A terraform module providing a Fargate cluster in AWS.
This module:
- Creates an AWS Application load balancer
- Populate it with listeners
- Creates target groups
- Creates Fargate cluster
- Creates AWS ECS Services with tasks at Fargate cluster
- Creates Lambda functions for dynamic creation of alerts and dashboards at CloudWatch
This module was strongly inspired by https://github.com/telia-oss/terraform-aws-ecs-fargate
For further information see example folder
module "fargate" {
source = "../"
name_prefix = "fargate-test-cluster"
vpc_id = data.aws_vpc.main.id
subnet_ids = data.aws_subnet_ids.main.ids
containers_definitions = {
helloworld = {
task_container_image = "crccheck/hello-world:latest"
task_container_assign_public_ip = true
task_container_port = 8000
task_container_environment = [
{
name = "TEST_VARIABLE"
value = "TEST_VALUE"
}
]
health_check = {
port = "traffic-port"
path = "/"
}
task_tags = {
terraform = "True"
}
}
hellonginx = {
task_container_image = "nginx:latest"
task_container_assign_public_ip = true
task_container_port = 80
task_container_environment = [
{
name = "TEST_VARIABLE"
value = "TEST_VALUE"
}
]
health_check = {
port = "traffic-port"
path = "/"
}
task_tags = {
terraform = "True"
}
}
}
tags = {
environment = "dev"
}
}
This is a special map of arguments needed for definition of tasks and services:
Name | Description | Type | Default | Required |
---|---|---|---|---|
tags_tags | A map of tags (key-value pairs) passed to resources | map(string) | {} | no |
task_log_retention_in_days | Days TTL before logs are dropped from cloudwatch | number | 30 | no |
task_container_name | Name of container, if not used, key of service is used | string | key of container_definitions | no |
task_container_image | Name of image used for task | string | nginx | no |
task_definition_cpu | Amount of CPU units for a task | number | 256 | no |
task_definition_memory | Amount of memory units for a task | number | 1024 | no |
task_container_command | Docker command of a task | list(string) | [] | no |
task_container_environment | Docker ENV variables of a task | list(string) | [] | no |
task_repository_credentials | KMS credentials for access to docker image registry | string | null | no |
task_container_assign_public_ip | If task should have public IP address | bool | null | no |
task_container_port | Port to be exported from container | number | null | yes |
deployment_minimum_healthy_percent | Minimum healthy tasks in deployment | number | 50 | no |
deployment_maximum_percent | Maximum healthy tasks in deployment | number | 200 | no |
health_check_grace_period_seconds | Health check grace period | number | 300 | no |
task_desired_count | Desired count of running tasks | number | 1 | no |
service_registry_arn | See resource aws_ecs_service service_registries | string | null | no |
deployment_controller_type | See resource aws_ecs_service deployment_controller_type | string | ECS | no |
rule_field | Listener rule field used in load balancer listener | string | host-header | no |
rule_values | Listener rule value used in load balancer listener | string | "${each.key}.com" | no |
health_check | Map of health check attributes, see aws_lb_target_group health_check resource | map(string) | {} | no |
scaling_enable | Enable scaling for the task | bool | false | no |
scaling_max_capacity | Scaling max task number | number | 4 | no |
scaling_min_capacity | Scaling min task number | number | 1 | no |
scaling_metric | Enable scaling for the task | string ECSServiceAverageCPUUtilization or ECSServiceAverageMemoryUtilization | ECSServiceAverageCPUUtilization | no |
scaling_target_value | Threshold to be reached to scale up/down | number | 70 | no |
Provider Requirements:
- aws: (any version)
- random: (any version)
allowed_subnets
(default{"ipv4":["0.0.0.0/0"],"ipv6":["::/0"]}
): Subnets allowed to access the services and load balancercertificate_arn
(required): ARN for certificate at ACM required for HTTPS listenercontainers_definitions
(required): Container setting which is than passed to fargate ecs serviceinternal_elb
(defaulttrue
): If used, load balancer will be only for internal usename_prefix
(required): Name prefix for fargate clustersubnet_ids
(required): Subnet IDs used for load balancertags
(required): A map of tags (key-value pairs) passed to resourcesvpc_id
(required): VPC ID
cluster_id
: Id of ECS clusterload_balancer_arn
: Get ARN of load balancerload_balancer_domain
: Get DNS record of load balancerlog_group_name
: The name of the Cloudwatch log group for the task.service_arn
: The Amazon Resource Name (ARN) that identifies the service.service_name
: The name of the service.service_sg_id
: The Amazon Resource Name (ARN) that identifies the service security group.sns_topic_arn
: SNS topic to subscribe for alertstarget_group_arn
: The ARN of the Target Group.target_group_name
: The Name of the Target Groups.task_role_arn
: The Amazon Resource Name (ARN) specifying the service role.task_role_name
: The name of the service role.
