@continuous-excellence/ze-great-dashboard-aws 0.13.7 → 0.14.0

package/dist/compute-mode.d.ts

@@ -0,0 +1,14 @@
+export type ComputeMode = 'lambda' | 'ecs';
+export type ComputeModeInputs = {
+    /** Mode from the checked-in bootstrap manifest. */
+    persisted?: string;
+    /** Mode from an existing/generated CloudFormation parameter file. */
+    artifact?: string;
+    /** Optional CLI assertion used for inspection and repair. */
+    explicit?: string;
+};
+/** Resolves every deployment mode decision and rejects contradictory selectors. */
+export declare function resolveComputeMode(input?: ComputeModeInputs): ComputeMode;
+export declare function computeMode(config: {
+    mode?: string;
+}): ComputeMode;

package/dist/guided.d.ts

@@ -1,4 +1,4 @@
-import { type BootstrapConfig } from './bootstrap.js';
+import { type BootstrapConfig, type ComputeMode } from './bootstrap.js';
 import { type BootstrapProvider, bootstrapHandoff, type CommandRunner } from './handoff.js';
 export type BootstrapCheckStatus = 'ready' | 'missing' | 'mismatch' | 'unverified';
 export type BootstrapPreflightCheck = {
@@ -11,6 +11,7 @@ export type BootstrapPreflight = {
     checks: BootstrapPreflightCheck[];
 };
 export type BootstrapInitInput = {
+    mode?: ComputeMode;
     slug: string;
     repository: string;
     environment: string;

package/dist/index.d.ts

@@ -1,8 +1,10 @@
-export { type BootstrapConfig, type BootstrapConsistency, type BootstrapKind, type BootstrapPlan, type BootstrapTemplateInspection, bootstrapConsistency, bootstrapContractVersion, bootstrapPlan, bootstrapTemplate, bootstrapTemplatePath, bootstrapTemplateRevision, type CloudFormationParameterValue, coreBootstrapOutputs, type DeployedBootstrapStack, deployedBootstrapStack, mergeBootstrapParameters, requiredBootstrapParameters, } from './bootstrap.js';
+import type { ComputeMode } from './bootstrap.js';
+export { type BootstrapConfig, type BootstrapConsistency, type BootstrapKind, type BootstrapPlan, type BootstrapTemplateInspection, bootstrapConsistency, bootstrapContractVersion, bootstrapPlan, bootstrapTemplate, bootstrapTemplatePath, bootstrapTemplateRevision, type CloudFormationParameterValue, type ComputeMode, computeMode, coreBootstrapOutputs, type DeployedBootstrapStack, deployedBootstrapStack, mergeBootstrapParameters, requireComputeMode, requiredBootstrapParameters, resolveComputeMode, } from './bootstrap.js';
 export { type BootstrapCheck, type BootstrapCheckDependencies, type BootstrapResourceDifference, type BootstrapResourceDrift, type BootstrapResourceDriftResult, type BootstrapStackCheck, checkBootstrap, formatBootstrapCheckText, } from './bootstrap-check.js';
 export { type BootstrapCheckStatus, type BootstrapInitInput, type BootstrapPreflight, type BootstrapPreflightCheck, bootstrapGuide, bootstrapPreflight, scaffoldBootstrapManifest, } from './guided.js';
 export { type BootstrapHandoff, type BootstrapPhase, type BootstrapProvider, type BootstrapVerification, bootstrapHandoff, type CommandRunner, githubOidcProvider, verifyBootstrap, } from './handoff.js';
 export type ReleaseMetadata = {
+    computeMode: ComputeMode;
     dashboardVersion: string;
     clientAssetUrl: string;
     serverRuntimeVersion: string;
@@ -14,6 +16,7 @@ export type ReleaseMetadata = {
 };
 export type PackagedRelease = ReleaseMetadata & {
     artifactKey: string;
+    image?: string;
 };
 export type LambdaPackageOptions = {
     boardConfigPath: string;
@@ -23,7 +26,13 @@ export type LambdaPackageOptions = {
     /** ARN of the consumer-owned JSON credential-map secret, never a secret value. */
     secretReference?: string;
 };
+export type EcsPackageOptions = Omit<LambdaPackageOptions, 'secretReference'> & {
+    secretReference?: string;
+    imageReference?: string;
+};
 export declare function packageLambda(options: LambdaPackageOptions): Promise<PackagedRelease>;
+/** Packages the published container reference and ECS CloudFormation handoff. */
+export declare function packageEcs(options: EcsPackageOptions): Promise<PackagedRelease>;
 export type PublishClientAssetsOptions = {
     assetsDir: string;
     assetsBucket: string;
@@ -32,4 +41,4 @@ export type PublishClientAssetsOptions = {
 };
 /** Publishes the versioned client half of a provider-managed release. */
 export declare function publishClientAssets(options: PublishClientAssetsOptions): Promise<string>;
-export declare function cloudFormationTemplate(): Promise<string>;
+export declare function cloudFormationTemplate(mode?: ComputeMode): Promise<string>;

