Terraform module to create AWS ECS resources 🇺🇦
Last updated Jul 8, 2026
674
Stars
664
Forks
4
Issues
+1
Stars/day
Attention Score
91
Language breakdown
HCL 100.0%
▸ Files
click to expand
README
AWS ECS Terraform module
Terraform module which creates ECS (Elastic Container Service) resources on AWS.
Available Features
- ECS cluster w/ Fargate or EC2 Auto Scaling capacity providers
- ECS Service w/ task definition, task set, and container definition support
- Separate sub-modules or integrated module for ECS cluster and service
Usage
This project supports creating resources through individual sub-modules, or through a single module that creates both the cluster and service resources. See the respective sub-module directory for more details and example usage.
Integrated Cluster w/ Services
module "ecs" {
source = "terraform-aws-modules/ecs/aws"
cluster_name = "ecs-integrated"
cluster_configuration = { executecommandconfiguration = { logging = "OVERRIDE" log_configuration = { cloudwatchloggroupname = "/aws/ecs/aws-ec2" } } }
# Cluster capacity providers clustercapacityproviders = ["FARGATE", "FARGATE_SPOT"] defaultcapacityprovider_strategy = { FARGATE = { weight = 50 base = 20 } FARGATE_SPOT = { weight = 50 } }
services = { ecsdemo-frontend = { cpu = 1024 memory = 4096
# Container definition(s) container_definitions = {
fluent-bit = { cpu = 512 memory = 1024 essential = true image = "906394416424.dkr.ecr.us-west-2.amazonaws.com/aws-for-fluent-bit:stable" firelensConfiguration = { type = "fluentbit" } memoryReservation = 50 }
ecs-sample = { cpu = 512 memory = 1024 essential = true image = "public.ecr.aws/aws-containers/ecsdemo-frontend:776fd50" portMappings = [ { name = "ecs-sample" containerPort = 80 protocol = "tcp" } ]
# Example image used requires access to write to root filesystem readonlyRootFilesystem = false
dependsOn = [{ containerName = "fluent-bit" condition = "START" }]
enablecloudwatchlogging = false logConfiguration = { logDriver = "awsfirelens" options = { Name = "firehose" region = "eu-west-1" delivery_stream = "my-stream" log-driver-buffer-limit = "2097152" } } memoryReservation = 100 } }
serviceconnectconfiguration = { namespace = "example" service = [{ client_alias = { port = 80 dns_name = "ecs-sample" } port_name = "ecs-sample" discovery_name = "ecs-sample" }] }
load_balancer = { service = { targetgrouparn = "arn:aws:elasticloadbalancing:eu-west-1:1234567890:targetgroup/bluegreentarget1/209a844cd01825a4" container_name = "ecs-sample" container_port = 80 } }
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
securitygroupingress_rules = { alb_3000 = { description = "Service port" fromport = local.containerport ip_protocol = "tcp" referencedsecuritygroup_id = "sg-12345678" } } securitygroupegress_rules = { all = { ip_protocol = "-1" cidr_ipv4 = "0.0.0.0/0" } } } }
tags = { Environment = "Development" Project = "Example" } }
Examples
- ECS cluster w/ integrated service(s)
- ECS container definition
- ECS cluster w/ EC2 Autoscaling capacity provider
- ECS express service
- ECS cluster w/ Fargate capacity provider
- ECS cluster w/ ECS managed instances capacity provider
Requirements
| Name | Version | |------|---------| | terraform | >= 1.5.7 | | aws | >= 6.34 |
Providers
No providers.
Modules
| Name | Source | Version | |------|--------|---------| | cluster | ./modules/cluster | n/a | | service | ./modules/service | n/a |
Resources
No resources.
