Jon Chery
fda4564a7f
EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to
terraform/platform, drops the vpc child from the microservice composition
(references the platform VPC via data source), and makes state keys
env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle).
Platform VPC (terraform/platform/main.tf):
- aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG
- Outputs: vpc_id, subnet_ids, ecs_security_group_id
Microservice composition (modules/l2/microservice/composition.json):
- Dropped the vpc child (no per-contract VPC ever again).
- Added data_sources block: platform_vpc → terraform_remote_state (platform).
- Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids.
- Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id.
- Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group.
Contract resolver (core/contract_resolver.py):
- Added environment to the stack instance (stack.environment).
- Added data_sources handling: pseudo-children with outputs but no resources.
- data_sources propagated through fragment merge to the final stack instance.
Adapter (adapters/terraform/adapter.py):
- State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware).
- Emits data "terraform_remote_state" "platform" block when data_sources present.
- ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>.
Tests (tests/test_adapter.py):
- test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate.
- test_adapt_emits_data_source_block: data.terraform_remote_state.platform.
- test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output.
- Updated existing state key assertion (spike/s3/dev/terraform.tfstate).
Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only
passes for both microservice (9 resources, no VPC) and static-assets (5 resources).
---ci---
project: acdl
phase: P58
milestone: v1.11
status: execute
---/ci---
microservice — ECS Fargate microservice
Module kind: module pattern | Version: 1.0.0
A pattern that references multiple primitives to deploy an ECS Fargate microservice end-to-end (VPC, cluster, ECR, IAM role, ALB, ECS service).
Resources
The pattern references these primitives:
| Primitive | Purpose | README |
|---|---|---|
vpc |
VPC, subnets, routing | README |
ecs-cluster |
ECS Fargate cluster | README |
ecr |
ECR image repository | README |
iam-role |
IAM task execution role | README |
alb |
Application Load Balancer | README |
ecs-service |
ECS task definition + service | README |
Inputs
| Name | Type | Required | Description |
|---|---|---|---|
image |
string | yes | ECR image URL for the task container |
port |
number | yes | Container port the service listens on |
region |
string | yes | AWS region |
cidr |
string | no | VPC CIDR block (default 10.0.0.0/16) |
azs |
string | no | Comma-separated availability zones |
Outputs
| Name | Type | Description |
|---|---|---|
lb_arn |
arn | The load balancer ARN |
service_arn |
arn | The ECS service ARN |
Usage
Define a contract referencing this module:
environment: dev
id: msvc
infrastructure:
microservice:
inputs:
image: 581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest
port: 8080
region: us-east-1
version: 1.0.0
name: microservice
Compliance extension points
The pattern can wire compliance resources across primitives when the compliance milestone (GDPR, SOX, SOC2, DORA) lands:
- KMS key — shared encryption key referenced by S3, ECR, CloudWatch Logs, and Secrets Manager.
- CloudTrail — management-plane audit trail for the entire stack.
- VPC Flow Logs — network audit trail.
- Security groups — proper network segmentation between ALB, service, and data tiers.
- Private subnets — ECS tasks in private subnets with NAT egress.
See each primitive's README for per-module compliance extension points.
Examples
Validated example contracts are in examples/. The platform-test
pipeline validates them against schemas/contract.schema.json.
Simple
A minimal deployment (minimal Fargate, no ALB):
environment: dev
id: msvc
infrastructure:
microservice:
inputs:
bucket_name: my-microservice-demo
image: public.ecr.aws/docker/library/nginx:latest
port: 80
region: us-east-1
version: 1.0.0
name: microservice
Complex
A production deployment with optional inputs (ALB + env vars + health check):
environment: dev
id: msvc
infrastructure:
microservice:
inputs:
bucket_name: my-production-microservice
env:
ENVIRONMENT: production
LOG_LEVEL: info
image: public.ecr.aws/docker/library/nginx:latest
port: 8080
region: us-east-1
version: 1.0.0
name: microservice
Versioning
1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.