Skip to content

Commit 9baaeb5

Browse files
author
rahul-infra
committed
Updated examples for same account and cross account.
1 parent 2206cd0 commit 9baaeb5

File tree

12 files changed

+628
-8
lines changed

12 files changed

+628
-8
lines changed

‎examples/cross-account/.header.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# ECS Deployment Complete
2+
3+
Configuration in this directory creates:
4+
5+
- ECS Service in a pre-configured ECS Cluster and corresponding ECS Capacity Providers
6+
- Internet-facing Application Load Balancer to access the deployed services with S3 bucket for storing access and connection logs, and
7+
- ACM to generate and validate an Amazon-issued certificate for a base domain
8+
9+
## Example `tfvars` Configuration
10+
11+
```tf
12+
vpc_id = "vpc-0123456789abcdefg"
13+
service_network_configuration_security_groups = ["sg-0123456789abcdefg"]
14+
private_subnets = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
15+
public_subnets = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
16+
cluster_name = "your-cluster-name"
17+
container_name = "your-container-name"
18+
service_desired_count = 123
19+
container_image = "your-container-image:version"
20+
container_port = 123
21+
container_cpu = 123
22+
container_memory = 123
23+
container_essential = true
24+
container_port_mappings = [
25+
{
26+
name = "your-port-mapping-name"
27+
containerPort = 123
28+
hostPort = 123
29+
protocol = "your-port-mapping-protocol"
30+
}
31+
]
32+
container_readonly_root_filesystem = false
33+
asg_arn = "arn:aws:autoscaling:your-region:01234567890:autoScalingGroup:abcdefgh-ijkl-mnop-qrst-uvwxyz012345:autoScalingGroupName/your-autoscaling-group-name"
34+
capacity_provider_name = "your-capacity-provider-name"
35+
capacity_provider_managed_scaling = {
36+
status = "ENABLED"
37+
target_capacity = 123
38+
minimum_scaling_step_size = 123
39+
maximum_scaling_step_size = 123
40+
}
41+
alb_name = "your-alb-name"
42+
target_group_name = "your-alb-target-group-name"
43+
target_group_protocol = "HTTP"
44+
target_group_health_check = {
45+
path = "/path/to/health/check"
46+
}
47+
listener_port = 123
48+
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
49+
security_group_alb = "your-alb-sg-name"
50+
s3_bucket_force_destroy = true
51+
base_domain = "example.com"
52+
domain_name = "your-service.example.com"
53+
region = "us-east-1"
54+
route53_assume_role_arn = "arn:aws:iam::123456789012:role/Route53CrossAccountRole"
55+
```
56+
57+
## Usage
58+
59+
To run this example, you will need to execute the commands:
60+
61+
```bash
62+
terraform init
63+
terraform plan
64+
terraform apply
65+
```
66+
67+
Please note that this example may create resources that can incur monetary charges on your AWS bill. You can run `terraform destroy` when you no longer need the resources.