package/dist/index.js

@@ -721,6 +721,9 @@ function zipSync(data, opts) {
   return out;
 }
 
+// packages/aws/src/index.ts
+import { parseDocument, Scalar } from "yaml";
+
 // packages/aws/src/release.ts
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -843,16 +846,52 @@ function sha256(value2) {
 // packages/aws/src/bootstrap.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
+
+// packages/aws/src/compute-mode.ts
+function valid(value2, label) {
+  if (value2 !== "lambda" && value2 !== "ecs")
+    throw new Error(`${label} must be lambda or ecs (received ${value2})`);
+  return value2;
+}
+function resolveComputeMode(input = {}) {
+  const persisted = input.persisted === void 0 ? void 0 : valid(input.persisted, "persisted mode");
+  const artifact = input.artifact === void 0 ? void 0 : valid(input.artifact, "ComputeMode");
+  const explicit = input.explicit === void 0 ? void 0 : valid(input.explicit, "mode");
+  const selected = persisted ?? explicit ?? artifact ?? "lambda";
+  if (artifact !== void 0 && artifact !== selected)
+    throw new Error(
+      `ComputeMode ${artifact} disagrees with persisted mode ${selected}; regenerate the bootstrap and parameter artifacts to change deployment mode`
+    );
+  if (explicit !== void 0 && explicit !== selected)
+    throw new Error(
+      `explicit mode ${explicit} disagrees with persisted mode ${selected}; regenerate the bootstrap and parameter artifacts to change deployment mode`
+    );
+  return selected;
+}
+function computeMode(config) {
+  return resolveComputeMode({ persisted: config.mode });
+}
+
+// packages/aws/src/bootstrap.ts
 var templates = {
-  core: "../bootstrap/core-v1.yml",
-  "github-oidc": "../bootstrap/github-oidc-v2.yml"
+  core: {
+    lambda: "../bootstrap/core-v1.yml",
+    ecs: "../bootstrap/core-ecs-v1.yml"
+  },
+  "github-oidc": {
+    lambda: "../bootstrap/github-oidc-v2.yml",
+    ecs: "../bootstrap/github-oidc-ecs-v1.yml"
+  }
 };
-async function bootstrapTemplatePath(kind) {
+function requireComputeMode(persisted, explicit) {
+  return resolveComputeMode({ persisted: persisted.mode, explicit });
+}
+async function bootstrapTemplatePath(kind, mode = "lambda") {
   if (!Object.hasOwn(templates, kind)) throw new Error(`Unknown bootstrap template: ${kind}`);
-  return fileURLToPath(new URL(templates[kind], import.meta.url));
+  return fileURLToPath(new URL(templates[kind][mode], import.meta.url));
 }
-async function bootstrapTemplate(kind) {
-  return readFile2(await bootstrapTemplatePath(kind), "utf8");
+async function bootstrapTemplate(kind, mode = "lambda") {
+  return readFile2(await bootstrapTemplatePath(kind, mode), "utf8");
 }
 function bootstrapContractVersion(template) {
   const version = template.match(/BootstrapContractVersion:\s*\{\s*Value:\s*'([^']+)'\s*}/)?.[1];
@@ -889,9 +928,10 @@ async function bootstrapPlan(config) {
   );
   const packageTemplates = await Promise.all(
     ["core", "github-oidc"].map(async (kind) => {
+      const mode = computeMode(config);
       const [path, template] = await Promise.all([
-        bootstrapTemplatePath(kind),
-        bootstrapTemplate(kind)
+        bootstrapTemplatePath(kind, mode),
+        bootstrapTemplate(kind, mode)
       ]);
       return inspectTemplate(kind, path, template);
     })
@@ -964,6 +1004,7 @@ function bootstrapConsistency(kind, config, stackInput, expectedContract, expect
     ArtifactBucketName: config.core?.artifactBucketName,
     ApplicationStackName: config.core?.applicationStackName,
     DashboardFunctionName: config.core?.dashboardFunctionName,
+    ComputeMode: config.mode,
     RuntimeSecretArn: config.core?.runtimeSecretArn ?? "",
     ArtifactKmsKeyArn: config.core?.artifactKmsKeyArn ?? ""
   } : {
@@ -975,6 +1016,7 @@ function bootstrapConsistency(kind, config, stackInput, expectedContract, expect
     CoreBootstrapStackName: config.core?.stackName,
     ApplicationStackName: config.core?.applicationStackName,
     ArtifactBucketName: config.core?.artifactBucketName,
+    ComputeMode: config.mode,
     CloudFormationExecutionRoleArn: coreOutputs.CloudFormationExecutionRoleArn,
     ConsumerGatewayStackName: config.githubOidc?.consumerGatewayStackName ?? ""
   };
@@ -1037,7 +1079,7 @@ function requiredBootstrapParameters(kind, values) {
   ];
   const missing = keys.filter((key) => !values[key]);
   if (missing.length) throw new Error(`Missing required bootstrap values: ${missing.join(", ")}`);
-  const optional2 = kind === "core" ? ["RuntimeSecretArn", "ArtifactKmsKeyArn"] : ["ConsumerGatewayStackName"];
+  const optional2 = kind === "core" ? ["RuntimeSecretArn", "ArtifactKmsKeyArn", "ComputeMode"] : ["ConsumerGatewayStackName", "ComputeMode"];
   return [...keys, ...optional2].filter((key) => values[key] !== void 0).map((ParameterKey) => ({ ParameterKey, ParameterValue: values[ParameterKey] ?? "" }));
 }
 
