terraform-aws-ecs-fargate-task-definition

Terraform module to create AWS ECS Fargate Task Definition.

Terraform versions

Terraform 0.12. Pin module version to ~> v2.0. Submit pull-requests to master branch.

Usage

module "ecs-task-definition" {
  source = "umotif-public/ecs-fargate-task-definition/aws"
  version = "~> 2.0.0"

  enabled              = true
  name_prefix          = "test-container"
  task_container_image = "httpd:2.4"

  container_name      = "test-container-name"
  task_container_port = "80"
  task_host_port      = "80"

  task_definition_cpu    = "512"
  task_definition_memory = "1024"

  task_container_environment = {
    "ENVIRONEMNT" = "Test"
  }
}

Assumptions

Module is to be used with Terraform > 0.12.

Examples

Authors

Module managed by Marcin Cuber LinkedIn.

Requirements

Name	Version
terraform	>= 1.0.11
aws	>= 3.76.1

Providers

Name	Version
aws	>= 3.76.1

Modules

No modules.

Resources

Name	Type
aws_ecs_task_definition.task	resource
aws_iam_role.execution	resource
aws_iam_role.task	resource
aws_iam_role_policy.log_agent	resource
aws_iam_role_policy.read_repository_credentials	resource
aws_iam_role_policy_attachment.ecs_task_execution_role_policy_attach	resource
aws_iam_policy_document.assume_role_policy	data source
aws_iam_policy_document.read_repository_credentials	data source
aws_iam_policy_document.task_permissions	data source
aws_kms_key.secretsmanager_key	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
cloudwatch_log_group_name	CloudWatch log group name required to enabled logDriver in container definitions for ecs task.	`string`	`""`	no
container_name	Optional name for the container to be used instead of name_prefix.	`string`	`""`	no
create_repository_credentials_iam_policy	Set to true if you are specifying `repository_credentials` variable, it will attach IAM policy with necessary permissions to task role.	`bool`	`false`	no
enabled	Whether to create the resources. Set to `false` to prevent the module from creating any resources	`bool`	`true`	no
name_prefix	A prefix used for naming resources.	`string`	n/a	yes
placement_constraints	(Optional) A set of placement constraints rules that are taken into consideration during task placement. Maximum number of placement_constraints is 10. This is a list of maps, where each map should contain "type" and "expression"	`list(any)`	`[]`	no
proxy_configuration	(Optional) The proxy configuration details for the App Mesh proxy. This is a list of maps, where each map should contain "container_name", "properties" and "type"	`list(any)`	`[]`	no
repository_credentials	name or ARN of a secrets manager secret (arn:aws:secretsmanager:region:aws_account_id:secret:secret_name)	`string`	`""`	no
repository_credentials_kms_key	key id, key ARN, alias name or alias ARN of the key that encrypted the repository credentials	`string`	`"alias/aws/secretsmanager"`	no
tags	A map of tags (key-value pairs) passed to resources.	`map(string)`	`{}`	no
task_container_command	The command that is passed to the container.	`list(string)`	`[]`	no
task_container_cpu	Amount of CPU to reserve for the container.	`number`	`null`	no
task_container_environment	The environment variables to pass to a container.	`map(string)`	`{}`	no
task_container_image	The image used to start a container.	`string`	n/a	yes
task_container_memory	The hard limit (in MiB) of memory for the container.	`number`	`null`	no
task_container_memory_reservation	The soft limit (in MiB) of memory to reserve for the container.	`number`	`null`	no
task_container_port	The port number on the container that is bound to the user-specified or automatically assigned host port	`number`	`0`	no
task_container_secrets	The secrets variables to pass to a container.	`list(map(string))`	`null`	no
task_container_working_directory	The working directory to run commands inside the container.	`string`	`""`	no
task_definition_cpu	Amount of CPU to reserve for the task.	`number`	`256`	no
task_definition_memory	The soft limit (in MiB) of memory to reserve for the task.	`number`	`512`	no
task_health_check	An optional healthcheck definition for the task	`object({ command = list(string), interval = number, timeout = number, retries = number, startPeriod = number })`	`null`	no
task_host_port	The port number on the container instance to reserve for your container.	`number`	`0`	no
task_mount_points	The mount points for data volumes in your container. Each object inside the list requires "sourceVolume", "containerPath" and "readOnly". For more information see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html	`list(object({ sourceVolume = string, containerPath = string, readOnly = bool }))`	`null`	no
task_start_timeout	Time duration (in seconds) to wait before giving up on resolving dependencies for a container. If this parameter is not specified, the default value of 3 minutes is used (fargate).	`number`	`null`	no
task_stop_timeout	Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. The max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used.	`number`	`null`	no
volume	(Optional) A set of volume blocks that containers in your task may use. This is a list of maps, where each map should contain "name", "host_path", "docker_volume_configuration" and "efs_volume_configuration". Full set of options can be found at https://www.terraform.io/docs/providers/aws/r/ecs_task_definition.html	`any`	`[]`	no

