adserver-dashboard 1.0.0

package/terraform/ecs.tf

@@ -0,0 +1,727 @@
+# ECR Repository for Docker Images
+resource "aws_ecr_repository" "app" {
+  name                 = "${var.project_name}-${var.environment}"
+  image_tag_mutability = var.image_tag_mutability
+
+  image_scanning_configuration {
+    scan_on_push = var.image_scan_on_push
+  }
+
+  encryption_configuration {
+    encryption_type = "AES256"
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-ecr"
+    }
+  )
+}
+
+# ECR Lifecycle Policy
+resource "aws_ecr_lifecycle_policy" "app" {
+  repository = aws_ecr_repository.app.name
+
+  policy = jsonencode({
+    rules = [
+      {
+        rulePriority = 1
+        description  = "Keep last 10 production images"
+        selection = {
+          tagStatus     = "tagged"
+          tagPrefixList = ["prod", "production"]
+          countType     = "imageCountMoreThan"
+          countNumber   = 10
+        }
+        action = {
+          type = "expire"
+        }
+      },
+      {
+        rulePriority = 2
+        description  = "Keep last 5 staging images"
+        selection = {
+          tagStatus     = "tagged"
+          tagPrefixList = ["staging", "stg"]
+          countType     = "imageCountMoreThan"
+          countNumber   = 5
+        }
+        action = {
+          type = "expire"
+        }
+      },
+      {
+        rulePriority = 3
+        description  = "Delete untagged images after 7 days"
+        selection = {
+          tagStatus   = "untagged"
+          countType   = "sinceImagePushed"
+          countUnit   = "days"
+          countNumber = 7
+        }
+        action = {
+          type = "expire"
+        }
+      }
+    ]
+  })
+}
+
+# VPC for ECS
+resource "aws_vpc" "main" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-vpc"
+    }
+  )
+}
+
+# Public Subnets
+resource "aws_subnet" "public" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  vpc_id                  = aws_vpc.main[0].id
+  cidr_block              = "10.0.${count.index}.0/24"
+  availability_zone       = data.aws_availability_zones.available.names[count.index]
+  map_public_ip_on_launch = true
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-public-${count.index + 1}"
+      Type = "Public"
+    }
+  )
+}
+
+# Private Subnets
+resource "aws_subnet" "private" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  vpc_id            = aws_vpc.main[0].id
+  cidr_block        = "10.0.${count.index + 10}.0/24"
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-private-${count.index + 1}"
+      Type = "Private"
+    }
+  )
+}
+
+# Internet Gateway
+resource "aws_internet_gateway" "main" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  vpc_id = aws_vpc.main[0].id
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-igw"
+    }
+  )
+}
+
+# NAT Gateway
+resource "aws_eip" "nat" {
+  count  = var.enable_ecs_backend ? 2 : 0
+  domain = "vpc"
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-nat-eip-${count.index + 1}"
+    }
+  )
+}
+
+resource "aws_nat_gateway" "main" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  allocation_id = aws_eip.nat[count.index].id
+  subnet_id     = aws_subnet.public[count.index].id
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-nat-${count.index + 1}"
+    }
+  )
+
+  depends_on = [aws_internet_gateway.main]
+}
+
+# Route Tables
+resource "aws_route_table" "public" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  vpc_id = aws_vpc.main[0].id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main[0].id
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-public-rt"
+    }
+  )
+}
+
+resource "aws_route_table" "private" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  vpc_id = aws_vpc.main[0].id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main[count.index].id
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-private-rt-${count.index + 1}"
+    }
+  )
+}
+
+# Route Table Associations
+resource "aws_route_table_association" "public" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  subnet_id      = aws_subnet.public[count.index].id
+  route_table_id = aws_route_table.public[0].id
+}
+
+resource "aws_route_table_association" "private" {
+  count = var.enable_ecs_backend ? 2 : 0
+
+  subnet_id      = aws_subnet.private[count.index].id
+  route_table_id = aws_route_table.private[count.index].id
+}
+
+# Security Group for ALB
+resource "aws_security_group" "alb" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name        = "${var.project_name}-${var.environment}-alb-sg"
+  description = "Security group for ALB"
+  vpc_id      = aws_vpc.main[0].id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow HTTP from anywhere"
+  }
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow HTTPS from anywhere"
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow all outbound traffic"
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-alb-sg"
+    }
+  )
+}
+
+# Security Group for ECS Tasks
+resource "aws_security_group" "ecs_tasks" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name        = "${var.project_name}-${var.environment}-ecs-tasks-sg"
+  description = "Security group for ECS tasks"
