@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/ecs-core/iam.tf

@@ -0,0 +1,95 @@
+########################################################################################################################
+## IAM Role for ECS Task execution
+########################################################################################################################
+
+resource "aws_iam_role" "ecs_task_execution_role" {
+  name               = "${var.project_name}_ECS_TaskExecutionRole"
+  assume_role_policy = data.aws_iam_policy_document.task_assume_role_policy.json
+  
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+data "aws_iam_policy_document" "task_assume_role_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution_secrets_role_policy" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+########################################################################################################################
+## IAM Role for ECS Task
+########################################################################################################################
+
+# Create an IAM policy
+resource "aws_iam_policy" "ecs_task_policy" {
+  name = "${var.project_name}-ecs-task-policy"
+
+  policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": [
+          "ecr:GetAuthorizationToken",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "ecs:ExecuteCommand",
+          "ssmmessages:CreateControlChannel",
+          "ssmmessages:CreateDataChannel",
+          "ssmmessages:OpenControlChannel",
+          "ssmmessages:OpenDataChannel",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        "Resource": "*"
+      }
+    ]
+  })
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_iam_role" "task_exec_role" {
+  name = "${var.project_name}-ecs-task-role"
+
+  assume_role_policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Principal": {
+          "Service": "ecs-tasks.amazonaws.com"
+        },
+        "Action": "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# Attach the IAM policy to the IAM role
+resource "aws_iam_policy_attachment" "iam_role_policy_attachment" {
+  name = "Policy Attachement"
+  policy_arn = aws_iam_policy.ecs_task_policy.arn
+  roles      = [aws_iam_role.task_exec_role.name]
+}

package/dist/infra-templates/modules/ecs-core/main.tf

@@ -0,0 +1,12 @@
+########################################################################################################################
+## Creates an ECS Cluster
+########################################################################################################################
+
+resource "aws_ecs_cluster" "default" {
+  name = var.project_name
+
+  tags = {
+    Name     = "${var.project_name}_ECSCluster"
+    Scenario = var.scenario
+  }
+}

package/dist/infra-templates/modules/ecs-core/outputs.tf

@@ -0,0 +1,44 @@
+output "alb_dns" {
+    description = "The CNAME for the ALB"
+    value = aws_alb.alb.dns_name
+}
+
+output "ecs_log_group_name" {
+    description = "The name of the cloudwatch log group for ECS"
+    value = aws_cloudwatch_log_group.cb_log_group.name
+}
+
+output "ecs_task_execution_role_arn" {
+    description = "The ARN of the IAM execution role"
+    value = aws_iam_role.ecs_task_execution_role.arn
+}
+
+output "ecs_task_role_arn" {
+    description = "The ARN of the IAM rask role"
+    value = aws_iam_role.task_exec_role.arn
+}
+
+output "ecs_cluster_id" {
+    description = "The ARN of the IAM execution role"
+    value = aws_ecs_cluster.default.id
+}
+
+output "ecs_container_security_group_id" {
+    description = "ECS Container Security Group ID"
+    value = aws_security_group.ecs_container_instance.id
+}
+
+output "ecs_cluster_name" {
+    description = "The name of the cluster"
+    value = aws_ecs_cluster.default.name
+}
+
+output "ecs_secret_arn" {
+    description = "ARN of the secrets for the app"
+    value = aws_secretsmanager_secret.secret.arn
+}
+
+output "aws_alb_target_groups" {
+    description = "ALB target groups"
+    value = aws_alb_target_group.app_service_target_group
+}

package/dist/infra-templates/modules/ecs-core/secrets.tf

@@ -0,0 +1,9 @@
+resource "random_id" "secret_suffix" {
+  byte_length = 4
+}
+
+resource "aws_secretsmanager_secret" "secret" {
+  name                    = "${var.project_name}_secrets_${random_id.secret_suffix.hex}"
+  description             = "Secret"
+  recovery_window_in_days = 0
+}