Inputs
| Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | capacity\providers | Map of capacity provider definitions to create for the cluster |
map(object({
autoscalinggroupprovider = optional(object({
autoscalinggrouparn = string
manageddraining = optional(string, "ENABLED")
managedscaling = optional(object({
instancewarmupperiod = optional(number)
maximumscalingstepsize = optional(number)
minimumscalingstepsize = optional(number)
status = optional(string)
targetcapacity = optional(number)
}))
managedterminationprotection = optional(string)
}))
managedinstancesprovider = optional(object({
infrastructurerolearn = optional(string)
instancelaunchtemplate = object({
capacityoptiontype = optional(string)
ec2instanceprofilearn = optional(string)
instancerequirements = optional(object({
acceleratorcount = optional(object({
max = optional(number)
min = optional(number)
}))
acceleratormanufacturers = optional(list(string))
acceleratornames = optional(list(string))
acceleratortotalmemorymib = optional(object({
max = optional(number)
min = optional(number)
}))
acceleratortypes = optional(list(string))
allowedinstancetypes = optional(list(string))
baremetal = optional(string)
baselineebsbandwidthmbps = optional(object({
max = optional(number)
min = optional(number)
}))
burstableperformance = optional(string)
cpumanufacturers = optional(list(string))
excludedinstancetypes = optional(list(string))
instancegenerations = optional(list(string))
localstorage = optional(string)
localstoragetypes = optional(list(string))
maxspotpriceaspercentageofoptimalondemandprice = optional(number)
memorygibpervcpu = optional(object({
max = optional(number)
min = optional(number)
}))
memorymib = optional(object({
max = optional(number)
min = optional(number)
}))
networkbandwidthgbps = optional(object({
max = optional(number)
min = optional(number)
}))
networkinterfacecount = optional(object({
max = optional(number)
min = optional(number)
}))
ondemandmaxpricepercentageoverlowestprice = optional(number)
requirehibernatesupport = optional(bool)
spotmaxpricepercentageoverlowestprice = optional(number)
totallocalstoragegb = optional(object({
max = optional(number)
min = optional(number)
}))
vcpucount = optional(object({
max = optional(number)
min = optional(number)
}))
}))
monitoring = optional(string)
networkconfiguration = optional(object({
securitygroups = optional(list(string), [])
subnets = list(string)
}))
storageconfiguration = optional(object({
storagesizegib = number
}))
})
propagatetags = optional(string, "CAPACITYPROVIDER")
}))
name = optional(string) # Will fall back to use map key if not set
tags = optional(map(string), {})
})) | null | no | | cloudwatch\log\group\class | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENTACCESS | string | null | no | | cloudwatch\log\group\kms\key\_id | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | string | null | no | | cloudwatch\log\group\_name | Custom name of CloudWatch Log Group for ECS cluster | string | null | no | | cloudwatch\log\group\retention\in\_days | Number of days to retain log events | number | 90 | no | | cloudwatch\log\group\_tags | A map of additional tags to add to the log group created | map(string) | {} | no | | cluster\capacity\providers | List of capacity provider names to associate with the ECS cluster. Note: any capacity providers created by this module will be automatically added | list(string) | [] | no | | cluster\configuration | The execute command configuration for the cluster | object({
executecommandconfiguration = optional(object({
kmskeyid = optional(string)
logconfiguration = optional(object({
cloudwatchencryptionenabled = optional(bool)
cloudwatchloggroupname = optional(string)
s3bucketencryptionenabled = optional(bool)
s3bucketname = optional(string)
s3kmskeyid = optional(string)
s3keyprefix = optional(string)
}))
logging = optional(string, "OVERRIDE")
}))
managedstorageconfiguration = optional(object({
fargateephemeralstoragekmskeyid = optional(string)
kmskeyid = optional(string)
}))
}) | {
"executecommandconfiguration": {
"logconfiguration": {
"cloudwatchloggroup_name": "placeholder"
}
}
} | no | | cluster\_name | Name of the cluster (up to 255 letters, numbers, hyphens, and underscores) | string | "" | no | | cluster\service\connect\_defaults | Configures a default Service Connect namespace | object({
namespace = string