aws_ecs_cluster.cluster
fromaws
aws_security_group_rule.ingress_http
fromaws
aws_security_group_rule.ingress_https
fromaws
random_string.random
fromrandom
data.aws_region.current
fromaws
ecs-fargate
from./fargate/
fargate_alb
fromtelia-oss/loadbalancer/aws
(3.0.0
)monitoring
from./monitoring
monitoring_sns_topic
from./sns
Provider Requirements:
- aws: (any version)
- null: (any version)
alb_arn
(required): ALB ARNallowed_sg
(required): Allowed SG to ECS services, probably useful only for Load Balancerallowed_subnets
(default["0.0.0.0/0"]
): Subnets allowed to access the services and load balancercertificate_arn
(required): ARN for certificate at ACMcluster_id
(required): The Amazon Resource Name (ARN) that identifies the cluster.cluster_name
(required): Name that identifies the cluster.containers_definitions
(required): Container setting which is than passed to fargate ecs serviceprivate_subnet_ids
(required): A list of private subnets inside the VPCtags
(required): A map of tags (key-value pairs) passed to resources.vpc_id
(required): The VPC ID.
log_group_name
: The name of the Cloudwatch log group for the task.service_arn
: The Amazon Resource Name (ARN) that identifies the service.service_name
: The name of the service.service_sg_id
: The Amazon Resource Name (ARN) that identifies the service security group.target_group_arn
: The ARN of the Target Group.target_group_name
: The Name of the Target Groups.task_role_arn
: The Amazon Resource Name (ARN) specifying the service role.task_role_name
: The name of the service role.
aws_appautoscaling_policy.ecs_scaling_policy
fromaws
aws_appautoscaling_target.ecs_target
fromaws
aws_cloudwatch_log_group.main
fromaws
aws_ecs_service.service
fromaws
aws_ecs_service.service_with_no_service_registries
fromaws
aws_ecs_task_definition.task
fromaws
aws_iam_role.execution
fromaws
aws_iam_role.task
fromaws
aws_iam_role_policy.log_agent
fromaws
aws_iam_role_policy.read_repository_credentials
fromaws
aws_iam_role_policy.task_execution
fromaws
aws_lb_listener.http
fromaws
aws_lb_listener.https
fromaws
aws_lb_listener_rule.routing_http
fromaws
aws_lb_listener_rule.routing_https
fromaws
aws_lb_target_group.task
fromaws
aws_security_group.ecs_service
fromaws
aws_security_group_rule.egress_service
fromaws
aws_security_group_rule.egress_service_sg
fromaws
aws_security_group_rule.ingress_service
fromaws
aws_security_group_rule.ingress_service_sg
fromaws
null_resource.lb_exists
fromnull
data.aws_iam_policy_document.read_repository_credentials
fromaws
data.aws_iam_policy_document.task_assume
fromaws
data.aws_iam_policy_document.task_execution_permissions
fromaws
data.aws_iam_policy_document.task_permissions
fromaws
data.aws_kms_key.secretsmanager_key
fromaws
data.aws_region.current
fromaws
Provider Requirements:
- aws: (any version)
- null: (any version)
allowed_subnets
(default["0.0.0.0/0"]
): Subnets allowed to access the services and load balancercertificate_arn
(required): ARN for certificate at ACMcluster_id
(required): The Amazon Resource Name (ARN) that identifies the cluster.container_name
(required): Optional name for the container to be used instead of name_prefix. Useful when when constructing an imagedefinitons.json file for continuous deployment using Codepipeline.deployment_controller_type
(default"ECS"
): Type of deployment controller. Valid values: CODE_DEPLOY, ECS.deployment_maximum_percent
(default200
): The upper limit of the number of running tasks that can be running in a service during a deploymentdeployment_minimum_healthy_percent
(default50
): The lower limit of the number of running tasks that must remain running and healthy in a service during a deploymentdesired_count
(default1
): The number of instances of the task definitions to place and keep running.health_check
(required): A health block containing health check settings for the target group. Overrides the defaults.health_check_grace_period_seconds
(default300
): Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 7200. Only valid for services configured to use load balancers.lb_arn
(required): Arn for the LB for which the service should be attach to.log_retention_in_days
(default30
): Number of days the logs will be retained in CloudWatch.name_prefix
(required): A prefix used for naming resources.private_subnet_ids
(required): A list of private subnets inside the VPCrepository_credentials
(required): name or ARN of a secrets manager secret (arn:aws:secretsmanager:region:aws_account_id:secret:secret_name)repository_credentials_kms_key
(default"alias/aws/secretsmanager"
): key id, key ARN, alias name or alias ARN of the key that encrypted the repository credentialsservice_listner_rules
(required): Rules to be bind to listenerservice_registry_arn
(required): ARN of aws_service_discovery_service resourcetags
(required): A map of tags (key-value pairs) passed to resources.task_container_assign_public_ip
(required): Assigned public IP to the container.task_container_command
(required): The command that is passed to the container.task_container_environment
(required): The environment variables to pass to a container.task_container_image
(required): The image used to start a container.task_container_port
(required): Port that the container exposes.task_container_protocol
(default"HTTP"
): Protocol that the container exposes.task_definition_cpu
(default256
): Amount of CPU to reserve for the task.task_definition_memory
(default512
): The soft limit (in MiB) of memory to reserve for the container.vpc_id
(required): The VPC ID.
