Skip to content

Commit 7348d53

Browse files
oanhnnoanhnn
committed
Change required version aws provider, Add submodule
1 parent 41b3091 commit 7348d53

File tree

14 files changed

+631
-11
lines changed

14 files changed

+631
-11
lines changed

‎.github/dependabot.yml‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,42 @@
44
version: 2
55
updates:
66

7-
- package-ecosystem: "github-actions"
8-
directory: "/"
7+
- package-ecosystem: github-actions
8+
directory: /
99
schedule:
10-
interval: "weekly"
10+
interval: weekly
11+
day: monday
12+
time: "12:00"
13+
timezone: Asia/Ho_Chi_Minh
1114
labels:
12-
- "dependencies"
15+
- dependencies
16+
17+
- package-ecosystem: terraform
18+
directory: /
19+
schedule:
20+
interval: weekly
21+
day: monday
22+
time: "12:00"
23+
timezone: Asia/Ho_Chi_Minh
24+
labels:
25+
- dependencies
26+
27+
- package-ecosystem: terraform
28+
directory: /modules/ecs-execution-role
29+
schedule:
30+
interval: weekly
31+
day: monday
32+
time: "12:00"
33+
timezone: Asia/Ho_Chi_Minh
34+
labels:
35+
- dependencies
36+
37+
- package-ecosystem: terraform
38+
directory: /modules/ecs-task-role
39+
schedule:
40+
interval: weekly
41+
day: monday
42+
time: "12:00"
43+
timezone: Asia/Ho_Chi_Minh
44+
labels:
45+
- dependencies

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ validate: ## Validate Terraform files
6060
.PHONY: docs
6161
docs: ## Generate README.md
6262
terraform-docs markdown . \
63+
--recursive \
6364
--sort-by required \
6465
--output-file README.md \
6566
--output-mode insert