}) | null | no | | cluster\_setting | List of configuration block(s) with cluster settings. For example, this can be used to enable CloudWatch Container Insights for a cluster | list(object({
name = string
value = string
})) | [| no | | cluster\_tags | A map of additional tags to add to the cluster |
{
"name": "containerInsights",
"value": "enabled"
}
]
map(string) | {} | no | | create | Determines whether resources will be created (affects all resources) | bool | true | no | | create\cloudwatch\log\_group | Determines whether a log group is created by this module for the cluster logs. If not, AWS will automatically create one if logging is enabled | bool | true | no | | create\infrastructure\iam\_role | Determines whether the ECS infrastructure IAM role should be created | bool | true | no | | create\node\iam\instance\profile | Determines whether an IAM instance profile is created or to use an existing IAM instance profile | bool | true | no | | create\security\group | Determines if a security group is created | bool | true | no | | create\task\exec\iam\role | Determines whether the ECS task definition IAM role should be created | bool | false | no | | create\task\exec\_policy | Determines whether the ECS task definition IAM policy should be created. This includes permissions included in AmazonECSTaskExecutionRolePolicy as well as access to secrets and SSM parameters | bool | true | no | | default\capacity\provider\_strategy | Map of default capacity provider strategy definitions to use for the cluster | map(object({
base = optional(number)
name = optional(string) # Will fall back to use map key if not set
weight = optional(number)
})) | null | no | | disable\v7\default\name\description | [DEPRECATED - will be removed in v8.0] Determines whether to disable the default postfix added to resource names and descriptions added in v7.0 | bool | false | no | | infrastructure\iam\role\_description | Description of the role | string | null | no | | infrastructure\iam\role\_name | Name to use on IAM role created | string | null | no | | infrastructure\iam\role\override\policy\_documents | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid | list(string) | [] | no | | infrastructure\iam\role\_path | IAM role path | string | null | no | | infrastructure\iam\role\permissions\boundary | ARN of the policy that is used to set the permissions boundary for the IAM role | string | null | no | | infrastructure\iam\role\source\policy\_documents | List of IAM policy documents that are merged together into the exported document. Statements must have unique sids | list(string) | [] | no | | infrastructure\iam\role\statements | A map of IAM policy statements for custom permission usage | map(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string, "Allow")
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
not_principals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
variable = string
values = list(string)
})))
})) | null | no | | infrastructure\iam\role\_tags | A map of additional tags to add to the IAM role created | map(string) | {} | no | | infrastructure\iam\role\use\name\prefix | Determines whether the IAM role name (iamrole_name) is used as a prefix | bool | true | no | | node\iam\role\additional\policies | Additional policies to be added to the IAM role | map(string) | {} | no | | node\iam\role\_description | Description of the role | string | "ECS Managed Instances node IAM role" | no | | node\iam\role\_name | Name to use on IAM role/instance profile created | string | null | no | | node\iam\role\override\policy\_documents | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid | list(string) | [] | no | | node\iam\role\_path | IAM role/instance profile path | string | null | no | | node\iam\role\permissions\boundary | ARN of the policy that is used to set the permissions boundary for the IAM role | string | null | no | | node\iam\role\source\policy\_documents | List of IAM policy documents that are merged together into the exported document. Statements must have unique sids | list(string) | [] | no | | node\iam\role\statements | A map of IAM policy statements for custom permission usage | map(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string, "Allow")
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
not_principals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
variable = string
values = list(string)
})))
