Jon Chery
cec34abc22
The live terraform apply (P4) uncovered a P2 module-completeness gap: the ecs-service L1 aws_ecs_task_definition was missing execution_role_arn + task_role_arn, and the microservice L2 composition did not wire roles.outputs.role_arn to the service. Fargate requires an execution role for ECR image pull. Fixed: interface.json + variables.tf + main.tf + composition.json wires. The iam-role assume-policy trusts ecs-tasks + the inline policy grants ECR pull + CW logs. A second live gap surfaced once the task definition applied: the ALB aws_lb had no security group (AWS rejects an ALB with an empty SG list). The platform VPC only outputs an ECS SG; the composition now wires platform_vpc.outputs.ecs_security_group_id to alb.inputs.security_group (the ECS SG opens port 80 to 0.0.0.0/0 — acceptable for an internet-facing ALB + dev pilot per D-020). No iam-role module changes were needed — its locals.tf already trusts ecs-tasks.amazonaws.com and grants ECR pull + CloudWatch logs by default. Live apply now succeeds: Apply complete! Resources: 0 added, 1 changed, 0 destroyed (task def + ECS service created on the first re-apply; ALB SG updated in-place on the second). Full suite: 844 passed. ---ci--- project: acdl phase: 4 milestone: v1.26 status: execute wave: W1 ---
98 lines
2.2 KiB
Terraform
98 lines
2.2 KiB
Terraform
variable "image" {
|
|
type = string
|
|
description = "ECR image URL for the task container."
|
|
}
|
|
|
|
variable "port" {
|
|
type = number
|
|
description = "Container port the service listens on."
|
|
default = 80
|
|
}
|
|
|
|
variable "cpu" {
|
|
type = number
|
|
description = "Task CPU units (Fargate)."
|
|
default = 256
|
|
}
|
|
|
|
variable "memory" {
|
|
type = number
|
|
description = "Task memory (MiB, Fargate)."
|
|
default = 512
|
|
}
|
|
|
|
variable "env" {
|
|
type = string
|
|
description = "Environment variables as a JSON map string (optional)."
|
|
default = null
|
|
}
|
|
|
|
variable "cluster_arn" {
|
|
type = string
|
|
description = "ECS cluster ARN (ref to ecs-cluster)."
|
|
}
|
|
|
|
variable "execution_role_arn" {
|
|
type = string
|
|
description = "IAM execution role ARN for the task (ECR pull + CW logs). Ref to iam-role."
|
|
}
|
|
|
|
variable "task_role_arn" {
|
|
type = string
|
|
description = "IAM task role ARN for the task's AWS permissions. Ref to iam-role. Optional; falls back to execution role when empty."
|
|
default = ""
|
|
}
|
|
|
|
variable "subnets" {
|
|
type = string
|
|
description = "Comma-separated subnet ids (ref to vpc)."
|
|
}
|
|
|
|
variable "security_group" {
|
|
type = string
|
|
description = "Security group id for the service ENIs."
|
|
default = null
|
|
}
|
|
|
|
variable "lb_target_group_arn" {
|
|
type = string
|
|
description = "Optional ALB target group ARN (ref to alb)."
|
|
default = null
|
|
}
|
|
|
|
variable "region" {
|
|
type = string
|
|
description = "AWS region (provider-level; not a resource arg)."
|
|
default = null
|
|
}
|
|
|
|
variable "kms_key_arn" {
|
|
type = string
|
|
description = "ARN of the CMK for CloudWatch log group encryption; if absent, uses managed key."
|
|
default = null
|
|
}
|
|
|
|
variable "desired_count" {
|
|
type = number
|
|
description = "Desired number of ECS task replicas (Fargate)."
|
|
default = 1
|
|
}
|
|
|
|
variable "launch_type" {
|
|
type = string
|
|
description = "ECS launch type (FARGATE or EC2)."
|
|
default = "FARGATE"
|
|
}
|
|
|
|
variable "family" {
|
|
type = string
|
|
description = "ECS task definition family name."
|
|
default = "app"
|
|
}
|
|
|
|
variable "enabled" {
|
|
type = bool
|
|
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
|
default = true
|
|
}
|