Skip to content

Commit 9d29599

Browse files
bryantbiggsbryantbiggs
committed
chore: Update upgrade guide, add container definition example for testing
1 parent f3c9f66 commit 9d29599

File tree

10 files changed

+642
-15
lines changed

10 files changed

+642
-15
lines changed

‎docs/UPGRADE-6.0.md

Lines changed: 183 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,21 @@ If you find a bug, please open an issue with supporting configuration to reprodu
55

66
## List of backwards incompatible changes
77

8-
- Terraform v1.5.7 is now minimum supported version
9-
- AWS provider v6.0.0 is now minimum supported version
8+
- Terraform `v1.5.7` is now minimum supported version
9+
- AWS provider `v6.0.0` is now minimum supported version
10+
- The attributes used to construct the container definition(s) have been changed from HCL's norm of `snake_case` to `camelCase` to match the AWS API. There currently isn't a [resource nor data source for the container definition](https://github.com/hashicorp/terraform-provider-aws/issues/17988), so one is constructed entirely from HCL in the `container-definition` sub-module. This definition is then rendered as JSON when presented to the task definition (or task set) APIs. Previously, the variable names used were `snake_case` and then internally converted to `camelCase`. However, this does not allow for [using the `container-definition` sub-module on its own](https://github.com/terraform-aws-modules/terraform-aws-ecs/issues/147) due to the mismatch between casing. Its probably going to trip a few folks up, but hopefully we'll remove this for a data source in the future.
11+
- `security_group_rules` has been split into `security_group_ingress_rules` and `security_group_egress_rules` to better match the AWS API and allow for more flexibility in defining security group rules.
12+
- Default permissive permissions for SSM parameter ARNs and Secrets Manager secret ARNs have been removed throughout. While this made it easier for users since it "just worked", it was not secure and could lead to unexpected access to resources. Users should now explicitly define the permissions they need in their IAM policies.
13+
- The "hack" put in place to track the task definition version when updating outside of the module has been removed. Instead, users should rely on the `track_latest` variable to ensure that the latest task definition is used when updating the service. Any issues with tracking the task definition version should be reported to the *ECS service team* as it is a limitation of the AWS ECS service/API and not the module itself.
14+
- The inline policy for the Tasks role of the `service` sub-module has been replaced with a standalone IAM policy. In some organizations, inline policies are not allowed.
15+
- The default for the `container-definition` `user` has been changed from `0` to `null`.
1016

1117
## Additional changes
1218

1319
### Added
1420

1521
- Support for `region` parameter to specify the AWS region for the resources created if different from the provider region.
22+
- Support for ECS infrastructure IAM role creation in the `service` sub-module. This role is used to manage ECS infrastructure resources https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html
1623

1724
### Modified
1825

@@ -22,35 +29,148 @@ If you find a bug, please open an issue with supporting configuration to reprodu
2229

2330
1. Removed variables:
2431

25-
-
32+
- `default_capacity_provider_use_fargate`
33+
- `fargate_capacity_providers`
34+
35+
- `cluster` sub-module
36+
- `fargate_capacity_providers`; part of `default_capacity_provider_strategy` now
37+
- `default_capacity_provider_use_fargate`
38+
39+
- `container-definition` sub-module
40+
- None
41+
42+
- `service` sub-module
43+
- `inference_accelerator`
44+
2645

2746
2. Renamed variables:
2847

29-
-
48+
- `cluster_settings` -> `cluster_setting`
49+
50+
- `cluster` sub-module
51+
- `cluster_configuration` - `configuration`
52+
- `cluster_settings` - `setting`
53+
- `cluster_service_connect_defaults` - `service_connect_defaults`
54+
55+
- `container-definition` sub-module
56+
- `dependencies` - `dependsOn`
57+
- `disable_networking` - `disableNetworking`
58+
- `dns_search_domains` - `dnsSearchDomains`
59+
- `dns_servers` - `dnsServers`
60+
- `docker_labels` - `dockerLabels`
61+
- `docker_security_options` - `dockerSecurityOptions`
62+
- `environment_files` - `environmentFiles`
63+
- `extra_hosts` - `extraHosts`
64+
- `firelens_configuration` - `firelensConfiguration`
65+
- `health_check` - `healthCheck`
66+
- `linux_parameters` - `linuxParameters`
67+
- `log_configuration` - `logConfiguration`
68+
- `memory_reservation` - `memoryReservation`
69+
- `mount_points` - `mountPoints`
70+
- `port_mappings` - `portMappings`
71+
- `psuedo_terminal` - `pseudoTerminal`
72+
- `readonly_root_filesystem` - `readonlyRootFilesystem`
73+
- `repository_credentials` - `repositoryCredentials`
74+
- `start_timeout` - `startTimeout`
75+
- `system_controls` - `systemControls`
76+
- `volumes_from` - `volumesFrom`
77+
- `working_directory` - `workingDirectory`
78+
79+
- `service` sub-module
80+
- None
3081