})) | null | no | | node\iam\role\_tags | A map of additional tags to add to the IAM role/instance profile created | map(string) | {} | no | | node\iam\role\use\name\prefix | Determines whether the IAM role/instance profile name (nodeiamrolename) is used as a prefix | bool | true | no | | region | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | string | null | no | | security\group\description | Description of the security group created | string | null | no | | security\group\egress\rules | Security group egress rules to add to the security group created | map(object({
name = optional(string)
cidripv4 = optional(string)
cidripv6 = optional(string)
description = optional(string)
fromport = optional(string)
ipprotocol = optional(string, "tcp")
prefixlistid = optional(string)
referencedsecuritygroupid = optional(string)
tags = optional(map(string), {})
toport = optional(string)
})) | {
"allipv4": {
"cidripv4": "0.0.0.0/0",
"description": "Allow all IPv4 traffic",
"ipprotocol": "-1"
},
"allipv6": {
"cidripv6": "::/0",
"description": "Allow all IPv6 traffic",
"ip_protocol": "-1"
}
} | no | | security\group\ingress\rules | Security group ingress rules to add to the security group created | map(object({
name = optional(string)
cidripv4 = optional(string)
cidripv6 = optional(string)
description = optional(string)
fromport = optional(string)
ipprotocol = optional(string, "tcp")
prefixlistid = optional(string)
referencedsecuritygroupid = optional(string)
tags = optional(map(string), {})
to_port = optional(string)
})) | {} | no | | security\group\name | Name to use on security group created | string | null | no | | security\group\tags | A map of additional tags to add to the security group created | map(string) | {} | no | | security\group\use\name\prefix | Determines whether the security group name (securitygroupname) is used as a prefix | bool | true | no | | services | Map of service definitions to create | map(object({
create = optional(bool)
createservice = optional(bool)
tags = optional(map(string))
# Service
ignoretaskdefinitionchanges = optional(bool)
alarms = optional(object({
alarmnames = list(string)
enable = optional(bool)
rollback = optional(bool)
}))
availabilityzonerebalancing = optional(string)
capacityproviderstrategy = optional(map(object({
base = optional(number)
capacityprovider = string
weight = optional(number)
})))
deploymentcircuitbreaker = optional(object({
enable = bool
rollback = bool
}))
deploymentconfiguration = optional(object({
strategy = optional(string)
baketimeinminutes = optional(string)
canaryconfiguration = optional(object({
canarybaketimeinminutes = optional(string)
canarypercent = optional(string)
}))
linearconfiguration = optional(object({
stepbaketimeinminutes = optional(string)
steppercent = optional(string)
}))
lifecyclehook = optional(map(object({
hooktargetarn = string
rolearn = optional(string)
lifecyclestages = list(string)
hookdetails = optional(string)
})))
}))
deploymentcontroller = optional(object({
type = optional(string)
}))
deploymentmaximumpercent = optional(number, 200)
deploymentminimumhealthypercent = optional(number, 66)
desiredcount = optional(number, 1)
enableecsmanagedtags = optional(bool)
enableexecutecommand = optional(bool)
forcedelete = optional(bool)
forcenewdeployment = optional(bool)
healthcheckgraceperiodseconds = optional(number)
launchtype = optional(string)
loadbalancer = optional(map(object({
containername = string
containerport = number
elbname = optional(string)
targetgrouparn = optional(string)
advancedconfiguration = optional(object({
alternatetargetgrouparn = string
productionlistenerrule = string # Should be optional but bug in provider
rolearn = optional(string)
testlistenerrule = optional(string)
}))
})))
name = optional(string) # Will fall back to use map key if not set
assignpublicip = optional(bool)
securitygroupids = optional(list(string))
subnetids = optional(list(string))
orderedplacementstrategy = optional(list(object({
field = optional(string)
type = string
})))
placementconstraints = optional(map(object({
expression = optional(string)
type = string
})))
platformversion = optional(string)
propagatetags = optional(string)
schedulingstrategy = optional(string)
serviceconnectconfiguration = optional(object({
enabled = optional(bool)
accesslogconfiguration = optional(object({
format = string
includequeryparameters = optional(string)
}))
logconfiguration = optional(object({
logdriver = string
options = optional(map(string))
secretoption = optional(list(object({
name = string