@@ -1460,14 +1502,16 @@ var githubOidcProvider = {
     }
   }
 };
-async function contracts() {
+async function contracts(config) {
   return {
-    core: bootstrapContractVersion(await bootstrapTemplate("core")),
-    githubOidc: bootstrapContractVersion(await bootstrapTemplate("github-oidc"))
+    core: bootstrapContractVersion(await bootstrapTemplate("core", computeMode(config))),
+    githubOidc: bootstrapContractVersion(
+      await bootstrapTemplate("github-oidc", computeMode(config))
+    )
   };
 }
 async function bootstrapHandoff(input) {
-  const expectedContracts = await contracts();
+  const expectedContracts = await contracts(input.config);
   const coreCapturePath = input.coreStackPath ?? workFile(input.workDir, "core-deployed-stack.json");
   const core = input.coreStack === void 0 ? void 0 : deployedBootstrapStack(input.coreStack, expectedContracts.core);
   const oidc = input.githubOidcStack === void 0 ? void 0 : deployedBootstrapStack(input.githubOidcStack, expectedContracts.githubOidc);
@@ -1477,7 +1521,7 @@ async function bootstrapHandoff(input) {
       ApplicationStackName: input.config.core?.applicationStackName,
       DashboardFunctionName: input.config.core?.dashboardFunctionName
     });
-    const templatePath = await bootstrapTemplatePath("core");
+    const templatePath = await bootstrapTemplatePath("core", computeMode(input.config));
     return {
       phase: "core",
       expectedContracts,
@@ -1517,7 +1561,7 @@ async function bootstrapHandoff(input) {
       ConsumerGatewayStackName: input.config.githubOidc?.consumerGatewayStackName,
       ...coreBootstrapOutputs(core)
     });
-    const templatePath = await bootstrapTemplatePath("github-oidc");
+    const templatePath = await bootstrapTemplatePath("github-oidc", computeMode(input.config));
     return {
       phase: "github-oidc",
       expectedContracts,
@@ -1584,7 +1628,7 @@ function assertEqual(actual, expected, label) {
     );
 }
 async function verifyBootstrap(input) {
-  const expected = await contracts();
+  const expected = await contracts(input.config);
   const core = deployedBootstrapStack(input.coreStack, expected.core);
   const oidc = deployedBootstrapStack(input.githubOidcStack, expected.githubOidc);
   for (const [kind, capture] of [
@@ -1732,6 +1776,7 @@ async function discovered(input) {
   const repo = await optional(input.runner, "gh", ["api", `repos/${input.repository}`]);
   const github = parseOrUnavailable(repo) ?? {};
   return {
+    ...input.mode ? { mode: input.mode } : {},
     accountId,
     region: region2?.trim() || void 0,
     ownerId: typeof github.owner?.id === "number" || typeof github.owner?.id === "string" ? String(github.owner.id) : void 0,
@@ -1747,6 +1792,8 @@ async function scaffoldBootstrapManifest(input) {
   const environment = value(input.environment, "environment");
   const providerArn = value(input.providerArn, "github OIDC provider ARN");
   if (!accountFromArn(providerArn)) throw new Error("github OIDC provider ARN is invalid");
+  if (input.mode && input.mode !== "lambda" && input.mode !== "ecs")
+    throw new Error("mode must be lambda or ecs");
   const found = await discovered(input);
   const accountId = input.accountId ?? found.accountId;
   const region2 = input.region ?? found.region;
@@ -1970,27 +2017,45 @@ async function bootstrapGuide(input) {
 