3182
3. Added variables:
3283

33-
-
84+
- `cloudwatch_log_group_class`
85+
- `default_capacity_provider_strategy`
86+
87+
- `cluster` sub-module
88+
- `cloudwatch_log_group_class`
89+
- `default_capacity_provider_strategy` - replaces `fargate_capacity_providers` and `default_capacity_provider_use_fargate` functionality
90+
91+
- `container-definition` sub-module
92+
- `log_group_class`
93+
- `restartPolicy` - defaults to `enabled = true`
94+
- `versionConsistency` - defaults to `"disabled"` https://github.com/aws/containers-roadmap/issues/2394
95+
96+
- `service` sub-module
97+
- `availability_zone_rebalancing`
98+
- `volume_configuration`
99+
- `vpc_lattice_configurations`
100+
- `enable_fault_injection`
101+
- `track_latest`
102+
- `create_infrastructure_iam_role`
103+
- `infrastructure_iam_role_arn`
104+
- `infrastructure_iam_role_name`
105+
- `infrastructure_iam_role_use_name_prefix`
106+
- `infrastructure_iam_role_path`
107+
- `infrastructure_iam_role_description`
108+
- `infrastructure_iam_role_permissions_boundary`
109+
- `infrastructure_iam_role_tags`
34110

35111
4. Removed outputs:
36112

37-
-
113+
- `cluster` sub-module
114+
- None
115+
- `container-definition` sub-module
116+
- None
117+
- `service` sub-module
118+
- `task_definition_family_revision`
38119

39120
5. Renamed outputs:
40121

41-
-
122+
- `cluster` sub-module
123+
- None
124+
- `container-definition` sub-module
125+
- None
126+
- `service` sub-module
127+
- None
42128

43129
6. Added outputs:
44130

45-
-
131+
- `cluster` sub-module
132+
- None
133+
- `container-definition` sub-module
134+
- None
135+
- `service` sub-module
136+
- `infrastructure_iam_role_arn`
137+
- `infrastructure_iam_role_name`
46138

47139
## Upgrade Migrations
48140

49141
### Before 5.x Example
50142

143+
#### Cluster Sub-Module
144+
51145
```hcl
52-
module "ecs" {
53-
source = "terraform-aws-modules/ecs/aws"
146+
module "ecs_cluster" {
147+
source = "terraform-aws-modules/ecs/aws//modules/cluster"
148+
version = "~> 5.0"
149+
150+
# Truncated for brevity ...
151+
152+
# Capacity provider
153+
fargate_capacity_providers = {
154+
FARGATE = {
155+
default_capacity_provider_strategy = {
156+
weight = 50
157+
base = 20
158+
}
159+
}
160+
FARGATE_SPOT = {
161+
default_capacity_provider_strategy = {
162+
weight = 50
163+
}
164+
}
165+
}
166+
}
167+
```
168+
169+
#### Service Sub-Module
170+
171+
```hcl
172+
module "ecs_service" {
173+
source = "terraform-aws-modules/ecs/aws//modules/service"
54174
version = "~> 5.0"
55175
56176
# Truncated for brevity ...
@@ -122,6 +242,18 @@ module "ecs" {
122242
}
123243
}
124244
245+
service_connect_configuration = {
246+
namespace = aws_service_discovery_http_namespace.this.arn
247+
service = {
248+
client_alias = {
249+
port = 3000
250+
dns_name = "ecsdemo-frontend"
251+
}
252+
port_name = "ecsdemo-frontend"
253+
discovery_name = "ecsdemo-frontend"
254+
}
255+
}
256+
125257
security_group_rules = {
126258
alb_ingress_3000 = {
127259
type = "ingress"
@@ -142,10 +274,32 @@ module "ecs" {
142274

143275
### After 6.x Example
144276

145-
#### Service
277+
#### Cluster Sub-Module
146278

147279
```hcl
148-
module "ecs" {
280+
module "ecs_cluster" {
281+
source = "terraform-aws-modules/ecs/aws//modules/cluster"
282+
version = "~> 6.0"
283+
284+
# Truncated for brevity ...
285+
286+
# Cluster capacity providers
287+
default_capacity_provider_strategy = {
288+
FARGATE = {
289+
weight = 50
290+
base = 20
291+
}
292+
FARGATE_SPOT = {
293+
weight = 50
294+
}
295+
}
296+
}
297+
```
298+
299+
#### Service Sub-Module
300+
301+
```hcl
302+
module "ecs_service" {
149303
source = "terraform-aws-modules/ecs/aws//modules/service"
150304
version = "~> 6.0"
151305
@@ -224,6 +378,20 @@ module "ecs" {
224378
}
225379
}
226380
381+
service_connect_configuration = {
382+
namespace = aws_service_discovery_http_namespace.this.arn
383+
service = [
384+
{
385+
client_alias = {
386+
port = 3000
387+
dns_name = "ecsdemo-frontend"
388+
}
389+
port_name = "ecsdemo-frontend"
390+
discovery_name = "ecsdemo-frontend"
391+
}
392+
]
393+
}
394+
227395
security_group_ingress_rules = {
228396
alb_3000 = {
229397
description = "Service port"
@@ -242,15 +410,16 @@ module "ecs" {
242410