valuefrom = string
})))
}))
namespace = optional(string)
service = optional(list(object({
clientalias = optional(object({
dnsname = optional(string)
port = number
testtrafficrules = optional(list(object({
header = optional(object({
name = string
value = object({
exact = string
})
}))
})))
}))
discoveryname = optional(string)
ingressportoverride = optional(number)
portname = string
timeout = optional(object({
idletimeoutseconds = optional(number)
perrequesttimeoutseconds = optional(number)
}))
tls = optional(object({
issuercertauthority = object({
awspcaauthorityarn = string
})
kmskey = optional(string)
rolearn = optional(string)
}))
})))
}))
serviceregistries = optional(object({
containername = optional(string)
containerport = optional(number)
port = optional(number)
registryarn = string
}))
sigintrollback = optional(bool)
timeouts = optional(object({
create = optional(string)
update = optional(string)
delete = optional(string)
}))
triggers = optional(map(string))
volumeconfiguration = optional(object({
name = string
managedebsvolume = object({
encrypted = optional(bool)
filesystemtype = optional(string)
iops = optional(number)
kmskeyid = optional(string)
sizeingb = optional(number)
snapshotid = optional(string)
tagspecifications = optional(list(object({
propagatetags = optional(string)
resourcetype = string
tags = optional(map(string))
})))
throughput = optional(number)
volumeinitializationrate = optional(number)
volumetype = optional(string)
})
}))
vpclatticeconfigurations = optional(object({
rolearn = string
targetgrouparn = string
portname = string
}))
waitforsteadystate = optional(bool)
servicetags = optional(map(string))
# Service - IAM Role
createiamrole = optional(bool)
iamrolearn = optional(string)
iamrolename = optional(string)
iamroleusenameprefix = optional(bool)
iamrolepath = optional(string)
iamroledescription = optional(string)
iamrolepermissionsboundary = optional(string)
iamroletags = optional(map(string))
iamrolestatements = optional(list(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string)
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
notprincipals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
values = list(string)
variable = string
})))
})))
# Task Definition
createtaskdefinition = optional(bool)
taskdefinitionarn = optional(string)
containerdefinitions = optional(map(object({
operatingsystemfamily = optional(string)
tags = optional(map(string))
# Container definition
command = optional(list(string))
cpu = optional(number)
credentialSpecs = optional(list(string))
dependsOn = optional(list(object({
condition = string
containerName = string
})))
disableNetworking = optional(bool)
dnsSearchDomains = optional(list(string))
dnsServers = optional(list(string))
dockerLabels = optional(map(string))
dockerSecurityOptions = optional(list(string))
enableexecutecommand = optional(bool)
entrypoint = optional(list(string))
environment = optional(list(object({
name = string
value = string
})))
environmentFiles = optional(list(object({
type = string
value = string
})))
essential = optional(bool)
extraHosts = optional(list(object({
hostname = string
ipAddress = string
})))
firelensConfiguration = optional(object({
options = optional(map(string))
type = optional(string)
}))
healthCheck = optional(object({
command = optional(list(string))
interval = optional(number)
retries = optional(number)
startPeriod = optional(number)
timeout = optional(number)
}))
hostname = optional(string)
image = optional(string)
interactive = optional(bool)
links = optional(list(string))
linuxParameters = optional(object({
capabilities = optional(object({
add = optional(list(string))
drop = optional(list(string))
}))
devices = optional(list(object({
containerPath = optional(string)
hostPath = optional(string)
permissions = optional(list(string))
})))
initProcessEnabled = optional(bool)
maxSwap = optional(number)
sharedMemorySize = optional(number)
swappiness = optional(number)
tmpfs = optional(list(object({
containerPath = string
mountOptions = optional(list(string))
size = number
})))
}))
logConfiguration = optional(object({
logDriver = optional(string)
options = optional(map(string))
secretOptions = optional(list(object({
name = string
valueFrom = string
})))
}))
memory = optional(number)
memoryReservation = optional(number)
mountPoints = optional(list(object({
containerPath = optional(string)
readOnly = optional(bool)
sourceVolume = optional(string)
})), [])
