@swovohq/fuel 0.2.2-alpha.88 → 0.2.2-alpha.89

package/dist/infra-templates/modules/ecs-core/alb.tf

@@ -0,0 +1,126 @@
+########################################################################################################################
+## Application Load Balancer in public subnets with HTTP default listener that redirects traffic to HTTPS
+########################################################################################################################
+
+resource "aws_alb" "alb" {
+  name            = "${var.project_name}-ALB"
+  security_groups = [aws_security_group.alb.id, var.default_security_group_id]
+  subnets         = var.public_subnets
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+########################################################################################################################
+## Default HTTPS listener that blocks all traffic without valid custom origin header
+########################################################################################################################
+
+resource "aws_alb_listener" "alb_default_listener_https" {
+  load_balancer_arn         = aws_alb.alb.arn
+  port                      = "443"
+  protocol                  = "HTTPS"
+  certificate_arn   = var.ingress_ssl_arn
+
+  default_action {
+    type                    = "forward"
+    target_group_arn        = aws_alb_target_group.service_target_group.arn
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_alb_listener" "redirect" {
+  load_balancer_arn = aws_alb.alb.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }
+  }
+}
+
+resource "aws_alb_listener_rule" "frontend_listener" {
+  for_each = { 
+    for index, app in var.apps : app.app_name => app
+  }
+  
+  listener_arn = aws_alb_listener.alb_default_listener_https.arn
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_alb_target_group.app_service_target_group[each.key].arn
+  }
+
+  condition {
+    host_header {
+      values = ["${each.value.domain}"]
+    }
+  }
+}
+
+########################################################################################################################
+## Target Group for our service
+########################################################################################################################
+
+resource "aws_alb_target_group" "service_target_group" {
+  name                 = "${var.project_name}-TargetGroup"
+  port                 = var.container_port
+  protocol             = "HTTP"
+  vpc_id               = var.vpc_id
+  deregistration_delay = 5
+  target_type          = "ip"
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 60
+    matcher             = var.healthcheck_matcher
+    path                = var.healthcheck_endpoint
+    port                = "traffic-port"
+    protocol            = "HTTP"
+    timeout             = 30
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  depends_on = [aws_alb.alb]
+}
+
+resource "aws_alb_target_group" "app_service_target_group" {
+  for_each = { for app in var.apps : app.app_name => app }
+
+  name                 = each.value.app_name
+  port                 = each.value.port
+  protocol             = "HTTP"
+  vpc_id               = var.vpc_id
+  deregistration_delay = 5
+  target_type          = "ip"
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 90
+    matcher             = var.healthcheck_matcher
+    path                = each.value.health_check_path
+    port                = "traffic-port"
+    protocol            = "HTTP"
+    timeout             = 60
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  depends_on = [aws_alb.alb]
+}

package/dist/infra-templates/modules/ecs-core/cloudwatch.tf

@@ -0,0 +1,48 @@
+# logs.tf
+
+# Set up CloudWatch group and log stream and retain logs for 30 days
+resource "aws_cloudwatch_log_group" "cb_log_group" {
+  name              = var.log_group_name
+  retention_in_days = 30
+}
+
+resource "aws_cloudwatch_log_stream" "cb_log_stream" {
+  name           =  var.project_name
+  log_group_name = aws_cloudwatch_log_group.cb_log_group.name
+}
+
+resource "aws_cloudwatch_metric_alarm" "targetResponseTime" {
+  actions_enabled     = true
+  alarm_name          = "TargetResponseTimeALB"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = aws_alb.alb.arn_suffix
+  }
+
+  evaluation_periods = 1
+  metric_name        = "TargetResponseTime"
+  namespace          = "AWS/ApplicationELB"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 4
+}
+
+resource "aws_cloudwatch_metric_alarm" "httpCodeTarget5XXCount" {
+  actions_enabled     = true
+  alarm_name          = "HTTPCode_Target_5XX_Count"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = aws_alb.alb.arn_suffix
+  }
+
+  evaluation_periods = 1
+  metric_name        = "HTTPCode_Target_5XX_Count"
+  namespace          = "AWS/ApplicationELB"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 1
+}