 // packages/aws/src/index.ts
 var run = promisify(execFile);
+function requireImageDigest(image) {
+  if (!/^[^\s@]+@sha256:[a-f0-9]{64}$/.test(image))
+    throw new Error(
+      "ECS imageReference must be an immutable registry digest (image@sha256:<64 hex>)"
+    );
+  return image;
+}
 function deploymentTemplate(template, values) {
-  const listed = template.match(/^ {2}PackageManagedParameters: \[([^\]]*)\]\s*$/m)?.[1];
-  if (listed === void 0)
+  const document = parseDocument(template);
+  if (document.errors.length)
+    throw new Error(`Invalid CloudFormation template: ${document.errors[0]}`);
+  const managedValue = document.toJS().Metadata?.PackageManagedParameters;
+  if (!Array.isArray(managedValue))
     throw new Error("CloudFormation template has no PackageManagedParameters metadata");
-  const managed = listed.split(",").map((key) => key.trim()).filter(Boolean);
+  const managed = managedValue.filter((key) => typeof key === "string");
+  if (managed.length !== managedValue.length)
+    throw new Error("CloudFormation template has invalid PackageManagedParameters metadata");
   const missing = managed.filter((key) => !Object.hasOwn(values, key));
   const unknown = Object.keys(values).filter((key) => !managed.includes(key));
   if (missing.length || unknown.length)
     throw new Error(
       `Package-managed CloudFormation parameters are out of sync (missing: ${missing.join(", ") || "none"}; unknown: ${unknown.join(", ") || "none"})`
     );
-  return managed.reduce((rendered, key) => {
-    const pattern = new RegExp(`^  ${key}: \\{[^\\n]+\\}\\s*$`, "m");
-    const declaration = rendered.match(pattern)?.[0];
-    if (!declaration || /\bDefault:/.test(declaration))
-      throw new Error(`Unable to set the CloudFormation default for ${key}`);
-    return rendered.replace(
-      pattern,
-      declaration.replace(/\s*}\s*$/, `, Default: ${JSON.stringify(values[key])} }`)
-    );
-  }, template);
+  for (const key of managed) {
+    const path = ["Parameters", key];
+    const parameter = document.getIn(path);
+    if (!parameter || typeof parameter !== "object")
+      throw new Error(`CloudFormation template has no declaration for ${key}`);
+    const current = document.getIn([...path, "Default"], true);
+    if (current !== void 0) {
+      if (String(current) !== values[key])
+        throw new Error(`Package-managed CloudFormation parameter ${key} has a conflicting default`);
+    } else {
+      const scalar = new Scalar(values[key]);
+      scalar.type = "QUOTE_DOUBLE";
+      document.setIn([...path, "Default"], scalar);
+    }
+  }
+  return document.toString({ lineWidth: 0 });
 }
 async function packageLambda(options) {
   const outputDir = resolve2(options.outputDir);
@@ -2009,6 +2074,7 @@ async function packageLambda(options) {
   });
   const runtimeMetadata = {
     ...release.metadata,
+    computeMode: "lambda",