name = optional(string)
portMappings = optional(list(object({
appProtocol = optional(string)
containerPort = optional(number)
containerPortRange = optional(string)
hostPort = optional(number)
name = optional(string)
protocol = optional(string)
})), [])
privileged = optional(bool)
pseudoTerminal = optional(bool)
readonlyRootFilesystem = optional(bool)
repositoryCredentials = optional(object({
credentialsParameter = optional(string)
}))
resourceRequirements = optional(list(object({
type = string
value = string
})))
restartPolicy = optional(object({
enabled = optional(bool)
ignoredExitCodes = optional(list(number))
restartAttemptPeriod = optional(number)
}))
secrets = optional(list(object({
name = string
valueFrom = string
})))
startTimeout = optional(number)
stopTimeout = optional(number)
systemControls = optional(list(object({
namespace = optional(string)
value = optional(string)
})))
ulimits = optional(list(object({
hardLimit = number
name = string
softLimit = number
})))
user = optional(string)
versionConsistency = optional(string)
volumesFrom = optional(list(object({
readOnly = optional(bool)
sourceContainer = optional(string)
})))
workingDirectory = optional(string)
# Cloudwatch Log Group
service = optional(string, "")
enablecloudwatchlogging = optional(bool)
createcloudwatchloggroup = optional(bool)
cloudwatchloggroupname = optional(string)
cloudwatchloggroupusenameprefix = optional(bool)
cloudwatchloggroupclass = optional(string)
cloudwatchloggroupretentionindays = optional(number)
cloudwatchloggroupkmskeyid = optional(string)
})))
cpu = optional(number, 1024)
enablefaultinjection = optional(bool)
ephemeralstorage = optional(object({
sizeingib = number
}))
family = optional(string)
ipcmode = optional(string)
memory = optional(number, 2048)
networkmode = optional(string)
pidmode = optional(string)
proxyconfiguration = optional(object({
containername = string
properties = optional(map(string))
type = optional(string)
}))
requirescompatibilities = optional(list(string))
runtimeplatform = optional(object({
cpuarchitecture = optional(string)
operatingsystemfamily = optional(string)
}))
skipdestroy = optional(bool)
taskdefinitionplacementconstraints = optional(map(object({
expression = optional(string)
type = string
})))
tracklatest = optional(bool)
volume = optional(map(object({
configureatlaunch = optional(bool)
dockervolumeconfiguration = optional(object({
autoprovision = optional(bool)
driver = optional(string)
driveropts = optional(map(string))
labels = optional(map(string))
scope = optional(string)
}))
efsvolumeconfiguration = optional(object({
authorizationconfig = optional(object({
accesspointid = optional(string)
iam = optional(string)
}))
filesystemid = string
rootdirectory = optional(string)
transitencryption = optional(string)
transitencryptionport = optional(number)
}))
fsxwindowsfileservervolumeconfiguration = optional(object({
authorizationconfig = optional(object({
credentialsparameter = string
domain = string
}))
filesystemid = string
rootdirectory = string
}))
hostpath = optional(string)
name = optional(string)
})))
tasktags = optional(map(string))
# Task Execution - IAM Role
createtaskexeciamrole = optional(bool)
taskexeciamrolearn = optional(string)
taskexeciamrolename = optional(string)
taskexeciamroleusenameprefix = optional(bool)
taskexeciamrolepath = optional(string)
taskexeciamroledescription = optional(string)
taskexeciamrolepermissionsboundary = optional(string)
taskexeciamroletags = optional(map(string))
taskexeciamrolepolicies = optional(map(string))
taskexeciamrolemaxsessionduration = optional(number)
createtaskexecpolicy = optional(bool)
taskexecssmparamarns = optional(list(string))
taskexecsecretarns = optional(list(string))
taskexeciamstatements = optional(list(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string)
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
notprincipals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
values = list(string)
variable = string
})))
})))
taskexeciampolicypath = optional(string)
# Tasks - IAM Role
createtasksiamrole = optional(bool)
tasksiamrolearn = optional(string)
tasksiamrolename = optional(string)
tasksiamroleusenameprefix = optional(bool)
tasksiamrolepath = optional(string)
tasksiamroledescription = optional(string)
tasksiamrolepermissionsboundary = optional(string)
tasksiamroletags = optional(map(string))
tasksiamrolepolicies = optional(map(string))
tasksiamrolemaxsessionduration = optional(number)