+  vpc_id      = aws_vpc.main[0].id
+
+  ingress {
+    from_port       = var.container_port
+    to_port         = var.container_port
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb[0].id]
+    description     = "Allow traffic from ALB"
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow all outbound traffic"
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-ecs-tasks-sg"
+    }
+  )
+}
+
+# Application Load Balancer
+resource "aws_lb" "api" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name               = "${var.project_name}-${var.environment}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb[0].id]
+  subnets            = aws_subnet.public[*].id
+
+  enable_deletion_protection = var.environment == "production" ? true : false
+  enable_http2               = true
+  enable_cross_zone_load_balancing = true
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-alb"
+    }
+  )
+}
+
+# ALB Target Group
+resource "aws_lb_target_group" "api" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name        = "${var.project_name}-${var.environment}-tg"
+  port        = var.container_port
+  protocol    = "HTTP"
+  vpc_id      = aws_vpc.main[0].id
+  target_type = "ip"
+
+  health_check {
+    enabled             = true
+    healthy_threshold   = 2
+    unhealthy_threshold = 3
+    timeout             = 5
+    interval            = 30
+    path                = "/health"
+    matcher             = "200"
+  }
+
+  deregistration_delay = 30
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-tg"
+    }
+  )
+}
+
+# ALB Listener (HTTP -> HTTPS Redirect)
+resource "aws_lb_listener" "http" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  load_balancer_arn = aws_lb.api[0].arn
+  port              = 80
+  protocol          = "HTTP"
+
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }
+  }
+}
+
+# ALB Listener (HTTPS)
+resource "aws_lb_listener" "https" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  load_balancer_arn = aws_lb.api[0].arn
+  port              = 443
+  protocol          = "HTTPS"
+  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
+  certificate_arn   = aws_acm_certificate.cloudfront.arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.api[0].arn
+  }
+
+  depends_on = [aws_acm_certificate_validation.cloudfront]
+}
+
+# ECS Cluster
+resource "aws_ecs_cluster" "main" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name = "${var.project_name}-${var.environment}-cluster"
+
+  setting {
+    name  = "containerInsights"
+    value = "enabled"
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-ecs-cluster"
+    }
+  )
+}
+
+# ECS Cluster Capacity Providers
+resource "aws_ecs_cluster_capacity_providers" "main" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  cluster_name = aws_ecs_cluster.main[0].name
+
+  capacity_providers = ["FARGATE", "FARGATE_SPOT"]
+
+  default_capacity_provider_strategy {
+    base              = 1
+    weight            = 100
+    capacity_provider = "FARGATE"
+  }
+}
+
+# CloudWatch Log Group
+resource "aws_cloudwatch_log_group" "ecs" {
+  count = var.enable_ecs_backend && var.enable_cloudwatch_logs ? 1 : 0
+
+  name              = "/ecs/${var.project_name}-${var.environment}"
+  retention_in_days = var.log_retention_days
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-logs"
+    }
+  )
+}
+
+# IAM Role for ECS Task Execution
+resource "aws_iam_role" "ecs_task_execution" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name = "${var.project_name}-${var.environment}-ecs-task-execution-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ecs-tasks.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-ecs-task-execution-role"
+    }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  role       = aws_iam_role.ecs_task_execution[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+# IAM Role for ECS Task
+resource "aws_iam_role" "ecs_task" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name = "${var.project_name}-${var.environment}-ecs-task-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ecs-tasks.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-ecs-task-role"
+    }
+  )
+}
+
+# IAM Policy for S3 Access
+resource "aws_iam_role_policy" "ecs_task_s3" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name = "${var.project_name}-${var.environment}-ecs-task-s3-policy"
+  role = aws_iam_role.ecs_task[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject",
+          "s3:ListBucket"
+        ]
+        Resource = [
+          aws_s3_bucket.assets.arn,
+          "${aws_s3_bucket.assets.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
+# ECS Task Definition
+resource "aws_ecs_task_definition" "app" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  family                   = "${var.project_name}-${var.environment}"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = var.ecs_task_cpu
+  memory                   = var.ecs_task_memory
+  execution_role_arn       = aws_iam_role.ecs_task_execution[0].arn
+  task_role_arn            = aws_iam_role.ecs_task[0].arn
+
+  container_definitions = jsonencode([
+    {
+      name      = "${var.project_name}-container"