package/dist/infra-templates/modules/ecs-core/iam.tf

@@ -0,0 +1,95 @@
+########################################################################################################################
+## IAM Role for ECS Task execution
+########################################################################################################################
+
+resource "aws_iam_role" "ecs_task_execution_role" {
+  name               = "${var.project_name}_ECS_TaskExecutionRole"
+  assume_role_policy = data.aws_iam_policy_document.task_assume_role_policy.json
+  
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+data "aws_iam_policy_document" "task_assume_role_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution_secrets_role_policy" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+########################################################################################################################
+## IAM Role for ECS Task
+########################################################################################################################
+
+# Create an IAM policy
+resource "aws_iam_policy" "ecs_task_policy" {
+  name = "${var.project_name}-ecs-task-policy"
+
+  policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": [
+          "ecr:GetAuthorizationToken",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "ecs:ExecuteCommand",
+          "ssmmessages:CreateControlChannel",
+          "ssmmessages:CreateDataChannel",
+          "ssmmessages:OpenControlChannel",
+          "ssmmessages:OpenDataChannel",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        "Resource": "*"
+      }
+    ]
+  })
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_iam_role" "task_exec_role" {
+  name = "${var.project_name}-ecs-task-role"
+
+  assume_role_policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Principal": {
+          "Service": "ecs-tasks.amazonaws.com"
+        },
+        "Action": "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# Attach the IAM policy to the IAM role
+resource "aws_iam_policy_attachment" "iam_role_policy_attachment" {
+  name = "Policy Attachement"
+  policy_arn = aws_iam_policy.ecs_task_policy.arn
+  roles      = [aws_iam_role.task_exec_role.name]
+}

package/dist/infra-templates/modules/ecs-core/main.tf

@@ -0,0 +1,12 @@
+########################################################################################################################
+## Creates an ECS Cluster
+########################################################################################################################
+
+resource "aws_ecs_cluster" "default" {
+  name = var.project_name
+
+  tags = {
+    Name     = "${var.project_name}_ECSCluster"
+    Scenario = var.scenario
+  }
+}

package/dist/infra-templates/modules/ecs-core/outputs.tf

@@ -0,0 +1,44 @@
+output "alb_dns" {
+    description = "The CNAME for the ALB"
+    value = aws_alb.alb.dns_name
+}
+
+output "ecs_log_group_name" {
+    description = "The name of the cloudwatch log group for ECS"
+    value = aws_cloudwatch_log_group.cb_log_group.name
+}
+
+output "ecs_task_execution_role_arn" {
+    description = "The ARN of the IAM execution role"
+    value = aws_iam_role.ecs_task_execution_role.arn
+}
+
+output "ecs_task_role_arn" {
+    description = "The ARN of the IAM rask role"
+    value = aws_iam_role.task_exec_role.arn
+}
+
+output "ecs_cluster_id" {
+    description = "The ARN of the IAM execution role"
+    value = aws_ecs_cluster.default.id
+}
+
+output "ecs_container_security_group_id" {
+    description = "ECS Container Security Group ID"
+    value = aws_security_group.ecs_container_instance.id
+}
+
+output "ecs_cluster_name" {
+    description = "The name of the cluster"
+    value = aws_ecs_cluster.default.name
+}
+
+output "ecs_secret_arn" {
+    description = "ARN of the secrets for the app"
+    value = aws_secretsmanager_secret.secret.arn
+}
+
+output "aws_alb_target_groups" {
+    description = "ALB target groups"
+    value = aws_alb_target_group.app_service_target_group
+}

package/dist/infra-templates/modules/ecs-core/secrets.tf

@@ -0,0 +1,9 @@
+resource "random_id" "secret_suffix" {
+  byte_length = 4
+}
+
+resource "aws_secretsmanager_secret" "secret" {
+  name                    = "${var.project_name}_secrets_${random_id.secret_suffix.hex}"
+  description             = "Secret"
+  recovery_window_in_days = 0
+}

