Create cluster using AWS CLI

[arun-gupta]

Show steps how to create an ECS cluster using AWS CLI

[arun-gupta]

/assign @tiffanyfj

[arun-gupta]

Blocked by #121

[tiffanyfay]

Technically speaking, only the EC2 part of the cluster is blocked by 121. Fargate is not as you don't set up instances.

[arun-gupta]

After discussion with the team, creating an ECS cluster using CLI may be fun but not a typical developer experience. CloudFormation and Console are the typical experiences.

Removing the text and keeping it here in case somebody finds it useful. It's not a fully working example at this time.

Here is the text that is created so far:

=== Deployment: Create Cluster using AWS CLI

This section will explain how to create an ECS cluster using AWS CLI.

Make sure to use `aws configure` to configure the `us-east-1` region.

. Create an ECS cluster:
+

aws ecs create-cluster --cluster-name MyCluster

+
. Create and/or identify AWS resources needed for the cluster
.. Get the list of key pairs:

  aws ec2 describe-key-pairs

.. Create a security group. Default VPC id will be used for the security group:
+

aws ec2 describe-vpcs
--query 'Vpcs[?IsDefault==true].VpcId'
--output text

+
Now, create the security group:
+

aws ec2 create-security-group
--group-name MySecurityGroup
--vpc-id
--description "ECS cluster security group"

+
Note the security group id, it'll be used in the next step.
+
Enable SSH and an ingress at port `80`:
+

aws ec2 authorize-security-group-ingress
--group-id
--protocol tcp
--port 22
--cidr 0.0.0.0/0;
aws ec2 authorize-security-group-ingress
--group-id
--protocol tcp
--port 80
--cidr 0.0.0.0/0

+
.. Container instances that run the agent require an IAM policy and role for the service to know that the agent belongs to you. Before you can launch container instances and register them into a cluster, you must create an IAM role for those container instances to use when they are launched.
+
If you've created an ECS cluster using the console then `ecsInstanceRole` is already created for you. Check if the role exists:
+

aws iam list-roles
--query 'Roles[?RoleName==ecsInstanceRole]'

+
If the output is empty, this means that the role does not exist and needs to be created. Create the role and attach the appropriate policies:
+

aws iam create-role
--role-name ecsInstanceRole2
--assume-role-policy-document file://ecs-assume-role-policy.json
aws iam put-role-policy
--role-name ecsInstanceRole2
--policy-name MyPolicy
--policy-document file://ecs-instance-role-policy.json
aws iam attach-role-policy
--role-name ecsInstanceRole2
--policy-arn arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole
aws iam attach-role-policy
--role-name ecsInstanceRole2
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

+
The container instance will be launched with these IAM permissions. This allows the ECS Agent in the EC2 instance to connect to the ECS cluster.
+
. Launch an instance (work in progress):
+

aws ec2 run-instances
--image-id ami-cb17d8b6
--count 3
--instance-type c4.large
--key-name arun-us-east1
--security-group-ids sg-059060666247be0db
--iam-instance-profile ecsInstanceRole2

+
The AMI id is for `us-east-1` as that is the only region where Fargate is currently supported. The complete list of AMI ids is listed at https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_container_instance.html.
+
By default, this instance is launched using a default subnet from the default VPC. Alternatively, you can use `--subnet-id` to specify the subnet from a different VPC.
+
This is causing https://github.com/aws-samples/aws-microservices-deploy-options/issues/121.
+
. List the container instances in the cluster:
+

aws ecs list-container-instances --cluster MyCluster

This concludes the creation of an ECS cluster using AWS CLI.

https://github.com/aws-samples/aws-microservices-deploy-options/issues/101