+      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      essential = true
+
+      portMappings = [
+        {
+          containerPort = var.container_port
+          protocol      = "tcp"
+        }
+      ]
+
+      environment = [
+        {
+          name  = "NODE_ENV"
+          value = var.environment
+        },
+        {
+          name  = "PORT"
+          value = tostring(var.container_port)
+        }
+      ]
+
+      secrets = [
+        {
+          name      = "DATABASE_URL"
+          valueFrom = aws_secretsmanager_secret.database_url[0].arn
+        },
+        {
+          name      = "SESSION_SECRET"
+          valueFrom = aws_secretsmanager_secret.session_secret[0].arn
+        }
+      ]
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.ecs[0].name
+          "awslogs-region"        = var.aws_region
+          "awslogs-stream-prefix" = "ecs"
+        }
+      }
+
+      healthCheck = {
+        command     = ["CMD-SHELL", "curl -f http://localhost:${var.container_port}/health || exit 1"]
+        interval    = 30
+        timeout     = 5
+        retries     = 3
+        startPeriod = 60
+      }
+    }
+  ])
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-task-def"
+    }
+  )
+}
+
+# ECS Service
+resource "aws_ecs_service" "app" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name            = "${var.project_name}-${var.environment}-service"
+  cluster         = aws_ecs_cluster.main[0].id
+  task_definition = aws_ecs_task_definition.app[0].arn
+  desired_count   = var.ecs_desired_count
+  launch_type     = "FARGATE"
+
+  network_configuration {
+    subnets          = aws_subnet.private[*].id
+    security_groups  = [aws_security_group.ecs_tasks[0].id]
+    assign_public_ip = false
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.api[0].arn
+    container_name   = "${var.project_name}-container"
+    container_port   = var.container_port
+  }
+
+  deployment_configuration {
+    maximum_percent         = 200
+    minimum_healthy_percent = 100
+  }
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-service"
+    }
+  )
+
+  depends_on = [
+    aws_lb_listener.https
+  ]
+}
+
+# Auto Scaling Target
+resource "aws_appautoscaling_target" "ecs" {
+  count = var.enable_ecs_backend && var.enable_autoscaling ? 1 : 0
+
+  max_capacity       = var.autoscaling_max_capacity
+  min_capacity       = var.autoscaling_min_capacity
+  resource_id        = "service/${aws_ecs_cluster.main[0].name}/${aws_ecs_service.app[0].name}"
+  scalable_dimension = "ecs:service:DesiredCount"
+  service_namespace  = "ecs"
+}
+
+# Auto Scaling Policy - CPU
+resource "aws_appautoscaling_policy" "ecs_cpu" {
+  count = var.enable_ecs_backend && var.enable_autoscaling ? 1 : 0
+
+  name               = "${var.project_name}-${var.environment}-cpu-autoscaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs[0].resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs[0].scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs[0].service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageCPUUtilization"
+    }
+    target_value = var.autoscaling_target_cpu
+  }
+}
+
+# Auto Scaling Policy - Memory
+resource "aws_appautoscaling_policy" "ecs_memory" {
+  count = var.enable_ecs_backend && var.enable_autoscaling ? 1 : 0
+
+  name               = "${var.project_name}-${var.environment}-memory-autoscaling"
+  policy_type        = "TargetTrackingScaling"
+  resource_id        = aws_appautoscaling_target.ecs[0].resource_id
+  scalable_dimension = aws_appautoscaling_target.ecs[0].scalable_dimension
+  service_namespace  = aws_appautoscaling_target.ecs[0].service_namespace
+
+  target_tracking_scaling_policy_configuration {
+    predefined_metric_specification {
+      predefined_metric_type = "ECSServiceAverageMemoryUtilization"
+    }
+    target_value = var.autoscaling_target_memory
+  }
+}
+
+# Secrets Manager for Database URL
+resource "aws_secretsmanager_secret" "database_url" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name                    = "${var.project_name}-${var.environment}-database-url"
+  recovery_window_in_days = var.environment == "production" ? 30 : 0
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-database-url"
+    }
+  )
+}
+
+resource "aws_secretsmanager_secret_version" "database_url" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  secret_id     = aws_secretsmanager_secret.database_url[0].id
+  secret_string = var.database_url
+}
+
+# Secrets Manager for Session Secret
+resource "aws_secretsmanager_secret" "session_secret" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  name                    = "${var.project_name}-${var.environment}-session-secret"
+  recovery_window_in_days = var.environment == "production" ? 30 : 0
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-session-secret"
+    }
+  )
+}
+
+resource "aws_secretsmanager_secret_version" "session_secret" {
+  count = var.enable_ecs_backend ? 1 : 0
+
+  secret_id     = aws_secretsmanager_secret.session_secret[0].id
+  secret_string = var.session_secret
+}
+
+# Data source for availability zones
+data "aws_availability_zones" "available" {
+  state = "available"
+}