Terraform ECS Fargate

A module used for provisioning web or api application stacks on AWS ECS Fargate. The majority of the module has been adapted from this template.

Example

This will spin up a new ECS cluster and fargate service running a simple default container image.

module "fargate" {
  source = "[email protected]:warnermedia/terraform-ecs-fargate-module/?ref=v4.3.0"

  app                   = "mywebsite"
  environment           = "main"
  tags                  = var.tags
  container_port        = 8000
  vpc                   = "vpc-a1b2c3der"
  create_public_ip      = true
  load_balancer_subnets = ["subnet-0ba9...","subnet-abcde"]
  fargate_subnets       = ["subnet-9ba0...","subnet-edcba"]

  health_check = "/"
}

Usage and link to base

It is recommended that you store your terraform state in a safe location. If the create_cicd_user variable is enabled, the state file will contain your aws key id and secret. The easiest method would be to use S3 state.

If you would like a ready to use template for this module, it's state bucket as well as CICD templates. Check out fargate-create

Inputs

Name	Description	Type	Default	Required
app	The application's name	string	n/a	yes
container_port	The port the container will listen on, used for load balancer health check Best practice is that this value is higher than 1024 so the container processes isn't running at root.	string	n/a	yes
environment	The environment that is being built	string	n/a	yes
fargate_subnets	These are the subnet ids that the containers will use	list(any)	n/a	yes
load_balancer_subnets	These are the subnet ids that the load balancer will use	list(any)	n/a	yes
tags	Tags for the infrastructure	map(string)	n/a	yes
vpc	The VPC to use for the Fargate cluster	any	n/a	yes
certificate_arn	The ARN for the SSL certificate, if this is not blank it will use it instead of requesting a dns validated ACM certificate	string	""	no
container_definitions	This is the json formatted container definition for the task. By default, a definition with the indicated container image and cloudwatch logging will be provided. Setting this will override the defaults allowing configuration like environment variables to be set. We recommend using this module to help build the json rather than doing it in a large string: https://registry.terraform.io/modules/cloudposse/ecs-container-definition/aws/latest	string	""	no
container_image	The default docker image to deploy with the infrastructure. Note that you can use the fargate CLI for application concerns like deploying actual application images and environment variables on top of the infrastructure provisioned by this template https://github.com/turnerlabs/fargate note that the source for the turner default backend image is here: https://github.com/turnerlabs/turner-defaultbackend	string	"ghcr.io/warnermedia/fargate-default-backend:v0.9.0"	no
container_name	The name of the container to run	string	"app"	no
cpu_architecture	The CPU Architecture X86_64 or ARM64 for Graviton, see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform	string	"X86_64"	no
cpu_units	See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size	number	256	no
create_cicd_user	Should the module create an iam user with permissions tuned for cicd (cicf.tf)	bool	false	no
create_ecs_dashboard	Log the ECS events happening in fargate and create a cloudwatch dashboard that shows these messages	bool	false	no
create_performance_dashboard	Create a cloudwatch dashboard containing popular performance metrics about fargate	bool	true	no
create_public_ip	Whether the load balancer is available on the public internet. The containers will always get subnet ips.	bool	false	no
custom_default_alb_cidr_blocks	This is the default list of cidr blocks that will be allowed to access the ALB on http and/or https	list(string)	[ "0.0.0.0/0" ]	no
default_ecr	The name of the elastic container registry in this account that the CICD user will be given write permission	string	""	no
deployment_maximum_percent	The upper limit on the number of tasks allowed running or pending. See https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentConfiguration.html	number	null	no
deployment_minimum_healthy_percent	The lower limit on the number of your service's tasks that must remain in the RUNNING state during a deployment See https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentConfiguration.html	number	null	no
deregistration_delay	The amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused	string	"30"	no
do_https_redirect	Should the service do http to https redirects, or just standard http hosting? This is done via alb rules https://aws.amazon.com/premiumsupport/knowledge-center/elb-redirect-http-to-https-using-alb/	bool	false	no