tasksiamrolestatements = optional(list(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string)
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
notprincipals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
values = list(string)
variable = string
})))
})))
# Task Set
externalid = optional(string)
scale = optional(object({
unit = optional(string)
value = optional(number)
}))
waituntilstable = optional(bool)
waituntilstabletimeout = optional(string)
# Autoscaling
enableautoscaling = optional(bool)
autoscalingmincapacity = optional(number)
autoscalingmaxcapacity = optional(number)
autoscalingpolicies = optional(map(object({
name = optional(string) # Will fall back to the key name if not provided
policytype = optional(string)
predictivescalingpolicyconfiguration = optional(object({
maxcapacitybreachbehavior = optional(string)
maxcapacitybuffer = optional(number)
metricspecification = list(object({
customizedcapacitymetricspecification = optional(object({
metricdataquery = list(object({
expression = optional(string)
id = string
label = optional(string)
metricstat = optional(object({
metric = object({
dimension = optional(list(object({
name = string
value = string
})))
metricname = optional(string)
namespace = optional(string)
})
stat = string
unit = optional(string)
}))
returndata = optional(bool)
}))
}))
customizedloadmetricspecification = optional(object({
metricdataquery = list(object({
expression = optional(string)
id = string
label = optional(string)
metricstat = optional(object({
metric = object({
dimension = optional(list(object({
name = string
value = string
})))
metricname = optional(string)
namespace = optional(string)
})
stat = string
unit = optional(string)
}))
returndata = optional(bool)
}))
}))
customizedscalingmetricspecification = optional(object({
metricdataquery = list(object({
expression = optional(string)
id = string
label = optional(string)
metricstat = optional(object({
metric = object({
dimension = optional(list(object({
name = string
value = string
})))
metricname = optional(string)
namespace = optional(string)
})
stat = string
unit = optional(string)
}))
returndata = optional(bool)
}))
}))
predefinedloadmetricspecification = optional(object({
predefinedmetrictype = string
resourcelabel = optional(string)
}))
predefinedmetricpairspecification = optional(object({
predefinedmetrictype = string
resourcelabel = optional(string)
}))
predefinedscalingmetricspecification = optional(object({
predefinedmetrictype = string
resourcelabel = optional(string)
}))
targetvalue = number
}))
mode = optional(string)
schedulingbuffertime = optional(number)
}))
stepscalingpolicyconfiguration = optional(object({
adjustmenttype = optional(string)
cooldown = optional(number)
metricaggregationtype = optional(string)
minadjustmentmagnitude = optional(number)
stepadjustment = optional(list(object({
metricintervallowerbound = optional(string)
metricintervalupperbound = optional(string)
scalingadjustment = number
})))
}))
targettrackingscalingpolicyconfiguration = optional(object({
customizedmetricspecification = optional(object({
dimensions = optional(list(object({
name = string
value = string
})))
metricname = optional(string)
metrics = optional(list(object({
expression = optional(string)
id = string
label = optional(string)
metricstat = optional(object({
metric = object({
dimensions = optional(list(object({
name = string
value = string
})))
metricname = string
namespace = string
})
stat = string
unit = optional(string)
}))
returndata = optional(bool)
})))
namespace = optional(string)
statistic = optional(string)
unit = optional(string)
}))
disablescalein = optional(bool)
predefinedmetricspecification = optional(object({
predefinedmetrictype = string
resourcelabel = optional(string)
}))
scaleincooldown = optional(number)
scaleoutcooldown = optional(number)
targetvalue = optional(number)
}))
})))
autoscalingscheduledactions = optional(map(object({
name = optional(string)
mincapacity = number
maxcapacity = number
schedule = string
starttime = optional(string)
endtime = optional(string)
timezone = optional(string)
})))
autoscalingsuspendedstate = optional(object({
dynamicscalinginsuspended = optional(bool)
dynamicscalingoutsuspended = optional(bool)
scheduledscalingsuspended = optional(bool)
}))
# Security Group
createsecuritygroup = optional(bool)
vpcid = optional(string)
securitygroupname = optional(string)
securitygroupusenameprefix = optional(bool)
