continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(P04 W1): ecs-service execution_role_arn + task_role_arn wiring (live apply gap)

Browse Source 
The live terraform apply (P4) uncovered a P2 module-completeness gap: the
ecs-service L1 aws_ecs_task_definition was missing execution_role_arn +
task_role_arn, and the microservice L2 composition did not wire
roles.outputs.role_arn to the service. Fargate requires an execution role
for ECR image pull. Fixed: interface.json + variables.tf + main.tf +
composition.json wires. The iam-role assume-policy trusts ecs-tasks +
the inline policy grants ECR pull + CW logs.

A second live gap surfaced once the task definition applied: the ALB
aws_lb had no security group (AWS rejects an ALB with an empty SG list).
The platform VPC only outputs an ECS SG; the composition now wires
platform_vpc.outputs.ecs_security_group_id to alb.inputs.security_group
(the ECS SG opens port 80 to 0.0.0.0/0 — acceptable for an internet-facing
ALB + dev pilot per D-020). No iam-role module changes were needed — its
locals.tf already trusts ecs-tasks.amazonaws.com and grants ECR pull +
CloudWatch logs by default.

Live apply now succeeds: Apply complete! Resources: 0 added, 1 changed, 0
destroyed (task def + ECS service created on the first re-apply; ALB SG
updated in-place on the second). Full suite: 844 passed.

---ci---
project: acdl
phase: 4
milestone: v1.26
status: execute
wave: W1
---
This commit is contained in:
Jon Chery
2026-08-19 03:01:47 +00:00
parent 6b60c0cbe3
commit cec34abc22
4 changed files with 31 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/l2/microservice/composition.json
+3
View File
@@ -27,8 +27,11 @@
{"from": "platform_vpc.outputs.subnet_ids", "to": "alb.inputs.subnets"},
{"from": "platform_vpc.outputs.subnet_ids", "to": "service.inputs.subnets"},
{"from": "platform_vpc.outputs.vpc_id", "to": "alb.inputs.vpc_id"},
{"from": "platform_vpc.outputs.ecs_security_group_id", "to": "alb.inputs.security_group"},
{"from": "platform_vpc.outputs.ecs_security_group_id", "to": "service.inputs.security_group"},
{"from": "cluster.outputs.cluster_arn", "to": "service.inputs.cluster_arn"},
{"from": "roles.outputs.role_arn", "to": "service.inputs.execution_role_arn"},
{"from": "roles.outputs.role_arn", "to": "service.inputs.task_role_arn"},
{"from": "ecr.outputs.repository_url", "to": "service.inputs.image"},
{"from": "alb.outputs.target_group_arn", "to": "service.inputs.lb_target_group_arn"},
{"from": "contract.inputs.region", "to": "kms.inputs.region"},