ecs terraform module ===========

A terraform module to provide ECS clusters in AWS.

This Module currently supports Terraform 0.10.x, but does not require it. If you use tfenv, this module contains a .terraform-version file which matches the version of Terraform we currently use to test with.

Module Input Variables

Required

• name - ECS cluster name
• key_name - An EC2 key pair name
• subnet_id - A list of subnet IDs
• vpc_id - The VPC ID to place the cluster in

Optional

NOTE About User Data: The userdata parameter overwrites the userdata template used by this module, this will break some of the module features (e.g. dockerstoragesize, dockerhubtoken, and dockerhubemail). However, additionaluserdatascript will concatenate additional data to the end of the current userdata script. It is recomended that you use additionaluserdata_script. These two parameters are mutually exclusive - you can not pass both into this module and expect it to work.

• additionaluserdatascript - Additional userdata scripts content
• ebsblockdevice - EBS block devices to attach to the instance. (default: /dev/xvdcz)
• region - AWS Region - defaults to us-east-1
• servers - Number of ECS Servers to start in the cluster - defaults to 1
• min_servers - Minimum number of ECS Servers to start in the cluster - defaults to 1
• max_servers - Maximum number of ECS Servers to start in the cluster - defaults to 10
• instance_type - AWS instance type - defaults to t2.micro
• load_balancers - List of elastic load balancer (classic only) names to put in front of your instances - defaults to []
• iam_path - IAM path, this is useful when creating resources with the same name across multiple regions. Defaults to /
• associatepublicip_address - assign a publicly-routable IP address to every instance in the cluster - default: false.
• dockerstoragesize - EBS Volume size in Gib that the ECS Instance uses for Docker images and metadata - defaults to 22
• dockerhub_email - Email Address used to authenticate to dockerhub. http://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html
• dockerhub_token - Auth Token used for dockerhub. http://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html
• extratags - Additional tags to be added to the ECS autoscaling group. Must be in the form of an array of hashes. See https://www.terraform.io/docs/providers/aws/r/autoscalinggroup.html for examples.

extra_tags = [
    {
      key                 = "consul_server"
      value               = "true"
      propagateatlaunch = true
    },
  ]

• allowedcidrblocks - List of subnets to allow into the ECS Security Group. Defaults to ["0.0.0.0/0"].
• ami - A specific AMI image to use, eg ami-95f8d2f3. Defaults to the latest ECS optimized Amazon Linux AMI.
• ami_version - Specific version of the Amazon ECS AMI to use (e.g. 2016.09). Defaults to *. Ignored if ami is specified.
• heartbeat_timeout - Heartbeat Timeout setting for how long it takes for the graceful shutdown hook takes to timeout. This is useful when deploying clustered applications like consul that benifit from having a deploy between autoscaling create/destroy actions. Defaults to 180"
• asgdeleteextratimeout - Extra time that terraform apply will wait for ASG deletion (default 600). This is added on top of heartbeattimeout. This variable is customizable for when the instances take longer than 600sec to shut down once shutdown is initiated.
• securitygroupids - a list of security group IDs to apply to the launch configuration
• userdata - The instance user data (e.g. a cloud-init config) to use in the awslaunch_configuration
• customiampolicy - JSON containing the custom IAM policy for ECS nodes. Will overwrite the default one if set.

• consul_image - Image to use when deploying consul, defaults to the hashicorp consul image
• registrator_image - Image to use when deploying registrator agent, defaults to the gliderlabs registrator:latest
• consulmemoryreservation - The soft limit (in MiB) of memory to reserve for the container, defaults 20
• registratormemoryreservation - The soft limit (in MiB) of memory to reserve for the container, defaults 20
• enable_agents - Enable Consul Agent and Registrator tasks on each ECS Instance. Defaults to false
• spotbidprice - Use spot instances and request this bid price. Note that with this option you risk your instances

• enabled_metrics - A list of metrics to collect.

module "ecs-cluster" {
  source    = "github.com/terraform-community-modules/tfawsecs"
  name      = "infra-services"
  servers   = 1
  subnet_id = ["subnet-6e101446"]
  vpc_id    = "vpc-99e73dfc"
}

Example cluster with consul and Registrator

In order to start the Consul/Registrator task in ECS, you'll need to pass in a consul config into the additionaluserdata_script script parameter. For example, you might pass something like this:

Please note, this module will try to mount /etc/consul/ into /consul/config in the container and assumes that the consul config lives under /etc/consul on the docker host.

/bin/mkdir -p /etc/consul
cat <<"CONSUL" > /etc/consul/config.json
{
	"raft_protocol": 3,
	"log_level": "INFO",
	"enablescriptchecks": true,
  "datacenter": "${datacenter}",
	"retryjoinec2": {
		"tagkey": "consulserver",
		"tag_value": "true"
	}
}
CONSUL

data "templatefile" "ecsconsulagentjson" {
  template = "${file("ecsconsulagent.json.sh")}"
vars {     datacenter = "infra-services"   } }
module "ecs-cluster" {   source                      = "github.com/terraform-community-modules/tfawsecs"   name                        = "infra-services"   servers                     = 1   subnet_id                   = ["subnet-6e101446"]   vpc_id                      = "vpc-99e73dfc"   additionaluserdatascript = "${data.templatefile.ecsconsulagent_json.rendered}"   enable_agents               = true }

Outputs =======

• clusterid - (String)_ ECS Cluster id for use in ECS task and service definitions.
• clustername - (String) ECS Cluster name that can be used for CloudWatch app autoscaling policy resourceid.
• autoscalinggroup (Map) A map with keys id, name, and arn of the awsautoscaling_group created.
• iamrole (Map) A map with keys arn and name of the iamrole created.
• securitygroup (Map) A map with keys id, name, and arn of the awssecurity_group created.

• Tim Hartmann
• Joe Stump
• Michal

MIT