Skip to content

Commit

Permalink
Don't pass IAM role to ECS Service when there are more than one Targe…
Browse files Browse the repository at this point in the history
…t Groups (#83)

* Add check for load balancers var length on iam role

* Add check to also not create the role if not needed

* Updated README.md

* Change to module.this

* Update Makefile as advised by @jamengual

* Updated wrong Makefile, fixing

* Executed 'terraform fmt'

* Fix tabs I guess

* Update main.tf with suggestion

Co-authored-by: Andriy Knysh <[email protected]>

* Update main.tf with suggestion

Co-authored-by: Andriy Knysh <[email protected]>

* As advised

Co-authored-by: actions-bot <[email protected]>
Co-authored-by: Andriy Knysh <[email protected]>
  • Loading branch information
3 people authored Dec 1, 2020
1 parent 869323a commit e8f90ee
Show file tree
Hide file tree
Showing 10 changed files with 161 additions and 48 deletions.
15 changes: 14 additions & 1 deletion .github/CODEOWNERS
Validating CODEOWNERS rules …
Original file line number Diff line number Diff line change
@@ -1,4 +1,17 @@
# Use this file to define individuals or teams that are responsible for code in a repository.
# Read more: <https://help.github.com/articles/about-codeowners/>
#
# Order is important: the last matching pattern takes the most precedence

* @cloudposse/engineering
# These owners will be the default owners for everything
* @cloudposse/engineering @cloudposse/contributors

# Cloud Posse must review any changes to Makefiles
**/Makefile @cloudposse/engineering
**/Makefile.* @cloudposse/engineering

# Cloud Posse must review any changes to GitHub actions
.github/* @cloudposse/engineering

# Cloud Posse must review any changes to standard context definition
**/context.tf @cloudposse/engineering
4 changes: 2 additions & 2 deletions .github/ISSUE_TEMPLATE/feature_request.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ assignees: ''

---

Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) in the `#geodesic` channel or visit our [Slack Archive](https://archive.sweetops.com/geodesic/).
Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) or visit our [Slack Archive](https://archive.sweetops.com/).

[![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)

Expand All @@ -33,4 +33,4 @@ Explain what alternative solutions or features you've considered.

## Additional Context

Add any other context or screenshots about the feature request here.
Add any other context or screenshots about the feature request here.
40 changes: 40 additions & 0 deletions .github/auto-release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name-template: 'v$RESOLVED_VERSION'
tag-template: '$RESOLVED_VERSION'
version-template: '$MAJOR.$MINOR.$PATCH'
version-resolver:
major:
labels:
- 'major'
minor:
labels:
- 'minor'
- 'enhancement'
patch:
labels:
- 'patch'
- 'fix'
- 'bugfix'
- 'bug'
- 'hotfix'
default: 'minor'

categories:
- title: '🚀 Enhancements'
labels:
- 'enhancement'
- title: '🐛 Bug Fixes'
labels:
- 'fix'
- 'bugfix'
- 'bug'
- 'hotfix'

change-template: |
<details>
<summary>$TITLE @$AUTHOR (#$NUMBER)</summary>
$BODY
</details>
template: |
$CHANGES
19 changes: 19 additions & 0 deletions .github/workflows/auto-release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: auto-release

on:
push:
branches:
- master

jobs:
semver:
runs-on: ubuntu-latest
steps:
# Drafts your next Release notes as Pull Requests are merged into "master"
- uses: release-drafter/release-drafter@v5
with:
publish: true
prerelease: false
config-name: auto-release.yml
env:
GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
8 changes: 4 additions & 4 deletions .github/workflows/chatops.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@ jobs:
steps:
- uses: actions/checkout@v2
- name: "Handle common commands"
uses: cloudposse/actions/github/slash-command-dispatch@0.15.0
uses: cloudposse/actions/github/slash-command-dispatch@0.16.0
with:
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
reaction-token: ${{ secrets.GITHUB_TOKEN }}
repository: cloudposse/actions
commands: rebuild-readme, terraform-fmt
permission: none
permission: triage
issue-type: pull-request

