region
13+
data "aws_region" "current" {}
14+
15+
# Get DNS information from AWS Route53
16+
data "aws_route53_zone" "mydomain" {
17+
name = var.domain
18+
private_zone = false
19+
}
20+

‎ecs-with-fargate/ecs.tf‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
module "ecs" {
2+
source = "terraform-aws-modules/ecs/aws"
3+
4+
cluster_name = "rite-blend"
5+
6+
cluster_configuration = {
7+
execute_command_configuration = {
8+
logging = "OVERRIDE"
9+
log_configuration = {
10+
cloud_watch_log_group_name = "/aws/ecs/ecs-exec-group" # aws_cloudwatch_log_group.ecs_execute_command.name
11+
}
12+
}
13+
}
14+
15+
#Specify how fargate provisions serverless resources for your containers
16+
fargate_capacity_providers = {
17+
FARGATE = {
18+
default_capacity_provider_strategy = {
19+
base = 1
20+
weight = 60
21+
}
22+
}
23+
FARGATE_SPOT = {
24+
default_capacity_provider_strategy = {
25+
base = 0
26+
weight = 40
27+
}
28+
}
29+
}
30+
31+
32+
# Task execution IAM role policy
33+
# Automatically creates a task execution role that has default permission for ECS to access ECR, SSM
34+
create_task_exec_policy = true
35+
36+
37+
# Service Configuration
38+
services = {
39+
(local.service_name) = {
40+
cpu = 1024
41+
memory = 4096
42+
43+
assign_public_ip = true
44+
enable_execute_command = true
45+
46+
47+
# Container definition(s)
48+
container_definitions = {
49+
(local.container_name) = {
50+
cpu = 512
51+
memory = 2048
52+
essential = true
53+
image = "public.ecr.aws/aws-containers/ecsdemo-frontend:latest"
54+
55+
56+
port_mappings = [
57+
{
58+
name = local.container_name
59+
containerPort = local.container_port
60+
hostPort = local.container_port
61+
protocol = "tcp"
62+
}
63+
]
64+
65+
# Example image used requires access to write to root filesystem
66+
readonly_root_filesystem = false
67+
68+
#Allows terraform to manage the cloudwatch log group
69+
create_cloudwatch_log_group = true
70+
cloud_watch_log_group_name = "/aws/ecs/${local.service_name}/${local.container_name}"
71+
cloudwatch_log_group_retention = 7
72+
73+
74+
log_configuration = {
75+
logDriver = "awslogs"
76+
options = {
77+
awslogs-region = var.aws_region
78+
awslogs-group = "/aws/ecs/${local.service_name}/${local.container_name}"
79+
awslogs-stream-prefix = "ecs"
80+
81+
}
82+
}
83+
memory_reservation = 100
84+
85+
}
86+
}
87+
88+
# Connect ECS Service to Load Balancer
89+
load_balancer = {
90+
service = {
91+
target_group_arn = module.alb.target_groups["ror-frontend-service"].arn
92+
container_name = local.container_name
93+
container_port = local.container_port
94+
}
95+
}
96+
97+
98+
#Specify subnets to host ECS service and tasks
99+
subnet_ids = data.terraform_remote_state.vpc.outputs.public_subnets
100+
101+
#Specify ECS service security groups
102+
security_group_rules = {
103+
public_ingress_80 = {
104+
type = "ingress"
105+
from_port = local.container_port
106+
to_port = local.container_port
107+
protocol = "tcp"
108+
source_security_group_id = module.alb.security_group_id
109+
description = "Allow traffic from ALB SG only"
110+
}
111+
egress_all = {
112+
type = "egress"
113+
from_port = 0
114+
to_port = 0
115+
protocol = "-1"
116+
cidr_blocks = ["0.0.0.0/0"]
117+
}
118+
}
119+
}
120+
}
121+
122+
123+
# TODO
124+
# - Create Task Execution Role -- to allow ECS access other AWS services it requires to create the task.
125+
# E.g accessing SSM parameter store for secrets to be injected when creating tasks for containers
126+
# - Create Task Role -- to allow running containers access other aws services- e.g container needs access to S3.
127+
}
128+
129+

0 commit comments

Comments
 (0)