     artifactChecksums: {
       ...release.metadata.artifactChecksums,
       "index.mjs": sha256(await readFile3(join2(runtimeDir, "index.mjs")))
@@ -2045,13 +2111,49 @@ async function packageLambda(options) {
 `);
   await writeFile2(
     join2(outputDir, "template.yml"),
-    deploymentTemplate(await cloudFormationTemplate(), {
+    deploymentTemplate(await cloudFormationTemplate("lambda"), {
+      ComputeMode: "lambda",
       LambdaArtifactKey: packagedRelease.artifactKey,
       DashboardVersion: packagedRelease.dashboardVersion
     })
   );
   return packagedRelease;
 }
+async function packageEcs(options) {
+  const outputDir = resolve2(options.outputDir);
+  await mkdir2(outputDir, { recursive: true });
+  const imageReference = requireImageDigest(options.imageReference ?? "");
+  const release = await assembleRelease({
+    boardConfigPath: options.boardConfigPath,
+    outputDir,
+    version: options.version,
+    providers: ["aws-ecs-fargate"],
+    assetDomain: options.assetDomain,
+    secretReference: options.secretReference
+  });
+  const packagedRelease = {
+    ...release.metadata,
+    computeMode: "ecs",
+    image: imageReference,
+    artifactKey: `ecs/${sha256(JSON.stringify({ ...release.metadata, image: imageReference }))}`
+  };
+  await writeFile2(join2(outputDir, "release.json"), `${JSON.stringify(packagedRelease, null, 2)}
+`);
+  await writeFile2(
+    join2(outputDir, "template.yml"),
+    deploymentTemplate(await cloudFormationTemplate("ecs"), {
+      ComputeMode: "ecs",
+      Image: imageReference,
+      DashboardVersion: packagedRelease.dashboardVersion
+    })
+  );
+  await writeFile2(
+    join2(outputDir, "SHA256SUMS"),
+    `${sha256(await readFile3(join2(outputDir, "release.json")))}  release.json
+`
+  );
+  return packagedRelease;
+}
 async function publishClientAssets(options) {
   const assetsDir = resolve2(options.assetsDir);
   await readFile3(join2(assetsDir, "index.html"));
@@ -2076,8 +2178,13 @@ async function publishClientAssets(options) {
   ]);
   return assetPath;
 }
-async function cloudFormationTemplate() {
-  return readFile3(fileURLToPath2(new URL("../template.yml", import.meta.url)), "utf8");
+async function cloudFormationTemplate(mode = "lambda") {
+  return readFile3(
+    fileURLToPath2(
+      new URL(mode === "ecs" ? "../template-ecs.yml" : "../template.yml", import.meta.url)
+    ),
+    "utf8"
+  );
 }
 export {
   bootstrapConsistency,
@@ -2091,14 +2198,18 @@ export {
   bootstrapTemplateRevision,
   checkBootstrap,
   cloudFormationTemplate,
+  computeMode,
   coreBootstrapOutputs,
   deployedBootstrapStack,
   formatBootstrapCheckText,
   githubOidcProvider,
   mergeBootstrapParameters,
+  packageEcs,
   packageLambda,
   publishClientAssets,
+  requireComputeMode,
   requiredBootstrapParameters,
+  resolveComputeMode,
   scaffoldBootstrapManifest,
   verifyBootstrap
 };