test:
Expand All @@ -24,13 +24,13 @@ jobs:
- name: "Checkout commit"
uses: actions/checkout@v2
- name: "Run tests"
uses: cloudposse/actions/github/slash-command-dispatch@0.15.0
uses: cloudposse/actions/github/slash-command-dispatch@0.16.0
with:
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
reaction-token: ${{ secrets.GITHUB_TOKEN }}
repository: cloudposse/actions
commands: test
permission: none
permission: triage
issue-type: pull-request
reactions: false

Expand Down
4 changes: 4 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
<!-- markdownlint-disable -->
# terraform-aws-ecs-alb-service-task [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-ecs-alb-service-task.svg)](https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
<!-- markdownlint-restore -->

[![README Header][readme_header_img]][readme_header_link]

Expand Down Expand Up @@ -463,8 +465,10 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply

### Contributors

<!-- markdownlint-disable -->
| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Igor Rodionov][goruha_avatar]][goruha_homepage]<br/>[Igor Rodionov][goruha_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] | [![Sarkis Varozian][sarkis_avatar]][sarkis_homepage]<br/>[Sarkis Varozian][sarkis_homepage] | [![Chris Weyl][rsrchboy_avatar]][rsrchboy_homepage]<br/>[Chris Weyl][rsrchboy_homepage] |
|---|---|---|---|---|
<!-- markdownlint-restore -->

[osterman_homepage]: https://github.com/osterman
[osterman_avatar]: https://img.cloudposse.com/150x150/https://github.com/osterman.png
Expand Down
13 changes: 7 additions & 6 deletions main.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
locals {
enabled = module.this.enabled
enabled = module.this.enabled
enable_ecs_service_role = module.this.enabled && var.network_mode != "awsvpc" && length(var.ecs_load_balancers) <= 1
}

module "task_label" {
Expand Down Expand Up @@ -129,15 +130,15 @@ data "aws_iam_policy_document" "ecs_service" {
}

resource "aws_iam_role" "ecs_service" {
count = local.enabled && var.network_mode != "awsvpc" ? 1 : 0
count = local.enable_ecs_service_role ? 1 : 0
name = module.service_label.id
assume_role_policy = join("", data.aws_iam_policy_document.ecs_service.*.json)
permissions_boundary = var.permissions_boundary == "" ? null : var.permissions_boundary
tags = module.service_label.tags
}

data "aws_iam_policy_document" "ecs_service_policy" {
count = local.enabled && var.network_mode != "awsvpc" ? 1 : 0
count = local.enable_ecs_service_role ? 1 : 0

statement {
effect = "Allow"
Expand All @@ -156,7 +157,7 @@ data "aws_iam_policy_document" "ecs_service_policy" {
}

resource "aws_iam_role_policy" "ecs_service" {
count = local.enabled && var.network_mode != "awsvpc" ? 1 : 0
count = local.enable_ecs_service_role ? 1 : 0
name = module.service_label.id
policy = join("", data.aws_iam_policy_document.ecs_service_policy.*.json)
role = join("", aws_iam_role.ecs_service.*.id)
Expand Down Expand Up @@ -274,7 +275,7 @@ resource "aws_ecs_service" "ignore_changes_task_definition" {
platform_version = var.launch_type == "FARGATE" ? var.platform_version : null
scheduling_strategy = var.launch_type == "FARGATE" ? "REPLICA" : var.scheduling_strategy
enable_ecs_managed_tags = var.enable_ecs_managed_tags
iam_role = var.network_mode != "awsvpc" ? join("", aws_iam_role.ecs_service.*.arn) : null
iam_role = local.enable_ecs_service_role ? join("", aws_iam_role.ecs_service.*.arn) : null