securitygroupdescription = optional(string)
securitygroupingressrules = optional(map(object({
cidripv4 = optional(string)
cidripv6 = optional(string)
description = optional(string)
fromport = optional(string)
ipprotocol = optional(string)
prefixlistid = optional(string)
referencedsecuritygroupid = optional(string)
tags = optional(map(string))
toport = optional(string)
})))
securitygroupegressrules = optional(map(object({
cidripv4 = optional(string)
cidripv6 = optional(string)
description = optional(string)
fromport = optional(string)
ipprotocol = optional(string)
prefixlistid = optional(string)
referencedsecuritygroupid = optional(string)
tags = optional(map(string))
toport = optional(string)
})))
securitygrouptags = optional(map(string))
# ECS Infrastructure IAM Role
createinfrastructureiamrole = optional(bool)
infrastructureiamrolearn = optional(string)
infrastructureiamrolename = optional(string)
infrastructureiamroleusenameprefix = optional(bool)
infrastructureiamrolepath = optional(string)
infrastructureiamroledescription = optional(string)
infrastructureiamrolepermissionsboundary = optional(string)
infrastructureiamrole_tags = optional(map(string))
})) | null | no | | tags | A map of tags to add to all resources | map(string) | {} | no | | task\exec\iam\role\description | Description of the role | string | null | no | | task\exec\iam\role\name | Name to use on IAM role created | string | null | no | | task\exec\iam\role\path | IAM role path | string | null | no | | task\exec\iam\role\permissions\_boundary | ARN of the policy that is used to set the permissions boundary for the IAM role | string | null | no | | task\exec\iam\role\policies | Map of IAM role policy ARNs to attach to the IAM role | map(string) | {} | no | | task\exec\iam\role\tags | A map of additional tags to add to the IAM role created | map(string) | {} | no | | task\exec\iam\role\use\name\prefix | Determines whether the IAM role name (taskexeciamrolename) is used as a prefix | bool | true | no | | task\exec\iam\statements | A map of IAM policy statements for custom permission usage | map(object({
sid = optional(string)
actions = optional(list(string))
notactions = optional(list(string))
effect = optional(string, "Allow")
resources = optional(list(string))
notresources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
not_principals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
variable = string
values = list(string)
})))
})) | null | no | | task\exec\secret\_arns | List of SecretsManager secret ARNs the task execution role will be permitted to get/read | list(string) | [] | no | | task\exec\ssm\param\arns | List of SSM parameter ARNs the task execution role will be permitted to get/read | list(string) | [] | no | | vpc\_id | The ID of the VPC where the security group will be created | string | null | no |
Outputs
| Name | Description | |------|-------------| | capacity\_providers | Map of autoscaling capacity providers created and their attributes | | cloudwatch\log\group\_arn | ARN of CloudWatch log group created | | cloudwatch\log\group\_name | Name of CloudWatch log group created | | cluster\_arn | ARN that identifies the cluster | | cluster\capacity\providers | Map of cluster capacity providers attributes | | cluster\_id | ID that identifies the cluster | | cluster\_name | Name that identifies the cluster | | infrastructure\iam\role\_arn | The Amazon Resource Name (ARN) specifying the IAM role | | infrastructure\iam\role\_name | IAM role name | | infrastructure\iam\role\unique\id | Stable and unique string identifying the IAM role | | node\iam\instance\profile\arn | ARN assigned by AWS to the instance profile | | node\iam\instance\profile\id | Instance profile's ID | | node\iam\instance\profile\unique | Stable and unique string identifying the IAM instance profile | | node\iam\role\_arn | The Amazon Resource Name (ARN) specifying the IAM role | | node\iam\role\_name | IAM role name | | node\iam\role\unique\id | Stable and unique string identifying the IAM role | | services | Map of services created and their attributes | | task\exec\iam\role\arn | Task execution IAM role ARN | | task\exec\iam\role\name | Task execution IAM role name | | task\exec\iam\role\unique\_id | Stable and unique string identifying the task execution IAM role |
Authors
Module is maintained by Anton Babenko with help from these awesome contributors.
License
Apache-2.0 Licensed. See LICENSE