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Terraform module which creates ECS cluster resources on AWS.
77
```hcl
88
module "php" {
99
source = "rabiloo/ecs/aws"
10-
version = "~> 0.2.0"
10+
version = "~> 0.2.1"
1111
1212
name = "app-ecs-cluster"
1313
capacity_providers = ["FARGATE", "FARGATE_SPOT"]
@@ -26,14 +26,14 @@ module "php" {
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.2 |
30-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 4.52 |
29+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.2 |
30+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >=4.0 |
3131

3232
## Providers
3333

3434
| Name | Version |
3535
|------|---------|
36-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.52.0 |
36+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >=4.0 |
3737

3838
## Modules
3939

@@ -85,5 +85,5 @@ If you would like to help take a look at the [list of issues](https://github.com
8585
## License
8686

8787
This project is released under the MIT License.
88-
Copyright © 2021 [Rabiloo Co., Ltd](https://rabiloo.com)
88+
Copyright © 2023 [Rabiloo Co., Ltd](https://rabiloo.com)
8989
Please see [License File](LICENSE) for more information.

‎modules/ecs-execution-role/README.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# ECS Task Execution Role submodule
2+
3+
This submodule help create an IAM assumable role for ECS Task Execution Role
4+
5+
## Usage
6+
7+
```hcl
8+
module "task_execution_role" {
9+
source = "rabiloo/ecs/aws//modules/ecs-execution-role"
10+
version = ">=0.2.1"
11+
12+
name = "custom-ecs-execution-role"
13+
path = "/service-roles/"
14+
15+
readable_kms_keys_arn = [
16+
"arn:aws:kms:<region>:<account_id>:key/1234abcd-12ab-34cd-56ef-1234567890ab",
17+
]
18+
readable_secrets_arn = [
19+
"arn:aws:secretsmanager:<region>:<account_id>:secret:example-123456",
20+
]
21+
22+
tags = {
23+
Owner = "user"
24+
Service = "app-name"
25+
Managed = "Terraform"
26+
}
27+
}
28+
```
29+
30+
<!-- BEGIN_TF_DOCS -->
31+
## Requirements
32+
33+
| Name | Version |
34+
|------|---------|
35+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.2 |
36+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >=4.0 |
37+
38+
## Providers
39+
40+
| Name | Version |
41+
|------|---------|
42+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >=4.0 |
43+
44+
## Modules
45+
46+
| Name | Source | Version |
47+
|------|--------|---------|
48+
| <a name="module_policy"></a> [policy](#module\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~>5.14.0 |
49+
| <a name="module_this"></a> [this](#module\_this) | terraform-aws-modules/iam/aws//modules/iam-assumable-role | ~>5.14.0 |
50+
51+
## Resources
52+
53+
| Name | Type |
54+
|------|------|
55+
| [aws_iam_policy.AmazonECSTaskExecutionRolePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
56+
| [aws_iam_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
57+
58+
## Inputs
59+
60+
| Name | Description | Type | Default | Required |
61+
|------|-------------|------|---------|:--------:|
62+
| <a name="input_name"></a> [name](#input\_name) | The name of the IAM role | `string` | n/a | yes |
63+
| <a name="input_description"></a> [description](#input\_description) | The description of the IAM role | `string` | `"This is a customized role"` | no |
64+
| <a name="input_path"></a> [path](#input\_path) | The path to the IAM role | `string` | `"/"` | no |
65+
| <a name="input_readable_kms_keys_arn"></a> [readable\_kms\_keys\_arn](#input\_readable\_kms\_keys\_arn) | The list KMS key\_id | `list(string)` | `[]` | no |
66+
| <a name="input_readable_secrets_arn"></a> [readable\_secrets\_arn](#input\_readable\_secrets\_arn) | The list secret ARN | `list(string)` | `[]` | no |
67+
| <a name="input_tags"></a> [tags](#input\_tags) | The list of tags to apply to the IAM role | `map(string)` | `{}` | no |
68+
69+
## Outputs
70+
71+
| Name | Description |
72+
|------|-------------|
73+
| <a name="output_iam_role_arn"></a> [iam\_role\_arn](#output\_iam\_role\_arn) | The ARN of the IAM role |
74+
| <a name="output_iam_role_name"></a> [iam\_role\_name](#output\_iam\_role\_name) | The name of the IAM role |
75+
| <a name="output_iam_role_unique_id"></a> [iam\_role\_unique\_id](#output\_iam\_role\_unique\_id) | The unique ID of the IAM role |
76+
<!-- END_TF_DOCS -->
77+
78+
## Contributing
79+
80+
All code contributions must go through a pull request and approved by a core developer before being merged.
81+
This is to ensure proper review of all the code.
82+
83+
Fork the project, create a feature branch, and send a pull request.
84+
85+
If you would like to help take a look at the [list of issues](https://github.com/rabiloo/terraform-aws-ecs/issues).
86+
87+
## License
88+
89+
This project is released under the MIT License.
90+