package/dist/infra-templates/modules/ecs-core/security_groups.tf

@@ -0,0 +1,73 @@
+resource "aws_security_group" "ecs_container_instance" {
+  name        = "${var.project_name}_ECS_Task_SecurityGroup"
+  description = "Security group for ECS task running on Fargate"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    description     = "Allow ingress traffic from ALB on HTTP only"
+    from_port       = var.container_port
+    to_port         = var.container_port
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id] 
+  }
+
+  egress {
+    description = "Allow all egress traffic"
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name     = "${var.project_name}_ECS_Task_SecurityGroup"
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_security_group" "alb" {
+  name        = "${var.project_name}_ALB_SecurityGroup"
+  description = "Security group for ALB"
+  vpc_id      = var.vpc_id
+  revoke_rules_on_delete      = true
+
+  tags = {
+    Name     = "${var.project_name}_ALB_SecurityGroup"
+    Scenario = var.scenario
+  }
+}
+
+# ------------------------------------------------------------------------------
+# Alb Security Group Rules - INBOUND
+# ------------------------------------------------------------------------------
+resource "aws_security_group_rule" "alb_http_ingress" {
+    type                        = "ingress"
+    from_port                   = 80
+    to_port                     = 80
+    protocol                    = "TCP"
+    description                 = "Allow http inbound traffic from internet"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}
+resource "aws_security_group_rule" "alb_https_ingress" {
+    type                        = "ingress"
+    from_port                   = 443
+    to_port                     = 443
+    protocol                    = "TCP"
+    description                 = "Allow https inbound traffic from internet"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}
+
+# ------------------------------------------------------------------------------
+# Alb Security Group Rules - OUTBOUND
+# ------------------------------------------------------------------------------
+resource "aws_security_group_rule" "alb_egress" {
+    type                        = "egress"
+    from_port                   = 0
+    to_port                     = 0
+    protocol                    = "-1"
+    description                 = "Allow outbound traffic from alb"
+    security_group_id           = aws_security_group.alb.id
+    cidr_blocks                 = ["0.0.0.0/0"] 
+}

package/dist/infra-templates/modules/ecs-core/variables.tf

@@ -0,0 +1,96 @@
+
+########################################################################################################################
+## Service variables
+########################################################################################################################
+
+variable "ingress_ssl_arn" {
+  description = "ACM ARN"
+  type = string
+}
+
+variable "namespace" {
+  description = "Namespace for resource names"
+  type        = string
+}
+
+variable "project_name" {
+  description = "A Docker image-compatible name for the service"
+  type        = string
+}
+
+variable "scenario" {
+  description = "Scenario name for tags"
+  default     = "scenario-ecs-fargate"
+  type        = string
+}
+
+########################################################################################################################
+## Cloudwatch
+########################################################################################################################
+
+variable "retention_in_days" {
+  description = "Retention period for Cloudwatch logs"
+  default     = 7
+  type        = number
+}
+
+########################################################################################################################
+## ALB
+########################################################################################################################
+
+variable "healthcheck_endpoint" {
+  description = "Endpoint for ALB healthcheck"
+  type        = string
+  default     = "/"
+}
+
+variable "healthcheck_matcher" {
+  description = "HTTP status code matcher for healthcheck"
+  type        = string
+  default     = "200-299"
+}
+
+variable "aws_region" {
+  description = "AWS Region"
+  type = string
+}
+
+variable "vpc_id" {
+  description = "VPC id"
+  type        = string
+}
+
+variable "public_subnets" {
+  description = "The public subnets for ingress resources."
+  default     = ""
+}
+
+variable "private_subnets" {
+  description = "The private subnets for ingress resources."
+  default     = ""
+}
+
+variable "default_security_group_id" {
+  description = "VPC Security Group"
+  type = string
+}
+
+variable "container_port" {
+  description = "Port of the container"
+  type        = number
+  default     = 3000
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    domain = string
+    port = number
+    health_check_path = string
+  }))
+}
+
+variable "log_group_name" {
+  description = "CloudWatch log group name"
+}

package/dist/infra-templates/modules/ecs-service/ecs_autoscaling.tf

@@ -0,0 +1,51 @@
+########################################################################################################################
+## Define Target Tracking on ECS Cluster Task level
+########################################################################################################################
+
+resource "aws_appautoscaling_target" "ecs_target" {
+  max_capacity       = var.ecs_task_max_count
+  min_capacity       = var.ecs_task_min_count
+  resource_id        = "service/${var.ecs_cluster_name}/${aws_ecs_service.backend_service.name}"
+  scalable_dimension = "ecs:service:DesiredCount"
+  service_namespace  = "ecs"
+}
+
+########################################################################################################################
+## Policy for CPU tracking
+########################################################################################################################
+
+resource "aws_appautoscaling_policy" "ecs_cpu_policy" {
+  name               = "${var.app_name}_CPUTargetTrackingScaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    target_value = var.cpu_target_tracking_desired_value
+
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageCPUUtilization"
+    }
+  }
+}
+
+########################################################################################################################
+## Policy for memory tracking
+########################################################################################################################
+
+resource "aws_appautoscaling_policy" "ecs_memory_policy" {
+  name               = "${var.app_name}_MemoryTargetTrackingScaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    target_value = var.memory_target_tracking_desired_value
+
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageMemoryUtilization"
+    }
+  }
+}