‎examples/cross-account/README.md‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
# ECS Deployment Complete
3+
4+
Configuration in this directory creates:
5+
6+
- ECS Service in a pre-configured ECS Cluster and corresponding ECS Capacity Providers
7+
- Internet-facing Application Load Balancer to access the deployed services with S3 bucket for storing access and connection logs, and
8+
- ACM to generate and validate an Amazon-issued certificate for a base domain
9+
10+
11+
## Prerequisites
12+
13+
**Create an IAM Role in the Hosted Zone Account (Account B)**
14+
If you want to validate ACM certificates across accounts, ensure that an IAM role exists in Account B (Route53 Hosted Zone account) that grants cross-account access to manage Route53 DNS records.
15+
This role must allow Account A (where ACM and your application resources are created) to assume it.
16+
It should include permissions such as:
17+
18+
route53:ChangeResourceRecordSets
19+
route53:ListHostedZonesByName
20+
route53:ListResourceRecordSets
21+
22+
And a trust policy allowing Account A to assume the role.
23+
24+
25+
## Example `tfvars` Configuration
26+
27+
```tf
28+
vpc_id = "vpc-0123456789abcdefg"
29+
service_network_configuration_security_groups = ["sg-0123456789abcdefg"]
30+
private_subnets = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
31+
public_subnets = ["subnet-0123456789abcdefg", "subnet-0123456789abcdefg"]
32+
33+
cluster_name = "your-cluster-name"
34+
container_name = "your-container-name"
35+
service_desired_count = 123
36+
container_image = "your-container-image:version"
37+
container_port = 123
38+
container_cpu = 123
39+
container_memory = 123
40+
container_essential = true
41+
container_port_mappings = [
42+
{
43+
name = "your-port-mapping-name"
44+
containerPort = 123
45+
hostPort = 123
46+
protocol = "your-port-mapping-protocol"
47+
}
48+
]
49+
container_readonly_root_filesystem = false
50+
51+
asg_arn = "arn:aws:autoscaling:your-region:01234567890:autoScalingGroup:abcdefgh-ijkl-mnop-qrst-uvwxyz012345:autoScalingGroupName/your-autoscaling-group-name"
52+
capacity_provider_name = "your-capacity-provider-name"
53+
capacity_provider_managed_scaling = {
54+
status = "ENABLED"
55+
target_capacity = 123
56+
minimum_scaling_step_size = 123
57+
maximum_scaling_step_size = 123
58+
}
59+
60+
alb_name = "your-alb-name"
61+
target_group_name = "your-alb-target-group-name"
62+
target_group_protocol = "HTTP"
63+
target_group_health_check = {
64+
path = "/path/to/health/check"
65+
}
66+
listener_port = 123
67+
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
68+
security_group_alb = "your-alb-sg-name"
69+
70+
s3_bucket_force_destroy = true
71+
72+
base_domain = "example.com"
73+
domain_name = "your-service.example.com"
74+
region = "us-east-1"
75+
route53_assume_role_arn = "arn:aws:iam::123456789012:role/Route53CrossAccountRole"
76+
```
77+
78+
## Usage
79+
80+
To run this example, you will need to execute the commands:
81+
82+
```bash
83+
terraform init
84+
terraform plan
85+
terraform apply
86+
```
87+
88+
Please note that this example may create resources that can incur monetary charges on your AWS bill. You can run `terraform destroy` when you no longer need the resources.
89+
90+
## Requirements
91+
92+
| Name | Version |
93+
|------|---------|
94+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6.0 |
95+
96+
## Providers
97+
98+
| Name | Version |
99+
|------|---------|
100+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.62.0 |
101+
102+
## Modules
103+
104+
| Name | Source | Version |
105+
|------|--------|---------|
106+
| <a name="module_ecs_deployment"></a> [ecs\_deployment](#module\_ecs\_deployment) | ../../ | n/a |
107+
108+
## Resources
109+
110+
| Name | Type |
111+
|------|------|
112+
| [aws_security_group.alb_allow_all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
113+
| [aws_route53_zone.base_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
114+
115+
## Inputs
116+
117+
| Name | Description | Type | Default | Required |
118+
|------|-------------|------|---------|:--------:|
119+
| <a name="input_alb_name"></a> [alb\_name](#input\_alb\_name) | Name of the application load balancer | `string` | n/a | yes |
120+
| <a name="input_asg_arn"></a> [asg\_arn](#input\_asg\_arn) | ARN of the Auto Scaling group | `string` | n/a | yes |
121+
| <a name="input_base_domain"></a> [base\_domain](#input\_base\_domain) | Base domain for ACM | `string` | n/a | yes |
122+
| <a name="input_capacity_provider_managed_scaling"></a> [capacity\_provider\_managed\_scaling](#input\_capacity\_provider\_managed\_scaling) | Managed scaling configuration for the Capacity Provider | `any` | n/a | yes |
123+
| <a name="input_capacity_provider_name"></a> [capacity\_provider\_name](#input\_capacity\_provider\_name) | Name of the Capacity Provider | `string` | n/a | yes |
124+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the ECS cluster | `string` | n/a | yes |
125+
| <a name="input_container_cpu"></a> [container\_cpu](#input\_container\_cpu) | CPU units to allocate to the container | `number` | n/a | yes |
126+
| <a name="input_container_essential"></a> [container\_essential](#input\_container\_essential) | Essential flag for the container | `bool` | n/a | yes |
127+
| <a name="input_container_image"></a> [container\_image](#input\_container\_image) | Image of the container | `string` | n/a | yes |
128+
| <a name="input_container_memory"></a> [container\_memory](#input\_container\_memory) | Memory in MB to allocate to the container | `number` | n/a | yes |
129+
| <a name="input_container_name"></a> [container\_name](#input\_container\_name) | Name of the container | `string` | n/a | yes |
130+
| <a name="input_container_port"></a> [container\_port](#input\_container\_port) | Port on which the container will listen | `number` | n/a | yes |
131+
| <a name="input_container_port_mappings"></a> [container\_port\_mappings](#input\_container\_port\_mappings) | Port mappings for the container | `any` | n/a | yes |
132+
| <a name="input_container_readonly_root_filesystem"></a> [container\_readonly\_root\_filesystem](#input\_container\_readonly\_root\_filesystem) | Whether the root filesystem is readonly for the container | `bool` | n/a | yes |
133+
| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | Domain name for ACM | `string` | n/a | yes |
134+
| <a name="input_listener_port"></a> [listener\_port](#input\_listener\_port) | Port for the ALB listener | `number` | n/a | yes |
135+
| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | List of private subnet IDs | `list(string)` | n/a | yes |
136+
| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | List of public subnet IDs | `list(string)` | n/a | yes |
137+
| <a name="input_s3_bucket_force_destroy"></a> [s3\_bucket\_force\_destroy](#input\_s3\_bucket\_force\_destroy) | (Optional, Default:false) Boolean that indicates all objects (including any locked objects) should be deleted from the bucket when the bucket is destroyed so that the bucket can be destroyed without error. | `bool` | n/a | yes |
138+
| <a name="input_security_group_alb"></a> [security\_group\_alb](#input\_security\_group\_alb) | Name of the security group for ALB | `string` | n/a | yes |
139+
| <a name="input_service_desired_count"></a> [service\_desired\_count](#input\_service\_desired\_count) | Desired count for the ECS Service | `number` | n/a | yes |
140+
| <a name="input_service_network_configuration_security_groups"></a> [service\_network\_configuration\_security\_groups](#input\_service\_network\_configuration\_security\_groups) | Security Groups for the ECS Service's Network Configuration | `list(string)` | n/a | yes |
141+
| <a name="input_ssl_policy"></a> [ssl\_policy](#input\_ssl\_policy) | SSL policy for the ALB | `string` | n/a | yes |
142+
| <a name="input_target_group_health_check"></a> [target\_group\_health\_check](#input\_target\_group\_health\_check) | Health check configuration for the target group | `any` | n/a | yes |
143+
| <a name="input_target_group_name"></a> [target\_group\_name](#input\_target\_group\_name) | Name of the target group | `string` | n/a | yes |
144+
| <a name="input_target_group_protocol"></a> [target\_group\_protocol](#input\_target\_group\_protocol) | Protocol to use with the target group | `string` | n/a | yes |
145+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC ID where the resources will be deployed | `string` | n/a | yes |
146+
147+
## Outputs
148+
149+
| Name | Description |
150+
|------|-------------|
151+
| <a name="output_acm_amazon_issued_certificate_arn"></a> [acm\_amazon\_issued\_certificate\_arn](#output\_acm\_amazon\_issued\_certificate\_arn) | ARN of the ACM Amazon-issued certificate for the base domain |
152+
| <a name="output_alb_allow_all_sg_id"></a> [alb\_allow\_all\_sg\_id](#output\_alb\_allow\_all\_sg\_id) | ID of the Security Group for Application Load Balancer to allow all traffic from any source |
153+
| <a name="output_alb_arn"></a> [alb\_arn](#output\_alb\_arn) | ARN of the Application Load Balancer ECS Service |
154+
| <a name="output_ecs_capacity_provider_arn"></a> [ecs\_capacity\_provider\_arn](#output\_ecs\_capacity\_provider\_arn) | ARN of the ECS Capacity Provider |
155+
| <a name="output_ecs_capacity_provider_id"></a> [ecs\_capacity\_provider\_id](#output\_ecs\_capacity\_provider\_id) | Identifier of the ECS Capacity Provider |
156+
| <a name="output_ecs_cluster_capacity_providers_id"></a> [ecs\_cluster\_capacity\_providers\_id](#output\_ecs\_cluster\_capacity\_providers\_id) | Identifier of the ECS Cluster Capacity Providers |
157+
| <a name="output_ecs_service_arn"></a> [ecs\_service\_arn](#output\_ecs\_service\_arn) | ARN of the ECS Service |
158+
| <a name="output_listener_arn"></a> [listener\_arn](#output\_listener\_arn) | ARN of the ALB Listener forwarding to container instances |
159+
| <a name="output_listener_id"></a> [listener\_id](#output\_listener\_id) | Identifier of the ALB Listener forwarding to container instances |
160+
| <a name="output_target_group_arn"></a> [target\_group\_arn](#output\_target\_group\_arn) | ARN of the Target Group instances |
161+
| <a name="output_target_group_id"></a> [target\_group\_id](#output\_target\_group\_id) | Identifier of the Target Group instances |
162+
| <a name="output_task_definition_arn"></a> [task\_definition\_arn](#output\_task\_definition\_arn) | ARN of the ECS Task Definition |
163+
<!-- END_TF_DOCS -->