package/dist/infra-templates/modules/ecs-core/security_groups.tf

@@ -0,0 +1,73 @@
+resource "aws_security_group" "ecs_container_instance" {
+  name        = "${var.project_name}_ECS_Task_SecurityGroup"
+  description = "Security group for ECS task running on Fargate"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    description     = "Allow ingress traffic from ALB on HTTP only"
+    from_port       = var.container_port
+    to_port         = var.container_port
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id] 
+  }
+
+  egress {
+    description = "Allow all egress traffic"
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name     = "${var.project_name}_ECS_Task_SecurityGroup"
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_security_group" "alb" {
+  name        = "${var.project_name}_ALB_SecurityGroup"
+  description = "Security group for ALB"
+  vpc_id      = var.vpc_id
+  revoke_rules_on_delete      = true
+
+  tags = {
+    Name     = "${var.project_name}_ALB_SecurityGroup"
+    Scenario = var.scenario
+  }
+}
+
+# ------------------------------------------------------------------------------
+# Alb Security Group Rules - INBOUND
+# ------------------------------------------------------------------------------
+resource "aws_security_group_rule" "alb_http_ingress" {
+    type                        = "ingress"
+    from_port                   = 80
+    to_port                     = 80
+    protocol                    = "TCP"
+    description                 = "Allow http inbound traffic from internet"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}
+resource "aws_security_group_rule" "alb_https_ingress" {
+    type                        = "ingress"
+    from_port                   = 443
+    to_port                     = 443
+    protocol                    = "TCP"
+    description                 = "Allow https inbound traffic from internet"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}
+
+# ------------------------------------------------------------------------------
+# Alb Security Group Rules - OUTBOUND
+# ------------------------------------------------------------------------------
+resource "aws_security_group_rule" "alb_egress" {
+    type                        = "egress"
+    from_port                   = 0
+    to_port                     = 0
+    protocol                    = "-1"
+    description                 = "Allow outbound traffic from alb"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}

package/dist/infra-templates/modules/ecs-core/variables.tf

@@ -0,0 +1,96 @@
+
+########################################################################################################################
+## Service variables
+########################################################################################################################
+
+variable "ingress_ssl_arn" {
+  description = "ACM ARN"
+  type = string
+}
+
+variable "namespace" {
+  description = "Namespace for resource names"
+  type        = string
+}
+
+variable "project_name" {
+  description = "A Docker image-compatible name for the service"
+  type        = string
+}
+
+variable "scenario" {
+  description = "Scenario name for tags"
+  default     = "scenario-ecs-fargate"
+  type        = string
+}
+
+########################################################################################################################
+## Cloudwatch
+########################################################################################################################
+
+variable "retention_in_days" {
+  description = "Retention period for Cloudwatch logs"
+  default     = 7
+  type        = number
+}
+
+########################################################################################################################
+## ALB
+########################################################################################################################
+
+variable "healthcheck_endpoint" {
+  description = "Endpoint for ALB healthcheck"
+  type        = string
+  default     = "/"
+}
+
+variable "healthcheck_matcher" {
+  description = "HTTP status code matcher for healthcheck"
+  type        = string
+  default     = "200-299"
+}
+
+variable "aws_region" {
+  description = "AWS Region"
+  type = string
+}
+
+variable "vpc_id" {
+  description = "VPC id"
+  type        = string
+}
+
+variable "public_subnets" {
+  description = "The public subnets for ingress resources."
+  default     = ""
+}
+
+variable "private_subnets" {
+  description = "The private subnets for ingress resources."
+  default     = ""
+}
+
+variable "default_security_group_id" {
+  description = "VPC Security Group"
+  type = string
+}
+
+variable "container_port" {
+  description = "Port of the container"
+  type        = number
+  default     = 3000
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    domain = string
+    port = number
+    health_check_path = string
+  }))
+}
+
+variable "log_group_name" {
+  description = "CloudWatch log group name"
+}