log_group_name
: The name of the Cloudwatch log group for the task.service_arn
: The Amazon Resource Name (ARN) that identifies the service.service_name
: The name of the service.service_sg_id
: The Amazon Resource Name (ARN) that identifies the service security group.target_group_arn
: The ARN of the Target Group.target_group_name
: The Name of the Target Group.task_role_arn
: The Amazon Resource Name (ARN) specifying the service role.task_role_name
: The name of the service role.
aws_cloudwatch_log_group.main
fromaws
aws_ecs_service.service
fromaws
aws_ecs_task_definition.task
fromaws
aws_iam_role.execution
fromaws
aws_iam_role.task
fromaws
aws_iam_role_policy.log_agent
fromaws
aws_iam_role_policy.read_repository_credentials
fromaws
aws_iam_role_policy.task_execution
fromaws
aws_lb_listener.http
fromaws
aws_lb_listener.https
fromaws
aws_lb_listener_rule.routing_http
fromaws
aws_lb_listener_rule.routing_https
fromaws
aws_lb_target_group.task
fromaws
aws_security_group.ecs_service
fromaws
aws_security_group_rule.egress_service
fromaws
aws_security_group_rule.ingress_service
fromaws
null_resource.lb_exists
fromnull
data.aws_iam_policy_document.read_repository_credentials
fromaws
data.aws_iam_policy_document.task_assume
fromaws
data.aws_iam_policy_document.task_execution_permissions
fromaws
data.aws_iam_policy_document.task_permissions
fromaws
data.aws_kms_key.secretsmanager_key
fromaws
data.aws_region.current
fromaws
Provider Requirements:
- aws: (any version)
- random: (any version)
environment
(default{"NA":"NA"}
): A map that defines environment variables for the Lambda function.filename
(required): The path to the function's deployment package within the local filesystem.handler
(default"main"
): The function entrypoint in your code.log_retention_in_days
(default60
): Log retention of the lambda functionname_prefix
(required): Name prefix of lambda functionpolicy
(required): A policy document for the lambda execution role.runtime
(default"go1.x"
): Lambda runtime. Defaults to Go 1.x.security_group_ids
(required): SG IDs for Lambda, should at least allow all outboundsubnet_ids
(required): VPC subnets for Lambdatags
(required): Map of tags to assign to lambda functiontimeout
(default30
): Execution timeout.
arn
name
aws_cloudwatch_log_group.lambda_log_group
fromaws
aws_iam_role.lambda_main
fromaws
aws_iam_role_policy.lambda_main
fromaws
aws_lambda_function.lambda
fromaws
random_string.lambda_postfix_generator
fromrandom
data.aws_iam_policy_document.lambda_assume
fromaws
Provider Requirements:
- archive: (any version)
- aws: (any version)
default_region
(default"eu-west-1"
): Default region to be used in Lambda functionsecs_service_alerts_evaluation_periods
(default5
): How many periods should alerts at ECS service cross the threshold to be triggeredname_prefix
(required): Name prefix for lambda monitoringssns_notification_topic
(required): SNS notification topic for alerting messages from user_data scriptstags
(required): A map of tags (key-value pairs) passed to resources
aws_cloudwatch_event_rule.lambda_services_alarm
fromaws
aws_cloudwatch_event_rule.lambda_services_dashboard
fromaws
aws_cloudwatch_event_target.lambda_services_alarm
fromaws
aws_cloudwatch_event_target.lambda_services_dashboard
fromaws
aws_lambda_permission.cloudwatch_services_alarm
fromaws
aws_lambda_permission.cloudwatch_services_dashboard
fromaws
data.archive_file.lambda_service_utilization_monitoring-dotfiles
fromarchive
data.aws_iam_policy_document.lambda_service_utilization_monitoring
fromaws
data.aws_iam_policy_document.lambda_services_dashboard
fromaws
alarm-lambda
from../lambda
dashboard-lambda
from../lambda
sns_topic_name
(required): SNS topic name to which SQS queue should subscribe
this_sns_topic_arn
: SNS topic ARN for potential subscriptionsthis_sns_topic_name
: SNS topic name
sns_topic
fromterraform-aws-modules/sns/aws
(~> 2.0
)
This module so far does not handle certificate management. You can add certificate_arn
to add TLS to AWS Load Balancer but creation of the certificate is up to you.
To handle certificate, their creation and usage, see https://www.terraform.io/docs/providers/aws/r/acm_certificate_validation.html