package/dist/lambda.mjs

@@ -63988,6 +63988,12 @@ var panelSchema = external_exports.looseObject({
   /** Advisory in v1 — a panel without a position renders in config order rather than not at all. */
   position: positionSchema.optional(),
   refresh: durationSchema.optional(),
+  /** Active pipeline runs are checked more often than normal panels. */
+  running_refresh: durationSchema.optional(),
+  /** Polling cadence around the estimated completion boundary. */
+  running_completion_refresh: durationSchema.optional(),
+  /** Maximum length of the tighter completion polling burst. */
+  running_completion_window: durationSchema.optional(),
   /** Optional active-run treatment. Omitted selects a visible treatment at random. */
   running_animation: runningAnimationSchema.optional(),
   /** Local animation-demo cycle duration; ignored by other panel types. */
@@ -64008,6 +64014,9 @@ var sourceSchema = external_exports.looseObject({
 });
 var boardSchema = external_exports.object({
   refresh: durationSchema.optional(),
+  running_refresh: durationSchema.optional(),
+  running_completion_refresh: durationSchema.optional(),
+  running_completion_window: durationSchema.optional(),
   panels: external_exports.array(panelSchema).min(1).superRefine((panels, ctx) => {
     const seen = /* @__PURE__ */ new Map();
     panels.forEach((panel, index) => {
@@ -67150,8 +67159,10 @@ function isLocalHost(host) {
 async function startup(options = {}) {
   const config2 = loadConfig2();
   const fetcher = options.fetcher ?? globalThis.fetch;
-  await waitForTemplate(config2, fetcher);
-  const boardConfig = await loadBoardConfig(config2.boardConfigUrl, fetcher);
+  const [, boardConfig] = await Promise.all([
+    waitForTemplate(config2, fetcher),
+    loadBoardConfig(config2.boardConfigUrl, fetcher)
+  ]);
   const board = selectBoard(config2.board, boardConfig);
   const resolvedConfig = { ...config2, board };
   const credentialNames = Object.values(boardConfig.sources).map((source) => source.token_env).filter((name) => Boolean(name));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.13.7",
+  "version": "0.14.0",
   "type": "module",
   "description": "AWS Lambda and CloudFormation adapter for Ze Great Dashboard.",
   "keywords": [
@@ -31,6 +31,7 @@
     "client",
     "bootstrap",
     "template.yml",
+    "template-ecs.yml",
     "LICENSE"
   ],
   "dependencies": {