package/dist/infra-templates/modules/ecs-service/ecs_autoscaling.tf

@@ -0,0 +1,51 @@
+########################################################################################################################
+## Define Target Tracking on ECS Cluster Task level
+########################################################################################################################
+
+resource "aws_appautoscaling_target" "ecs_target" {
+  max_capacity       = var.ecs_task_max_count
+  min_capacity       = var.ecs_task_min_count
+  resource_id        = "service/${var.ecs_cluster_name}/${aws_ecs_service.backend_service.name}"
+  scalable_dimension = "ecs:service:DesiredCount"
+  service_namespace  = "ecs"
+}
+
+########################################################################################################################
+## Policy for CPU tracking
+########################################################################################################################
+
+resource "aws_appautoscaling_policy" "ecs_cpu_policy" {
+  name               = "${var.app_name}_CPUTargetTrackingScaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    target_value = var.cpu_target_tracking_desired_value
+
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageCPUUtilization"
+    }
+  }
+}
+
+########################################################################################################################
+## Policy for memory tracking
+########################################################################################################################
+
+resource "aws_appautoscaling_policy" "ecs_memory_policy" {
+  name               = "${var.app_name}_MemoryTargetTrackingScaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    target_value = var.memory_target_tracking_desired_value
+
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageMemoryUtilization"
+    }
+  }
+}

package/dist/infra-templates/modules/ecs-service/ecs_service.tf

@@ -0,0 +1,39 @@
+resource "aws_ecs_service" "backend_service" {
+  name                               = "${var.app_name}"
+  cluster                            = var.ecs_cluster_id
+  task_definition                    = aws_ecs_task_definition.backend_task_definition.arn
+  desired_count                      = var.ecs_task_desired_count
+  deployment_minimum_healthy_percent = var.ecs_task_deployment_minimum_healthy_percent
+  deployment_maximum_percent         = var.ecs_task_deployment_maximum_percent
+  launch_type                        = "FARGATE"
+  enable_execute_command = true
+
+  dynamic "load_balancer" {
+    for_each = var.connect_to_alb == true ? [1]: []
+
+    content {
+      target_group_arn = var.aws_alb_target_group_arn
+      container_name   = var.app_name
+      container_port   = var.container_port
+    }
+  }
+
+  network_configuration {
+    security_groups  = [var.ecs_container_security_group_id, var.default_security_group_id]
+    subnets          = var.private_subnets
+    assign_public_ip = false
+  }
+
+  deployment_circuit_breaker {
+    enable   = var.ecs_circuit_breaker
+    rollback = var.ecs_rollback
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  lifecycle {
+    ignore_changes = [task_definition]
+  }
+}

package/dist/infra-templates/modules/ecs-service/ecs_task_definition.tf

@@ -0,0 +1,56 @@
+########################################################################################################################
+## Creates ECS Task Definition
+########################################################################################################################
+
+locals {
+   secretKeys = keys(var.env_vars)
+}
+
+locals {
+  secrets_list = [
+    for name in local.secretKeys : {
+      name  = name
+      valueFrom = "${var.ecs_secret_arn}:${name}::"
+    }
+  ]
+}
+
+resource "aws_ecs_task_definition" "backend_task_definition" {
+  family                   = var.app_name
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = var.ecs_task_execution_role_arn
+  task_role_arn            = var.ecs_task_role_arn
+  cpu                      = var.cpu_units
+  memory                   = var.memory
+
+  container_definitions = jsonencode([
+    {
+      name         = var.app_name
+      image        = var.repository_url
+      cpu          = var.cpu_units
+      memory       = var.memory
+      essential    = true
+      portMappings = [
+        {
+          containerPort = var.container_port
+          hostPort      = var.container_port
+          protocol      = "tcp"
+        }
+      ]
+      secrets = local.secrets_list
+      logConfiguration = {
+        logDriver = "awslogs"
+        options   = {
+          "awslogs-group"         = var.ecs_log_group_name
+          "awslogs-region"        = var.aws_region
+          "awslogs-stream-prefix" = "${var.app_name}-log-stream"
+        }
+      }
+    }
+  ])
+
+  tags = {
+    Scenario = var.scenario
+  }
+}