npalm / terraform-aws-ecs-service

Terraform module to create ECS / FARGATE services

AWS Terraform module to create Fargate / ECS service

This modules creates a Fargate or ECS service optionally with a application load balancer.

• Supports network modes: "awsvpc" and "bridge"
• Supports ECS and FARGATE
• Optionally a ALB can be created. (HTTP or HTTPS)

Example usages:

Below an example for deloy a service to Fargate. See the test directroy for more and complete examples.

All variables prefix with:

• awsvpc : should only be required in case of network mode awsvpc (FARGATE as well).
• lb : should only be required in case enable_lb is set to true.

resource "aws_security_group" "awsvpc_sg" {
  name   = "${var.environment}-awsvpc-cluster-sg"
  vpc_id = "${module.vpc.vpc_id}"

  ingress {
    protocol  = "tcp"
    from_port = 0
    to_port   = 65535

    cidr_blocks = [
      "${module.vpc.vpc_cidr}",
    ]
  }

  egress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags {
    Name        = "${var.environment}-ecs-cluster-sg"
    Environment = "${var.environment}"
  }
}

locals {
  container_name = "blog"
  container_port = "80"
}

data "template_file" "blog" {
  template = <<EOF
  [
    {
      "essential": true,
      "memoryReservation": null,
      "image": "npalm/040code.github.io:latest",
      "name": "${container_name}",
      "portMappings": [
        {
          "hostPort": ${container_port},
          "protocol": "tcp",
          "containerPort": ${container_port}
        }
      ],
      "environment": [],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "${log_group_name}",
          "awslogs-region": "${log_group_region}",
          "awslogs-stream-prefix": "${log_group_prefix}"
        }
      }
    }
  ]

  EOF
  vars {
    container_name   = "${local.container_name}"
    container_port   = "${local.container_port}"
    log_group_name   = "${aws_cloudwatch_log_group.log_group.name}"
    log_group_region = "${var.aws_region}"
    log_group_prefix = "blog-040"
  }
}

module "blog" {
  source  = "npalm/ecs-service/aws"

  service_name          = "blog-040"
  service_desired_count = 1

  environment = "${var.environment}"

  vpc_id       = "${module.vpc.vpc_id}"
  vpc_cidr     = "${module.vpc.vpc_cidr}"
  lb_subnetids = "${module.vpc.public_subnets}"

  ecs_cluster_id = "${aws_ecs_cluster.cluster.id}"

  lb_internal = false

  task_definition = "${data.template_file.blog.rendered}"
  task_cpu        = "256"
  task_memory     = "512"

  service_launch_type = "FARGATE"

  awsvpc_task_execution_role_arn = "${aws_iam_role.ecs_tasks_execution_role.arn}"
  awsvpc_service_security_groups = ["${aws_security_group.awsvpc_sg.id}"]
  awsvpc_service_subnetids       = "${module.vpc.private_subnets}"

  lb_target_group = {
    container_name = "${local.container_name}"
    container_port = "${local.container_port}"
  }