package/dist/infra-templates/modules/ecs-service/ecs_service.tf

@@ -0,0 +1,39 @@
+resource "aws_ecs_service" "backend_service" {
+  name                               = "${var.app_name}"
+  cluster                            = var.ecs_cluster_id
+  task_definition                    = aws_ecs_task_definition.backend_task_definition.arn
+  desired_count                      = var.ecs_task_desired_count
+  deployment_minimum_healthy_percent = var.ecs_task_deployment_minimum_healthy_percent
+  deployment_maximum_percent         = var.ecs_task_deployment_maximum_percent
+  launch_type                        = "FARGATE"
+  enable_execute_command = true
+
+  dynamic "load_balancer" {
+    for_each = var.connect_to_alb == true ? [1]: []
+
+    content {
+      target_group_arn = var.aws_alb_target_group_arn
+      container_name   = var.app_name
+      container_port   = var.container_port
+    }
+  }
+
+  network_configuration {
+    security_groups  = [var.ecs_container_security_group_id, var.default_security_group_id]
+    subnets          = var.private_subnets
+    assign_public_ip = false
+  }
+
+  deployment_circuit_breaker {
+    enable   = var.ecs_circuit_breaker
+    rollback = var.ecs_rollback
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  lifecycle {
+    ignore_changes = [task_definition]
+  }
+}

package/dist/infra-templates/modules/ecs-service/ecs_task_definition.tf

@@ -0,0 +1,56 @@
+########################################################################################################################
+## Creates ECS Task Definition
+########################################################################################################################
+
+locals {
+   secretKeys = keys(var.env_vars)
+}
+
+locals {
+  secrets_list = [
+    for name in local.secretKeys : {
+      name  = name
+      valueFrom = "${var.ecs_secret_arn}:${name}::"
+    }
+  ]
+}
+
+resource "aws_ecs_task_definition" "backend_task_definition" {
+  family                   = var.app_name
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = var.ecs_task_execution_role_arn
+  task_role_arn            = var.ecs_task_role_arn
+  cpu                      = var.cpu_units
+  memory                   = var.memory
+
+  container_definitions = jsonencode([
+    {
+      name         = var.app_name
+      image        = var.repository_url
+      cpu          = var.cpu_units
+      memory       = var.memory
+      essential    = true
+      portMappings = [
+        {
+          containerPort = var.container_port
+          hostPort      = var.container_port
+          protocol      = "tcp"
+        }
+      ]
+      secrets = local.secrets_list
+      logConfiguration = {
+        logDriver = "awslogs"
+        options   = {
+          "awslogs-group"         = var.ecs_log_group_name
+          "awslogs-region"        = var.aws_region
+          "awslogs-stream-prefix" = "${var.app_name}-log-stream"
+        }
+      }
+    }
+  ])
+
+  tags = {
+    Scenario = var.scenario
+  }
+}