Copyright © 2023 [Rabiloo Co., Ltd](https://rabiloo.com)
91+
Please see [License File](https://github.com/rabiloo/terraform-aws-ecs/blob/master/LICENSE) for more information.

‎modules/ecs-execution-role/main.tf‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html
2+
# The task execution role grants the Amazon ECS container and Fargate agents permission
3+
# to make AWS API calls on your behalf.
4+
# It includes the following permissions:
5+
# - pulling a container image from an Amazon ECR private repository
6+
# - sends container logs to CloudWatch Logs using the awslogs log driver
7+
# - using private registry authentication
8+
# - referencing sensitive data using Secrets Manager secrets or AWS Systems Manager Parameter Store parameters
9+
10+
data "aws_iam_policy" "AmazonECSTaskExecutionRolePolicy" {
11+
name = "AmazonECSTaskExecutionRolePolicy"
12+
}
13+
14+
data "aws_iam_policy_document" "policy" {
15+
// TODO: test this statement is required?
16+
statement {
17+
sid = "AllowECSExecCommand"
18+
effect = "Allow"
19+
actions = [
20+
"ssmmessages:CreateControlChannel",
21+
"ssmmessages:CreateDataChannel",
22+
"ssmmessages:OpenControlChannel",
23+
"ssmmessages:OpenDataChannel"
24+
]
25+
resources = ["*"]
26+
}
27+
28+
# statement {
29+
# sid = "AllowGetSecrets"
30+
# effect = "Allow"
31+
# actions = [
32+
# "kms:Decrypt",
33+
# "secretsmanager:GetSecretValue"
34+
# ]
35+
# resources = [
36+
# "arn:aws:secretsmanager:<region>:<aws_account_id>:secret:secret_name",
37+
# "arn:aws:kms:<region>:<aws_account_id>:key/key_id"
38+
# ]
39+
# }
40+
41+
dynamic "statement" {
42+
for_each = (length(var.readable_kms_keys_arn) > 0 && length(var.readable_secrets_arn) > 0) ? [true] : []
43+
content {
44+
sid = "AllowGetSecrets"
45+
effect = "Allow"
46+
actions = [
47+
"kms:Decrypt",
48+
"secretsmanager:GetSecretValue",
49+
]
50+
resources = concat(
51+
var.readable_kms_keys_arn,
52+
var.readable_secrets_arn,
53+
)
54+
}
55+
}
56+
}
57+
58+
module "policy" {
59+
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
60+
version = "~>5.14.0"
61+
62+
name = "${var.name}-policies"
63+
policy = data.aws_iam_policy_document.policy.json
64+
tags = var.tags
65+
}
66+
67+
module "this" {
68+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
69+
version = "~>5.14.0"
70+
71+
role_name = var.name
72+
role_path = var.path
73+
role_description = var.description
74+
tags = var.tags
75+
76+
create_role = true
77+
role_requires_mfa = false
78+
79+
trusted_role_actions = [
80+
"sts:AssumeRole",
81+
]
82+
trusted_role_services = [
83+
"ecs.amazonaws.com",
84+
"ecs-tasks.amazonaws.com",
85+
]
86+
custom_role_policy_arns = [
87+
data.aws_iam_policy.AmazonECSTaskExecutionRolePolicy.arn,
88+
module.policy.arn,
89+
]
90+
91+
depends_on = [
92+
module.policy,
93+
]
94+
}

‎modules/ecs-execution-role/outputs.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
output "iam_role_unique_id" {
2+
description = "The unique ID of the IAM role"
3+
value = module.this.iam_role_unique_id
4+
}
5+
6+
output "iam_role_name" {
7+
description = "The name of the IAM role"
8+
value = module.this.iam_role_name
9+
}
10+
11+
output "iam_role_arn" {
12+
description = "The ARN of the IAM role"
13+
value = module.this.iam_role_arn
14+
}

‎modules/ecs-execution-role/variables.tf‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
variable "name" {
2+
description = "The name of the IAM role"
3+
type = string
4+
5+
validation {
6+
condition = var.name != ""
7+
error_message = "The name MUST be not empty."
8+
}
9+
10+
validation {
11+
condition = var.name == replace(var.name, "/[^a-zA-Z0-9-_]+/", "")
12+
error_message = "The name MUST be alphanumeric and can contain dashes and underscores."
13+
}
14+
}
15+
16+
variable "tags" {
17+
description = "The list of tags to apply to the IAM role"
18+
type = map(string)
19+
default = {}
20+
}
21+
22+
variable "path" {
23+
description = "The path to the IAM role"
24+
type = string
25+
default = "/"
26+
27+
validation {
28+
condition = var.path == replace(var.path, "/[^a-zA-Z0-9-_\\/]+/", "")
29+
error_message = "The path MUST be alphanumeric and can contain dashes, underscores and slashs."
30+
}
31+
}
32+
33+
variable "description" {
34+
description = "The description of the IAM role"
35+
type = string
36+
default = "This is a customized role"
37+
}
38+
39+
variable "readable_kms_keys_arn" {
40+
description = "The list KMS key_id"
41+
type = list(string)
42+
default = []
43+
}
44+
45+
variable "readable_secrets_arn" {
46+
description = "The list secret ARN"
47+
type = list(string)
48+
default = []
49+
}

‎modules/ecs-execution-role/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">=1.2"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">=4.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)