‎examples/complete/main.tf‎ renamed to ‎examples/cross-account/main.tf‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,18 @@
11
provider "aws" {
2-
region = "ap-south-1"
2+
region = var.region
33
}
4+
45
provider "aws" {
56
alias = "cross_account_provider"
67
region = var.region
78

8-
dynamic "assume_role" {
9-
for_each = var.route53_assume_role_arn != null ? [1] : []
10-
content {
11-
role_arn = var.route53_assume_role_arn
12-
}
9+
assume_role {
10+
role_arn = var.route53_assume_role_arn
1311
}
1412
}
1513

1614
locals {
17-
task_definition_network_mode = "awsvpc"
18-
15+
task_definition_network_mode = "awsvpc"
1916
capacity_provider_default_strategies_weight = 1
2017
capacity_provider_default_strategies_base = 0
2118

‎examples/complete/outputs.tf‎ renamed to ‎examples/cross-account/outputs.tf‎

File renamed without changes.

‎examples/complete/variables.tf‎ renamed to ‎examples/cross-account/variables.tf‎

File renamed without changes.

‎examples/complete/versions.tf‎ renamed to ‎examples/cross-account/versions.tf‎

File renamed without changes.

‎examples/complete/.header.md‎ renamed to ‎examples/same-account/.header.md‎

File renamed without changes.

‎examples/complete/README.md‎ renamed to ‎examples/same-account/README.md‎

File renamed without changes.

0 commit comments

Comments
 (0)