package/dist/infra-templates/modules/ecs-service/variables.tf

@@ -0,0 +1,170 @@
+########################################################################################################################
+## Service variables
+########################################################################################################################
+
+variable "app_name" {
+  description = "A Docker image-compatible name for the service"
+  type        = string
+}
+
+variable "scenario" {
+  description = "Scenario name for tags"
+  default     = "scenario-ecs-fargate"
+  type        = string
+}
+
+########################################################################################################################
+## ECS variables
+########################################################################################################################
+
+variable "ecs_task_desired_count" {
+  description = "How many ECS tasks should run in parallel"
+  type        = number
+  default = 1
+}
+
+variable "ecs_task_min_count" {
+  description = "How many ECS tasks should minimally run in parallel"
+  default     = 1
+  type        = number
+}
+
+variable "ecs_task_max_count" {
+  description = "How many ECS tasks should maximally run in parallel"
+  default     = 10
+  type        = number
+}
+
+# if you have multiple tasks running this should be 50%, but for 1 task
+# it has to be zero so ecs can drain the task to replace it (making the service unstable for a few minutes)
+variable "ecs_task_deployment_minimum_healthy_percent" {
+  description = "How many percent of a service must be running to still execute a safe deployment"
+  default     = 100
+  type        = number
+}
+
+variable "ecs_task_deployment_maximum_percent" {
+  description = "How many additional tasks are allowed to run (in percent) while a deployment is executed"
+  default     = 200
+  type        = number
+}
+
+variable "cpu_target_tracking_desired_value" {
+  description = "Target tracking for CPU usage in %"
+  default     = 70
+  type        = number
+}
+
+variable "memory_target_tracking_desired_value" {
+  description = "Target tracking for memory usage in %"
+  default     = 80
+  type        = number
+}
+
+variable "target_capacity" {
+  description = "Amount of resources of container instances that should be used for task placement in %"
+  default     = 100
+  type        = number
+}
+
+variable "container_port" {
+  description = "Port of the container"
+  type        = number
+  default     = 3000
+}
+
+variable "cpu_units" {
+  description = "Amount of CPU units for a single ECS task"
+  default     = 1024
+  type        = number
+}
+
+variable "memory" {
+  description = "Amount of memory in MB for a single ECS task"
+  default     = 2048
+  type        = number
+}
+
+variable "aws_region" {
+  description = "AWS Region"
+  type = string
+}
+
+variable "repository_url" {
+  description = "Image URL"
+  type = string
+}
+
+variable "default_security_group_id" {
+  description = "VPC Security Group"
+  type = string
+}
+
+variable "ecs_task_execution_role_arn" {
+  description = "ARN for the task execution role"
+  type = string
+}
+
+variable "ecs_task_role_arn" {
+  description = "ARN for the task role"
+  type = string
+}
+
+variable "ecs_log_group_name" {
+  description = "Log group name for ECS"
+  type = string
+}
+
+variable "ecs_cluster_id" {
+  description = "ECS cluster id to attach services to"
+}
+
+variable "ecs_cluster_name" {
+  description = "ECS cluster name"
+}
+
+variable "aws_alb_target_group_arn" {
+  description = "AWS ALB target group ARN"
+  type = string
+}
+
+variable "ecs_container_security_group_id" {
+  description = "ECS Container Security Group ID"
+  type = string
+}
+
+variable "private_subnets" {
+  description = "Private subnets for the ECS cluster"
+  default     = ""
+}
+
+variable "ecs_secret_arn" {
+  description = "ARN for secrets"
+  type = string
+}
+
+variable "connect_to_alb" {
+  description = "Is this a public service?"
+  type = bool
+}
+
+variable "secret_name" {
+  description = "Name of the secret to use"
+  type = string
+}
+
+variable "env_vars" {
+  type    = map(string)
+  default = {}
+}
+variable "ecs_circuit_breaker" {
+  description = "Enable Circuit Breaker"
+  type = bool
+  default = true
+}
+
+variable "ecs_rollback" {
+  description = "Automatically rollback if failure occurs"
+  type = bool
+  default = true
+}

package/dist/infra-templates/modules/elastic-container-registry/main.tf

@@ -0,0 +1,32 @@
+locals {
+  all_apps = merge(
+    { for app in var.apps : app.app_name => app },
+    { for worker in var.workers : worker.worker_name => worker }
+  )
+}
+
+module "ecr" {
+  source  = "terraform-aws-modules/ecr/aws"
+  version = "2.2.0"
+
+  repository_name         = "${var.project_name}-application"
+  repository_force_delete = true
+  repository_image_tag_mutability = "MUTABLE"
+  repository_lifecycle_policy = jsonencode({
+    rules = [
+      for idx, app_key in zipmap(range(length(keys(local.all_apps))), keys(local.all_apps)) : {
+        rulePriority = idx + 1
+        description  = "Keep 5 most recent images with prefix '${app_key}'"
+        selection = {
+          tagStatus     = "tagged"
+          tagPrefixList = [app_key]
+          countType     = "imageCountMoreThan"
+          countNumber   = 5
+        }
+        action = {
+          type = "expire"
+        }
+      }
+    ]
+  })
+}

package/dist/infra-templates/modules/elastic-container-registry/outputs.tf

@@ -0,0 +1,9 @@
+output "repository_url" {
+  description = "The URL of the repository."
+  value = module.ecr.repository_url
+}
+
+output "registry_id" {
+  description = "The registry ID"
+  value = module.ecr.repository_registry_id
+}