dynamic "capacity_provider_strategy" {
for_each = var.capacity_provider_strategies
Expand Down Expand Up @@ -356,7 +357,7 @@ resource "aws_ecs_service" "default" {
platform_version = var.launch_type == "FARGATE" ? var.platform_version : null
scheduling_strategy = var.launch_type == "FARGATE" ? "REPLICA" : var.scheduling_strategy
enable_ecs_managed_tags = var.enable_ecs_managed_tags
iam_role = var.network_mode != "awsvpc" ? join("", aws_iam_role.ecs_service.*.arn) : null
iam_role = local.enable_ecs_service_role ? join("", aws_iam_role.ecs_service.*.arn) : null

dynamic "capacity_provider_strategy" {
for_each = var.capacity_provider_strategies
Expand Down
50 changes: 15 additions & 35 deletions test/src/Makefile
Original file line number Diff line number Diff line change
@@ -1,50 +1,30 @@
PACKAGE = terraform-aws-ecs-alb-service-task
GOEXE ?= /usr/bin/go
GOPATH = $(CURDIR)/.gopath
GOBIN = $(GOPATH)/bin
BASE = $(GOPATH)/src/$(PACKAGE)
PATH := $(PATH):$(GOBIN)

export TF_DATA_DIR ?= $(CURDIR)/.terraform
export TF_CLI_ARGS_init ?= -get-plugins=true
export GOPATH
export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1-2)

.DEFAULT_GOAL : all

.PHONY: all
.PHONY : all
## Default target
all: test

ifneq (,$(wildcard /sbin/apk))
## Install go, if not installed
$(GOEXE):
apk add --update go
endif

ifeq ($(shell uname -s),Linux)
## Install all `dep`, if not installed
$(GOBIN)/dep:
@mkdir -p $(GOBIN)
@curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
endif

## Prepare the GOPATH
$(BASE): $(GOEXE)
@mkdir -p $(dir $@)
@ln -sf $(CURDIR) $@

## Download vendor dependencies to vendor/
$(BASE)/vendor: $(BASE) $(GOBIN)/dep
cd $(BASE) && dep ensure

.PHONY : init
## Initialize tests
init: $(BASE)/vendor
init:
@exit 0

.PHONY : test
## Run tests
test: init
cd $(BASE) && go test -v -timeout 30m -run TestExamplesComplete
go mod download
go test -v -timeout 60m -run TestExamplesComplete

## Run tests in docker container
docker/test:
docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \
-e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
-v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test

.PHONY : clean
## Clean up files
clean:
rm -rf .gopath/ vendor/ $(TF_DATA_DIR)
rm -rf ../../examples/complete/*.tfstate*
13 changes: 13 additions & 0 deletions test/src/go.mod
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
module github.com/cloudposse/terraform-aws-ecs-alb-service-task

go 1.14

require (
github.com/aws/aws-sdk-go v1.35.37 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/go-sql-driver/mysql v1.5.0 // indirect
github.com/google/uuid v1.1.2 // indirect
github.com/gruntwork-io/terratest v0.16.0
github.com/pquerna/otp v1.3.0 // indirect
github.com/stretchr/testify v1.3.0
)
43 changes: 43 additions & 0 deletions test/src/go.sum
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
github.com/aws/aws-sdk-go v1.35.37 h1:XA71k5PofXJ/eeXdWrTQiuWPEEyq8liguR+Y/QUELhI=
github.com/aws/aws-sdk-go v1.35.37/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/gruntwork-io/terratest v0.16.0 h1:8dDdkAzqwVDclmefcy//oBPWs5bVrWuKYCUwG0WFG4c=
github.com/gruntwork-io/terratest v0.16.0/go.mod h1:NjUn6YXA5Skxt8Rs20t3isYx5Rl+EgvGB8/+RRXddqk=
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pquerna/otp v1.3.0 h1:oJV/SkzR33anKXwQU3Of42rL4wbrffP4uvUf1SvS5Xs=
github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

0 comments on commit e8f90ee

Please sign in to comment.