Jon Chery
cec34abc22
The live terraform apply (P4) uncovered a P2 module-completeness gap: the ecs-service L1 aws_ecs_task_definition was missing execution_role_arn + task_role_arn, and the microservice L2 composition did not wire roles.outputs.role_arn to the service. Fargate requires an execution role for ECR image pull. Fixed: interface.json + variables.tf + main.tf + composition.json wires. The iam-role assume-policy trusts ecs-tasks + the inline policy grants ECR pull + CW logs. A second live gap surfaced once the task definition applied: the ALB aws_lb had no security group (AWS rejects an ALB with an empty SG list). The platform VPC only outputs an ECS SG; the composition now wires platform_vpc.outputs.ecs_security_group_id to alb.inputs.security_group (the ECS SG opens port 80 to 0.0.0.0/0 — acceptable for an internet-facing ALB + dev pilot per D-020). No iam-role module changes were needed — its locals.tf already trusts ecs-tasks.amazonaws.com and grants ECR pull + CloudWatch logs by default. Live apply now succeeds: Apply complete! Resources: 0 added, 1 changed, 0 destroyed (task def + ECS service created on the first re-apply; ALB SG updated in-place on the second). Full suite: 844 passed. ---ci--- project: acdl phase: 4 milestone: v1.26 status: execute wave: W1 ---
36 lines
1.2 KiB
Terraform
36 lines
1.2 KiB
Terraform
resource "aws_ecs_task_definition" "this" {
|
|
count = var.enabled ? 1 : 0
|
|
family = var.family
|
|
cpu = tostring(var.cpu)
|
|
memory = tostring(var.memory)
|
|
requires_compatibilities = local.requires_compatibilities
|
|
network_mode = local.network_mode
|
|
container_definitions = local.container_definitions
|
|
execution_role_arn = var.execution_role_arn
|
|
task_role_arn = var.task_role_arn != "" ? var.task_role_arn : null
|
|
}
|
|
|
|
resource "aws_ecs_service" "this" {
|
|
count = var.enabled ? 1 : 0
|
|
name = "nova-microservice"
|
|
cluster = var.cluster_arn
|
|
task_definition = aws_ecs_task_definition.this[0].arn
|
|
desired_count = var.desired_count
|
|
launch_type = var.launch_type
|
|
|
|
network_configuration {
|
|
subnets = local.subnet_list
|
|
security_groups = local.security_groups
|
|
assign_public_ip = var.launch_type == "FARGATE"
|
|
}
|
|
|
|
dynamic "load_balancer" {
|
|
for_each = var.lb_target_group_arn != null ? [1] : []
|
|
content {
|
|
target_group_arn = var.lb_target_group_arn
|
|
container_name = "app"
|
|
container_port = var.port
|
|
}
|
|
}
|
|
}
|