-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathecs.tf
128 lines (105 loc) · 3.3 KB
/
ecs.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
resource "aws_ecs_cluster" "main" {
name = "${local.prefix}-cluster"
tags = local.common_tags
}
resource "aws_iam_policy" "task_execution_role_policy" {
name = "${local.prefix}-task-exec-role-policy"
path = "/"
description = "Allow retrieving of images and adding to logs"
policy = file("./templates/ecs/task-exec-role.json")
}
resource "aws_iam_role" "task_execution_role" {
name = "${local.prefix}-task-exec-role"
assume_role_policy = file("./templates/ecs/assume-role-policy.json")
tags = local.common_tags
}
resource "aws_iam_role_policy_attachment" "task_execution_role" {
role = aws_iam_role.task_execution_role.name
policy_arn = aws_iam_policy.task_execution_role_policy.arn
}
resource "aws_iam_role" "app_iam_role" {
name = "${local.prefix}-api-task"
assume_role_policy = file("./templates/ecs/assume-role-policy.json")
tags = local.common_tags
}
resource "aws_cloudwatch_log_group" "ecs_task_logs" {
name = "${local.prefix}-api"
tags = local.common_tags
}
data "template_file" "api_container_definitions" {
template = file("./templates/ecs/container-definitions.json.tpl")
vars = {
app_image = var.ecr_image_api
proxy_image = var.ecr_image_proxy
db_host = aws_db_instance.main.address
db_name = aws_db_instance.main.db_name
db_user = aws_db_instance.main.username
db_pass = aws_db_instance.main.password
log_group_name = aws_cloudwatch_log_group.ecs_task_logs.name
log_group_region = data.aws_region.current.name
}
}
resource "aws_ecs_task_definition" "api" {
family = "${local.prefix}-api"
container_definitions = data.template_file.api_container_definitions.rendered
requires_compatibilities = ["FARGATE"]
network_mode = "awsvpc"
cpu = 256
memory = 512
execution_role_arn = aws_iam_role.task_execution_role.arn
task_role_arn = aws_iam_role.app_iam_role.arn
volume {
name = "static"
}
tags = local.common_tags
}
resource "aws_security_group" "ecs_service" {
description = "Access for the ECS service"
name = "${local.prefix}-ecs-service"
vpc_id = aws_vpc.main.id
egress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 5432
to_port = 5432
protocol = "tcp"
cidr_blocks = [
aws_subnet.private_a.cidr_block,
aws_subnet.private_b.cidr_block,
]
}
ingress {
from_port = 8000
to_port = 8000
protocol = "tcp"
security_groups = [
aws_security_group.lb.id
]
}
tags = local.common_tags
}
resource "aws_ecs_service" "api" {
name = "${local.prefix}-api"
cluster = aws_ecs_cluster.main.name
task_definition = aws_ecs_task_definition.api.family
desired_count = 1
launch_type = "FARGATE"
platform_version = "1.4.0"
network_configuration {
subnets = [
aws_subnet.private_a.id,
aws_subnet.private_b.id,
]
security_groups = [aws_security_group.ecs_service.id]
}
load_balancer {
target_group_arn = aws_lb_target_group.api.arn
container_name = "proxy"
container_port = 8000
}
depends_on = [aws_lb_listener.api_https]
}