Skip to content

Commit f9f5fb0

Browse files
jamesiarmesjamesiarmes
committed
feat: Added consumer and tools containers.
1 parent f0dec05 commit f9f5fb0

38 files changed

+1605
-0
lines changed

‎tofu/config/service/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
output "consumer_image_push_commands" {
2+
value = module.system.consumer_image_push_commands
3+
description = "Commands to push a Docker image to the consumer container repository."
4+
}
5+
6+
output "tools_image_push_commands" {
7+
value = module.system.tools_image_push_commands
8+
description = "Commands to push a Docker image to the consumer container repository."
9+
}
10+
111
output "export_bucket" {
212
value = module.system.export_bucket
313
description = "The name of the S3 bucket for exports."

‎tofu/modules/deployment/templates/iam-policy.yaml.tftpl‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,30 @@
11
Version: "2012-10-17"
22
Statement:
3+
- Sid: InfraStateAccess
4+
Effect: Allow
5+
Action:
6+
- s3:CreateBucket
7+
- s3:ListBucket
8+
- s3:GetBucketLocation
9+
- s3:GetObject
10+
- s3:PutObject
11+
- s3:DeleteObject
12+
Resource:
13+
- arn:${partition}:s3:::${project}-${environment}-tfstate
14+
- arn:${partition}:s3:::${project}-${environment}-tfstate/*
15+
- Sid: InfraLockAccess
16+
Effect: Allow
17+
Action:
18+
- dynamodb:CreateTable
19+
- dynamodb:DescribeTable
20+
- dynamodb:DeleteTable
21+
- dynamodb:UpdateTable
22+
- dynamodb:GetItem
23+
- dynamodb:PutItem
24+
- dynamodb:DeleteItem
25+
Resource:
26+
- arn:${partition}:dynamodb:${region}:${account_id}:table/${environment}.tfstate
27+
328
- Effect: Allow
429
Action:
530
- ec2:DescribeAddresses

‎tofu/modules/ephemeral_service/data.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "aws_caller_identity" "identity" {}
2+
3+
data "aws_partition" "current" {}
4+
5+
data "aws_region" "current" {}

‎tofu/modules/ephemeral_service/iam.tf‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
resource "aws_iam_policy" "execution" {
2+
name = "${local.prefix}-execution"
3+
description = "${var.service} task execution policy for ${var.project} ${var.environment}."
4+
5+
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/execution-policy.yaml.tftpl", {
6+
project = var.project
7+
environment = var.environment
8+
ecr_arn = local.repository_arn
9+
})))
10+
11+
tags = var.tags
12+
}
13+
14+
resource "aws_iam_role" "execution" {
15+
name = "${local.prefix}-execution"
16+
description = "${var.service} task execution role for ${var.project} ${var.environment}."
17+
18+
assume_role_policy = jsonencode({
19+
Version = "2012-10-17"
20+
Statement = [
21+
{
22+
Effect = "Allow"
23+
Action = "sts:AssumeRole"
24+
Principal = {
25+
Service = "ecs-tasks.amazonaws.com"
26+
}
27+
}
28+
]
29+
})
30+
31+
tags = var.tags
32+
}
33+
34+
resource "aws_iam_role_policy_attachments_exclusive" "execution" {
35+
role_name = aws_iam_role.execution.name
36+
policy_arns = concat([
37+
aws_iam_policy.execution.arn
38+
], var.execution_policies)
39+
}
40+
41+
resource "aws_iam_role" "task" {
42+
name = "${local.prefix}-task"
43+
description = "${var.service} task role for ${var.project} ${var.environment}."
44+
45+
assume_role_policy = jsonencode({
46+
Version = "2012-10-17"
47+
Statement = [
48+
{
49+
Effect = "Allow"
50+
Action = "sts:AssumeRole"
51+
Principal = {
52+
Service = "ecs-tasks.amazonaws.com"
53+
}
54+
}
55+
]
56+
})
57+
58+
tags = var.tags
59+
}
60+
61+
resource "aws_iam_role_policy_attachments_exclusive" "task" {
62+
role_name = aws_iam_role.task.name
63+
# TODO: Create our own policy instead of using the managed ones.
64+
policy_arns = concat([
65+
"arn:${data.aws_partition.current.partition}:iam::aws:policy/CloudWatchFullAccess",
66+
"arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonSSMFullAccess",
67+
"arn:${data.aws_partition.current.partition}:iam::aws:policy/CloudWatchAgentServerPolicy",
68+
], var.task_policies)
69+
}

‎tofu/modules/ephemeral_service/kms.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "aws_kms_key" "fargate" {
2+
description = "${var.service} hosting encryption key for ${var.project} ${var.environment}"
3+
deletion_window_in_days = var.key_recovery_period
4+
enable_key_rotation = true
5+
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/key-policy.yaml.tftpl", {
6+
account_id : data.aws_caller_identity.identity.account_id,
7+
exec_role_arn : aws_iam_role.execution.arn,
8+
partition : data.aws_partition.current.partition,
9+
region : data.aws_region.current.region,
10+
repository_name : local.prefix,
11+
})))
12+
13+
tags = var.tags
14+
}
15+
16+
resource "aws_kms_alias" "fargate" {
17+
name = "alias/${var.project}/${var.environment}/${var.service}"
18+
target_key_id = aws_kms_key.fargate.id
19+
}

