Jon Chery
cec34abc22
The live terraform apply (P4) uncovered a P2 module-completeness gap: the ecs-service L1 aws_ecs_task_definition was missing execution_role_arn + task_role_arn, and the microservice L2 composition did not wire roles.outputs.role_arn to the service. Fargate requires an execution role for ECR image pull. Fixed: interface.json + variables.tf + main.tf + composition.json wires. The iam-role assume-policy trusts ecs-tasks + the inline policy grants ECR pull + CW logs. A second live gap surfaced once the task definition applied: the ALB aws_lb had no security group (AWS rejects an ALB with an empty SG list). The platform VPC only outputs an ECS SG; the composition now wires platform_vpc.outputs.ecs_security_group_id to alb.inputs.security_group (the ECS SG opens port 80 to 0.0.0.0/0 — acceptable for an internet-facing ALB + dev pilot per D-020). No iam-role module changes were needed — its locals.tf already trusts ecs-tasks.amazonaws.com and grants ECR pull + CloudWatch logs by default. Live apply now succeeds: Apply complete! Resources: 0 added, 1 changed, 0 destroyed (task def + ECS service created on the first re-apply; ALB SG updated in-place on the second). Full suite: 844 passed. ---ci--- project: acdl phase: 4 milestone: v1.26 status: execute wave: W1 ---
50 lines
3.1 KiB
JSON
50 lines
3.1 KiB
JSON
{
|
|
"name": "microservice",
|
|
"version": "1.0.0",
|
|
"kind": "l2",
|
|
"depth": 1,
|
|
"description": "A composition that references five L1 primitives to deploy an ECS Fargate microservice end-to-end. The VPC is owned by the platform (terraform/platform) and referenced via data source — no per-contract VPC.",
|
|
"children": [
|
|
{"id": "cluster", "module": "ecs-cluster@1.0.0"},
|
|
{"id": "ecr", "module": "ecr@1.0.0"},
|
|
{"id": "roles", "module": "iam-role@1.0.0"},
|
|
{"id": "alb", "module": "alb@1.0.0"},
|
|
{"id": "service", "module": "ecs-service@1.0.0"},
|
|
{"id": "kms", "module": "kms-key@1.0.0"}
|
|
],
|
|
"data_sources": [
|
|
{"name": "platform_vpc", "type": "terraform_remote_state", "source": "platform", "outputs": ["vpc_id", "subnet_ids", "ecs_security_group_id"]}
|
|
],
|
|
"wires": [
|
|
{"from": "contract.inputs.name", "to": "alb.inputs.name", "default": "app"},
|
|
{"from": "contract.inputs.name", "to": "ecr.inputs.name", "default": "app-repo"},
|
|
{"from": "contract.inputs.name", "to": "roles.inputs.role_name", "default": "nova-app-role"},
|
|
{"from": "contract.inputs.region", "to": "cluster.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "ecr.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "roles.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "alb.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "service.inputs.region"},
|
|
{"from": "platform_vpc.outputs.subnet_ids", "to": "alb.inputs.subnets"},
|
|
{"from": "platform_vpc.outputs.subnet_ids", "to": "service.inputs.subnets"},
|
|
{"from": "platform_vpc.outputs.vpc_id", "to": "alb.inputs.vpc_id"},
|
|
{"from": "platform_vpc.outputs.ecs_security_group_id", "to": "alb.inputs.security_group"},
|
|
{"from": "platform_vpc.outputs.ecs_security_group_id", "to": "service.inputs.security_group"},
|
|
{"from": "cluster.outputs.cluster_arn", "to": "service.inputs.cluster_arn"},
|
|
{"from": "roles.outputs.role_arn", "to": "service.inputs.execution_role_arn"},
|
|
{"from": "roles.outputs.role_arn", "to": "service.inputs.task_role_arn"},
|
|
{"from": "ecr.outputs.repository_url", "to": "service.inputs.image"},
|
|
{"from": "alb.outputs.target_group_arn", "to": "service.inputs.lb_target_group_arn"},
|
|
{"from": "contract.inputs.region", "to": "kms.inputs.region"},
|
|
{"from": "kms.outputs.kms_key_arn", "to": "ecr.inputs.kms_key_arn"},
|
|
{"from": "contract.inputs.desired_count", "to": "service.inputs.desired_count", "default": 1},
|
|
{"from": "contract.inputs.launch_type", "to": "service.inputs.launch_type", "default": "FARGATE"},
|
|
{"from": "contract.inputs.family", "to": "service.inputs.family", "default": "app"},
|
|
{"from": "contract.inputs.load_balancer_type", "to": "alb.inputs.load_balancer_type", "default": "application"},
|
|
{"from": "contract.inputs.target_type", "to": "alb.inputs.target_type", "default": "ip"}
|
|
],
|
|
"outputs": [
|
|
{"from": "alb.outputs.lb_arn", "to": "stack.outputs.lb_arn"},
|
|
{"from": "service.outputs.service_arn", "to": "stack.outputs.service_arn"},
|
|
{"from": "kms.outputs.kms_key_arn", "to": "stack.outputs.kms_key_arn"}
|
|
]
|
|
} |