do_performance_autoscaling	Should the fargate service scale up and down with cpu usage	bool	false	no
domain	The domain for r53 registration, leave blank to indicate not using route53	string	""	no
ecs_autoscale_max_instances	The maximum number of containers that should be running when scaling up	number	4	no
ecs_autoscale_min_instances	The minimum number of containers that should be running. Must be at least 1. For production, consider using at least "2".	number	1	no
ecs_cluster_name	Name of an existing ECS cluster, if left blank it will create one with the app and environment values	string	""	no
ecs_lambda_runtime	The lambda runtime for the ecs dashboard, provided here so that it is easy to update to the latest supported	string	"nodejs20.x"	no
fixed_non_spot_count	How many tasks are required stay normal fargate (non-spot) instances despite the percentages	number	1	no
health_check	The path to the health check for the load balancer to know if the container(s) are ready	string	"/"	no
health_check_interval	How often to check the liveliness of the container	string	"30"	no
health_check_matcher	What HTTP response code to listen for	string	"200"	no
health_check_timeout	How long to wait for the response on the health check path	string	"10"	no
https_port	The port to listen on for HTTPS (if it is enabled), always use 443	string	"443"	no
lb_access_logs_expiration_days	How many days worth of load balancer logs to keep in s3	string	"3"	no
lb_port	The port the standard http load balancer will listen on	string	"80"	no
lb_protocol	The load balancer protocol	string	"HTTP"	no
logs_retention_in_days	Specifies the number of days you want to retain log events	number	90	no
memory_size	See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size	number	512	no
operating_system_family	The OS Family of the task, see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform	string	"LINUX"	no
platform_version	The fargate platform version. These version numbers are different between linux and windows, make sure to use the correct value or leave it at LATEST: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html	string	"LATEST"	no
replicas	How many containers to run	number	1	no
scaling_cpu_high_threshold	If the average CPU utilization over a minute rises to this threshold, the number of containers will be increased (but not above ecs_autoscale_max_instances).	string	"80"	no
scaling_cpu_low_threshold	If the average CPU utilization over a minute drops to this threshold, the number of containers will be reduced (but not below ecs_autoscale_min_instances).	string	"20"	no
secrets_manager	indicates if a secrets manager	bool	false	no
secrets_manager_recovery_window_in_days	Number of days that secrets manager will wait before fully deleting a secret, set to 0 to delete immediately https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret#recovery_window_in_days	number	7	no
secrets_users	A list of users that will have full access to the secrets manager and its kms key, the current user applying the terraform will have access as well.	list(any)	[]	no
spot_percentage	The percentage of tasks in the service that should run as spot instances. This also works for ARM/Graviton, but beware, some regions don't have any capacity or support for ARM spot	number	0	no
ssl_policy	This is the policy that controls the specifics about TLS/SSL versions and supported ciphers. This default will only support TLS 1.2 https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies	string	"ELBSecurityPolicy-TLS-1-2-Ext-2018-06"	no
volumes	This allows for EFS volumes to be attached to your task	any	[]	no

Outputs

Name	Description
alb_nsg_id	This is the network security group id (sg-blah) for the ALB. This could be useful if you needed to directly add new rules
cicd_keys	A command to run that can extract the AWS keys for the CICD user to use in a build system (remove the \ in the select section
ecs_cluster_arn	The arn of the ecs cluster that was created or referenced
ecs_cluster_name	The name of the ecs cluster that was created or referenced
ecs_execution_role_arn	The arn of the role used by ecs when starting the task
ecs_execution_role_name	The name of the role used by ecs when starting the task
ecs_role_arn	The arn of the role assumed by the task at runtime
ecs_role_name	The name of the role assumed by the task at runtime
ecs_service_name	The arn of the fargate ecs service that was created
fqdn	The fully qualified domain name created if dns based ACM is enabled
lb_arn	The arn of the load balancer
lb_dns	The load balancer DNS name
secret_arn	The arn of the created secret manager (if enabled)
secret_id	The short name id of the created secret manager (if enabled)