243411
### State Changes
244412

245-
#### Service
413+
#### Service Sub-Module
414+
415+
Due to the change from `aws_security_group_rule` to `aws_vpc_security_group_ingress_rule` and `aws_vpc_security_group_egress_rule`, the following reference state changes are required to maintain the current security group rules. (Note: these are different resources so they cannot be moved with `terraform mv ...`)
246416

247417
```sh
248418
terraform state rm 'module.ecs_service.aws_security_group_rule.this["alb_ingress_3000"]'
249419
terraform state import 'module.ecs_service.aws_vpc_security_group_ingress_rule.this["alb_3000"]' 'sg-xxx'
250420

251421
terraform state rm 'module.ecs_service.aws_security_group_rule.this["egress_all"]'
252422
terraform state import 'module.ecs_service.aws_vpc_security_group_egress_rule.this["all"]' 'sg-xxx'
253-
254423
```
255424

256425
The inline tasks `aws_iam_role_policy` cannot be moved or imported into a standalone `aws_iam_policy`. It must be re-created.

‎examples/container-definition/README.md

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# ECS Container Definition
2+
3+
Configuration in this directory creates:
4+
5+
- ECS container definition
6+
7+
## Usage
8+
9+
To run this example you need to execute:
10+
11+
```bash
12+
$ terraform init
13+
$ terraform plan
14+
$ terraform apply
15+
```
16+
17+
Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources.
18+
19+
<!-- BEGIN_TF_DOCS -->
20+
## Requirements
21+
22+
| Name | Version |
23+
|------|---------|
24+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
25+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
26+
27+
## Providers
28+
29+
| Name | Version |
30+
|------|---------|
31+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
32+
33+
## Modules
34+
35+
| Name | Source | Version |
36+
|------|--------|---------|
37+
| <a name="module_alb"></a> [alb](#module\_alb) | terraform-aws-modules/alb/aws | ~> 9.0 |
38+
| <a name="module_ecs_cluster"></a> [ecs\_cluster](#module\_ecs\_cluster) | ../../modules/cluster | n/a |
39+
| <a name="module_ecs_service"></a> [ecs\_service](#module\_ecs\_service) | ../../modules/service | n/a |
40+
| <a name="module_ecs_task_definition"></a> [ecs\_task\_definition](#module\_ecs\_task\_definition) | ../../modules/service | n/a |
41+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
42+
43+
## Resources
44+
45+
| Name | Type |
46+
|------|------|
47+
| [aws_service_discovery_http_namespace.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/service_discovery_http_namespace) | resource |
48+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
49+
| [aws_ssm_parameter.fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
50+
51+
## Inputs
52+
53+
No inputs.
54+
55+
## Outputs
56+
57+
| Name | Description |
58+
|------|-------------|
59+
| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | ARN that identifies the cluster |
60+
| <a name="output_cluster_autoscaling_capacity_providers"></a> [cluster\_autoscaling\_capacity\_providers](#output\_cluster\_autoscaling\_capacity\_providers) | Map of capacity providers created and their attributes |
61+
| <a name="output_cluster_capacity_providers"></a> [cluster\_capacity\_providers](#output\_cluster\_capacity\_providers) | Map of cluster capacity providers attributes |
62+
| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | ID that identifies the cluster |
63+
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | Name that identifies the cluster |
64+
| <a name="output_service_autoscaling_policies"></a> [service\_autoscaling\_policies](#output\_service\_autoscaling\_policies) | Map of autoscaling policies and their attributes |
65+
| <a name="output_service_autoscaling_scheduled_actions"></a> [service\_autoscaling\_scheduled\_actions](#output\_service\_autoscaling\_scheduled\_actions) | Map of autoscaling scheduled actions and their attributes |
66+