Outputs

Name	Description
container_port	Port on which the container is listening.
execution_role_arn	The Amazon Resource Name (ARN : null of execution role.
execution_role_create_date	The creation date of the IAM role.
execution_role_id	The ID of the execution role.
execution_role_name	The name of the execution service role.
execution_role_unique_id	The stable and unique string identifying the role.
task_definition_arn	Full ARN of the Task Definition (including both family and revision).
task_definition_family	The family of the Task Definition.
task_definition_revision	The revision of the task in a particular family.
task_role_arn	The Amazon Resource Name (ARN) specifying the ECS service role.
task_role_create_date	The creation date of the IAM role.
task_role_id	The ID of the role.
task_role_name	The name of the Fargate task service role.
task_role_unique_id	The stable and unique string identifying the role.

License

See LICENSE for full details.

Pre-commit hooks

Install dependencies

pre-commit
terraform-docs required for terraform_docs hooks.
TFLint required for terraform_tflint hook.

MacOS

brew install pre-commit terraform-docs tflint

brew tap git-chglog/git-chglog
brew install git-chglog

`task_container_working_directory` needs to be quoted or documentation updated to use jsonencode before calling

What is the current behavior?

Using

...
task_container_working_directory = "/workdir/myfolder"
...

Will give this error:

-----------------------------------------------------------------------

Error: ECS Task Definition container_definitions is invalid: Error decoding JSON: invalid character '/' looking for beginning of value

  on .terraform/modules/ecs-task-definition/main.tf line 72, in resource "aws_ecs_task_definition" "task":
  72:   container_definitions = <<EOF
  73: [{
  74:     "name": "${var.container_name != "" ? var.container_name : var.name_prefix}",
  75:     "image": "${var.task_container_image}",
  76:     %{if var.repository_credentials != ""~}
  77:     "repositoryCredentials": {
  78:       "credentialsParameter": "${var.repository_credentials}"
  79:     },
  80:     %{~endif}
  81:     "essential": true,
  82:     %{if var.task_container_port != 0 || var.task_host_port != 0~}
  83:     "portMappings": [
  84:       {
  85:         %{if var.task_host_port != 0~}
  86:         "hostPort": ${var.task_host_port},
  87:         %{~endif}
  88:         %{if var.task_container_port != 0~}
  89:         "containerPort": ${var.task_container_port},
  90:         %{~endif}
  91:         "protocol":"tcp"
  92:       }
  93:     ],
  94:     %{~endif}
  95:     %{if var.cloudwatch_log_group_name != ""~}
  96:     "logConfiguration": {
  97:       "logDriver": "awslogs",
  98:       "options": {
  99:         "awslogs-group": "${var.cloudwatch_log_group_name}",
 100:         "awslogs-region": "${data.aws_region.current.name}",
 101:         "awslogs-stream-prefix": "container"
 102:       }
 103:     },
 104:     %{~endif}
 105:     %{if var.task_health_check != null~}
 106:     "healthcheck": {
 107:         "command": ${jsonencode(var.task_health_check.command)},
 108:         "interval": ${var.task_health_check.interval},
 109:         "timeout": ${var.task_health_check.timeout},
 110:         "retries": ${var.task_health_check.retries},
 111:         "startPeriod": ${var.task_health_check.startPeriod}
 112:     },
 113:     %{~endif}
 114:     "command": ${jsonencode(var.task_container_command)},
 115:     %{if var.task_container_working_directory != ""~}
 116:     "workingDirectory": ${var.task_container_working_directory},
 117:     %{~endif}
 118:     %{if var.task_container_memory != null~}
 119:     "memory": ${var.task_container_memory},
 120:     %{~endif}
 121:     %{if var.task_container_memory_reservation != null~}
 122:     "memoryReservation": ${var.task_container_memory_reservation},
 123:     %{~endif}
 124:     %{if var.task_container_cpu != null~}
 125:     "cpu": ${var.task_container_cpu},
 126:     %{~endif}
 127:     %{if var.task_start_timeout != null~}
 128:     "startTimeout": ${var.task_start_timeout},
 129:     %{~endif}
 130:     %{if var.task_stop_timeout != null~}
 131:     "stopTimeout": ${var.task_stop_timeout},
 132:     %{~endif}
 133:     %{if var.task_mount_points != null~}
 134:     "mountPoints": ${jsonencode(var.task_mount_points)},
 135:     %{~endif}
 136:     %{if var.task_container_secrets != null~}
 137:     "secrets": ${jsonencode(var.task_container_secrets)},
 138:     %{~endif}
 139:     "environment": ${jsonencode(local.task_environment)}
 140: }]
 141: EOF

If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem.

What is the expected behavior?

Task created.

Software versions?

Module version 2.1.1.

The fix might be:

add quotes or jsonencode in this line
update docs to use jsonencode before calling.

I guess 1) is more transparent.

umotif-public / terraform-aws-ecs-fargate-task-definition Goto Github PK