package/template-ecs.yml

@@ -0,0 +1,101 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Ze Great Dashboard ECS/Fargate application (consumer-owned network and ingress)
+
+Metadata:
+  PackageManagedParameters: [ComputeMode, Image, DashboardVersion]
+
+Parameters:
+  ComputeMode: { Type: String, Default: ecs, AllowedValues: [ecs] }
+  Image: { Type: String }
+  DashboardVersion: { Type: String }
+  Name: { Type: String, Default: dashboard }
+  AssetBaseUrl: { Type: String, Default: https://public-assets.zegreatrob.com }
+  BoardConfigPath: { Type: String, Default: /app/boards/example.yaml }
+  Subnets: { Type: List<AWS::EC2::Subnet::Id> }
+  SecurityGroups: { Type: List<AWS::EC2::SecurityGroup::Id> }
+  DesiredCount: { Type: Number, Default: 1, MinValue: 1 }
+  Cpu: { Type: String, Default: '256' }
+  Memory: { Type: String, Default: '512' }
+  ContainerPort: { Type: Number, Default: 3000 }
+  LogRetentionInDays: { Type: Number, Default: 14, MinValue: 1 }
+  SecretReference: { Type: String, Default: '' }
+
+Conditions:
+  HasSecretReference: !Not [!Equals [!Ref SecretReference, '']]
+
+Resources:
+  Cluster:
+    Type: AWS::ECS::Cluster
+    Properties: { ClusterName: !Ref Name }
+  LogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties: { LogGroupName: !Sub '/aws/ecs/${Name}', RetentionInDays: !Ref LogRetentionInDays }
+  ExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${Name}-execution'
+      AssumeRolePolicyDocument: { Version: '2012-10-17', Statement: [{ Effect: Allow, Principal: { Service: ecs-tasks.amazonaws.com }, Action: sts:AssumeRole }] }
+      ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy]
+  TaskRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${Name}-task'
+      AssumeRolePolicyDocument: { Version: '2012-10-17', Statement: [{ Effect: Allow, Principal: { Service: ecs-tasks.amazonaws.com }, Action: sts:AssumeRole }] }
+      Policies:
+        - PolicyName: read-consumer-credentials
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
+                Resource: !If [HasSecretReference, !Ref SecretReference, !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ze-great-dashboard-no-secret-configured']
+              - Effect: Allow
+                Action: ssm:GetParameter
+                Resource: !If [HasSecretReference, !Ref SecretReference, !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ze-great-dashboard-no-credential-configured']
+              - Effect: Allow
+                Action: kms:Decrypt
+                Resource: '*'
+                Condition:
+                  StringEquals:
+                    'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
+                    'kms:EncryptionContext:PARAMETER_ARN': !Ref SecretReference
+  TaskDefinition:
+    Type: AWS::ECS::TaskDefinition
+    Properties:
+      Family: !Ref Name
+      Cpu: !Ref Cpu
+      Memory: !Ref Memory
+      NetworkMode: awsvpc
+      RequiresCompatibilities: [FARGATE]
+      ExecutionRoleArn: !GetAtt ExecutionRole.Arn
+      TaskRoleArn: !GetAtt TaskRole.Arn
+      ContainerDefinitions:
+        - Name: dashboard
+          Image: !Ref Image
+          Essential: true
+          PortMappings: [{ ContainerPort: !Ref ContainerPort, Protocol: tcp }]
+          Environment:
+            - { Name: ASSET_PATH, Value: !Sub '${AssetBaseUrl}/dashboard/${DashboardVersion}' }
+            - { Name: BOARD_CONFIG_URL, Value: !Ref BoardConfigPath }
+            - { Name: HOST, Value: 0.0.0.0 }
+            - { Name: PORT, Value: '3000' }
+            - { Name: SECRET_REFERENCE, Value: !If [HasSecretReference, !Ref SecretReference, ''] }
+          LogConfiguration: { LogDriver: awslogs, Options: { awslogs-group: !Ref LogGroup, awslogs-region: !Ref AWS::Region, awslogs-stream-prefix: dashboard } }
+          HealthCheck: { Command: [CMD-SHELL, 'node /app/docker-healthcheck.mjs'], Interval: 30, Timeout: 5, Retries: 3, StartPeriod: 20 }
+  Service:
+    Type: AWS::ECS::Service
+    DependsOn: LogGroup
+    Properties:
+      Cluster: !Ref Cluster
+      ServiceName: !Ref Name
+      DesiredCount: !Ref DesiredCount
+      LaunchType: FARGATE
+      TaskDefinition: !Ref TaskDefinition
+      NetworkConfiguration: { AwsvpcConfiguration: { AssignPublicIp: DISABLED, Subnets: !Ref Subnets, SecurityGroups: !Ref SecurityGroups } }
+
+Outputs:
+  ComputeMode: { Value: !Ref ComputeMode }
+  ServiceName: { Value: !Ref Service }
+  ClusterName: { Value: !Ref Cluster }
+  Image: { Value: !Ref Image }
+  AssetPath: { Value: !Sub '${AssetBaseUrl}/dashboard/${DashboardVersion}' }

package/template.yml

@@ -2,9 +2,10 @@ AWSTemplateFormatVersion: '2010-09-09'
 Description: Ze Great Dashboard private Lambda application (integrate through a customer-managed gateway)
 
 Metadata:
-  PackageManagedParameters: [LambdaArtifactKey, DashboardVersion]
+  PackageManagedParameters: [ComputeMode, LambdaArtifactKey, DashboardVersion]
 
 Parameters:
+  ComputeMode: { Type: String, Default: lambda, AllowedValues: [lambda] }
   Name: { Type: String, Default: dashboard }
   LambdaArtifactBucket: { Type: String }
   LambdaArtifactKey: { Type: String }