| <a name="output_service_container_definitions"></a> [service\_container\_definitions](#output\_service\_container\_definitions) | Container definitions |
67+
| <a name="output_service_iam_role_arn"></a> [service\_iam\_role\_arn](#output\_service\_iam\_role\_arn) | Service IAM role ARN |
68+
| <a name="output_service_iam_role_name"></a> [service\_iam\_role\_name](#output\_service\_iam\_role\_name) | Service IAM role name |
69+
| <a name="output_service_iam_role_unique_id"></a> [service\_iam\_role\_unique\_id](#output\_service\_iam\_role\_unique\_id) | Stable and unique string identifying the service IAM role |
70+
| <a name="output_service_id"></a> [service\_id](#output\_service\_id) | ARN that identifies the service |
71+
| <a name="output_service_name"></a> [service\_name](#output\_service\_name) | Name of the service |
72+
| <a name="output_service_security_group_arn"></a> [service\_security\_group\_arn](#output\_service\_security\_group\_arn) | Amazon Resource Name (ARN) of the security group |
73+
| <a name="output_service_security_group_id"></a> [service\_security\_group\_id](#output\_service\_security\_group\_id) | ID of the security group |
74+
| <a name="output_service_task_definition_arn"></a> [service\_task\_definition\_arn](#output\_service\_task\_definition\_arn) | Full ARN of the Task Definition (including both `family` and `revision`) |
75+
| <a name="output_service_task_definition_family"></a> [service\_task\_definition\_family](#output\_service\_task\_definition\_family) | The unique name of the task definition |
76+
| <a name="output_service_task_definition_revision"></a> [service\_task\_definition\_revision](#output\_service\_task\_definition\_revision) | Revision of the task in a particular family |
77+
| <a name="output_service_task_exec_iam_role_arn"></a> [service\_task\_exec\_iam\_role\_arn](#output\_service\_task\_exec\_iam\_role\_arn) | Task execution IAM role ARN |
78+
| <a name="output_service_task_exec_iam_role_name"></a> [service\_task\_exec\_iam\_role\_name](#output\_service\_task\_exec\_iam\_role\_name) | Task execution IAM role name |
79+
| <a name="output_service_task_exec_iam_role_unique_id"></a> [service\_task\_exec\_iam\_role\_unique\_id](#output\_service\_task\_exec\_iam\_role\_unique\_id) | Stable and unique string identifying the task execution IAM role |
80+
| <a name="output_service_task_set_arn"></a> [service\_task\_set\_arn](#output\_service\_task\_set\_arn) | The Amazon Resource Name (ARN) that identifies the task set |
81+
| <a name="output_service_task_set_id"></a> [service\_task\_set\_id](#output\_service\_task\_set\_id) | The ID of the task set |
82+
| <a name="output_service_task_set_stability_status"></a> [service\_task\_set\_stability\_status](#output\_service\_task\_set\_stability\_status) | The stability status. This indicates whether the task set has reached a steady state |
83+
| <a name="output_service_task_set_status"></a> [service\_task\_set\_status](#output\_service\_task\_set\_status) | The status of the task set |
84+
| <a name="output_service_tasks_iam_role_arn"></a> [service\_tasks\_iam\_role\_arn](#output\_service\_tasks\_iam\_role\_arn) | Tasks IAM role ARN |
85+
| <a name="output_service_tasks_iam_role_name"></a> [service\_tasks\_iam\_role\_name](#output\_service\_tasks\_iam\_role\_name) | Tasks IAM role name |
86+
| <a name="output_service_tasks_iam_role_unique_id"></a> [service\_tasks\_iam\_role\_unique\_id](#output\_service\_tasks\_iam\_role\_unique\_id) | Stable and unique string identifying the tasks IAM role |
87+
| <a name="output_task_definition_run_task_command"></a> [task\_definition\_run\_task\_command](#output\_task\_definition\_run\_task\_command) | awscli command to run the standalone task |
88+
<!-- END_TF_DOCS -->
89+
90+
## License
91+
92+
Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-ecs/blob/master/LICENSE).

0 commit comments

Comments
 (0)