  lb_listener = {
    port     = 80
    protocol = "HTTP"
  }
}

Inputs

Name	Description	Type	Default	Required
awsvpc_service_security_groups	List of security groups to be attached to service running in awsvpc network mode.	string	<list>	no
awsvpc_service_subnetids	List of subnet ids to which a service is deployed in fargate mode.	string	<list>	no
awsvpc_task_execution_role_arn	The role arn used for task execution. Required for network mode awsvpc.	string	``	no
ecs_cluster_id	The id of the ECS cluster	string	-	yes
ecs_service_role		string	``	no
enable_alb	Enable or disable the load balancer.	string	true	no
environment	Logical name of the environment, will be used as prefix and in tags.	string	-	yes
lb_health_check	A health check block for the load balancer, see https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html more for details.	list	<list>	no
lb_internal	Indicates if the load balancer should be internal or external.	string	true	no
lb_listener	The listner for the load balancer, SSL in only applied once a certificate arn is provided.	map	<map>	no
lb_subnetids	List of subnets to which the load balancer needs to be attached. Mandatory when enable_alb = true.	list	<list>	no
lb_target_group	The target group to connectect the container to the load balancer listerner.	map	<map>	no
lb_security_group_ids	Custom Load Balancer security group ids	list	[]	no
lb_health_check_grace_period_seconds	Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647	string	0	no
service_desired_count	The number of instances of the task definition to place and keep running.	string	1	no
service_launch_type	The launch type, can be EC2 or FARGATE.	string	EC2	no
service_name	Logical name of the service.	string	-	yes
task_cpu	CPU value for the task, required for FARGATE.	string	``	no
task_definition	The AWS task definition of the containers to be created.	string	-	yes
task_memory	Memory value for the task, required for FARGATE.	string	``	no
task_network_mode	The network mode to be used in the task definiton. Supported modes are awsvpc and bridge.	string	awsvpc	no
task_role_arn	The AWS IAM role that will be provided to the task to perform AWS actions.	string	``	no
task_volumes	List of volume blocks for task definition	list	[]	no
vpc_cidr	CIDR for the VPC.	string	-	yes
vpc_id	ID of the VPC.	string	-	yes
public_alb_whitelist	Whitelists IP to be able to access ALB	list	["0.0.0.0/0","::/0"]	no

Outputs

Name	Description
service_url	Service urls.
lb_dns_name	Load Balancer DNS Name.
task_definition_arn	Task definition ARN.
lb_target_group_arn	Load Balancer Target Group ARN.
lb_arn	Load Balancer ARN.
lb_listener_arn	Load Balancer Listener ARN.
lb_security_group_id	Load Balancer Security Group ID.

terraform-aws-ecs-service's Issues

Feature Request: Add HTTP Redirect to HTTPS Option for ALB

First, I really like this module, so thank you!

I've run into an issue where I'm trying to add HTTP redirection to HTTPS on an ALB created by this module. I define a HTTPS listener and SSL offloading here:

  lb_target_group = {
    protocol       = "HTTP"
    host_port      = "${local.container_port}"
    container_port = "${local.container_port}"
  }

  lb_listener = {
    port            = 443
    protocol        = "HTTPS"
    certificate_arn = "${aws_acm_certificate.this.arn}"
  }

I tried to add a redirect listener like this outside of the module declaration:

resource "aws_lb_listener" "this" {
  load_balancer_arn = "${module.this.lb_arn}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_security_group_rule" "this" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["REDACTED"]  
  security_group_id = "${module.this.lb_security_group_id}"
}

Unfortunately, Terraform does not allow mixing up aws_security_group inline rules and aws_security_group_rule(s). This works the first time, but then alternates between applying and removing the new rule.

It would be very helpful to have an option to add another listener, or to have a simple option to include a HTTP-to-HTTPS listener as that is a fairly common use-case.

Thanks!

Invalid description for awsvpc_service_subnetids variable

awsvpc_service_subnetids is described as "List of subnet ids to which a service is deployed in fargate mode."

In reality, this is applied to EC2 mode as well. In awsvpc network mode, the ENI is placed in the subnet specified here.

IPv6 Addresses can't be added to `cidr_block`

The default for public_alb_whitelist is set to ["0.0.0.0/0", "::/0"]

This makes the module, with default settings error:

* aws_security_group.alb_sg: Error authorizing security group ingress rules: InvalidParameterValue: CIDR block ::/0 is malformed

hashicorp/terraform#14382

We need to use ipv6_cidr_blocks if we want to implement IPv6:

resource "aws_security_group" "test" {
  vpc_id = "${var.vpc}"
  name        = "Test"
  description = "Test"

  # Allow all outgoing:
  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }
  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    ipv6_cidr_blocks     = ["::/0"]
  }
}

A workaround is just to set public_alb_whitelist to ["0.0.0.0/0"] (Or your list of IPv4 addresses)

I'll open a PR to just remove the "::/0" from the default for now