‎tofu/modules/ephemeral_service/locals.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
locals {
2+
image_url = module.ecr.repository_url
3+
prefix = "${var.project}-${var.environment}-${var.service}"
4+
repository_arn = module.ecr.repository_arn
5+
stats_prefix = var.stats_prefix != "" ? var.stats_prefix : "${var.project}/${var.service}"
6+
image_tag = var.image_tag
7+
}

‎tofu/modules/ephemeral_service/logs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "aws_cloudwatch_log_group" "service" {
2+
name = "/aws/ecs/${var.project}/${var.environment}/${var.service}"
3+
retention_in_days = 30
4+
kms_key_id = var.logging_key_id
5+
6+
tags = var.tags
7+
}

‎tofu/modules/ephemeral_service/main.tf‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
module "ecr" {
2+
source = "terraform-aws-modules/ecr/aws"
3+
version = "~> 3.0"
4+
5+
repository_name = local.prefix
6+
repository_image_scan_on_push = true
7+
repository_encryption_type = "KMS"
8+
repository_force_delete = var.force_delete
9+
repository_image_tag_mutability = var.image_tags_mutable ? "MUTABLE" : "IMMUTABLE"
10+
repository_kms_key = aws_kms_key.fargate.arn
11+
repository_lifecycle_policy = jsonencode(yamldecode(templatefile(
12+
"${path.module}/templates/repository-lifecycle.yaml.tftpl", {
13+
untagged_image_retention : var.untagged_image_retention
14+
}
15+
)))
16+
17+
18+
tags = var.tags
19+
}
20+
21+
module "ecs_task" {
22+
source = "HENNGE/ecs/aws//modules/core/task"
23+
version = "~> 5.3"
24+
25+
name = local.prefix
26+
# cluster = module.ecs.arn
27+
# container_name = local.prefix
28+
cpu = var.cpu
29+
memory = var.memory
30+
daemon_role = aws_iam_role.execution.arn
31+
task_role = aws_iam_role.task.arn
32+
requires_compatibilities = ["FARGATE"]
33+
network_mode = "awsvpc"
34+
35+
volume_configurations = [
36+
{
37+
name = "aws-lib"
38+
},
39+
{
40+
name = "logs"
41+
},
42+
{
43+
name = "senzing-home"
44+
}
45+
]
46+
47+
container_definitions = jsonencode(yamldecode(templatefile(
48+
"${path.module}/templates/container_definitions.yaml.tftpl", {
49+
name = local.prefix
50+
cpu = var.cpu - 256
51+
memory = var.memory - 512
52+
image = "${local.image_url}:${local.image_tag}"
53+
container_command = var.container_command
54+
container_port = var.container_port
55+
log_group = aws_cloudwatch_log_group.service.name
56+
region = data.aws_region.current.region
57+
namespace = "${var.project}/${var.service}"
58+
env_vars = var.environment_variables
59+
otel_log_level = var.otel_log_level
60+
otel_ssm_arn = module.otel_config.ssm_parameter_arn
61+
env_secrets = var.environment_secrets
62+
63+
volumes = {
64+
# Needed to support SMS agent and ecs exec.
65+
aws-lib = {
66+
name = "aws-lib"
67+
mount = "/var/lib/aws"
68+
},
69+
logs = {
70+
name = "logs",
71+
mount = "/var/log"
72+
},
73+
senzing-home = {
74+
name = "senzing-home"
75+
mount = "/home/senzing"
76+
}
77+
}
78+
}
79+
)))
80+
81+
tags = var.tags
82+
}

‎tofu/modules/ephemeral_service/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "docker_push" {
2+
description = "Commands to push a Docker image to the container repository."
3+
value = <<EOT
4+
aws ecr get-login-password --region ${data.aws_region.current.region} | docker login --username AWS --password-stdin ${module.ecr.repository_registry_id}.dkr.ecr.${data.aws_region.current.region}.amazonaws.com
5+
docker build -t ${module.ecr.repository_name} --platform linux/amd64 -f Dockerfile .
6+
docker tag ${module.ecr.repository_name}:${var.image_tag} ${local.image_url}:latest
7+
docker push ${local.image_url}:latest
8+
EOT
9+
}

‎tofu/modules/ephemeral_service/secrets.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
module "otel_config" {
2+
source = "terraform-aws-modules/ssm-parameter/aws"
3+
version = "~> 1.1"
4+
5+
name = "/${var.project}/${var.environment}/${var.service}/otel"
6+
description = "Configuration for the OpenTelemetry collector."
7+
tier = "Intelligent-Tiering"
8+
value = templatefile("${path.module}/templates/aws-otel-config.yaml.tftpl", {
9+
app_namespace = local.stats_prefix
10+
})
11+
12+
tags = var.tags
13+
}

0 commit comments

Comments
 (0)