42 | > Watch demo of using Atmos with Terraform
43 | > 
44 | > Example of running atmos to manage infrastructure from our Quick Start tutorial.
45 | >
46 |
47 |
48 |
49 |
50 |
51 | ## Usage
52 |
53 | This module is meant to be used as output only, meaning it will be used to create outputs which are consumed as a parameter by Terraform resources or other modules.
54 |
55 | Caution: This module, unlike nearly all other Cloud Posse Terraform modules, does not use [terraform-null-label](https://github.com/cloudposse/terraform-null-label/).
56 | Furthermore, it has an input named `environment` which has a completely different meaning than the one in `terraform-null-label`.
57 | Do not call this module with the conventional `context = module.this.context`. See the documentation below for the usage of `environment`.
58 |
59 | For complete examples, see
60 |
61 | - [multi-port mappings](examples/multi_port_mappings)
62 | - [multi-type env vars](examples/multi_type_env_vars)
63 | - [multiple definitions](examples/multiple_definitions)
64 | - [string env vars](examples/string_env_vars)
65 |
66 | For a complete example with automated tests, see [examples/complete](examples/complete) with `bats` and `Terratest` for the example [test](test).
67 |
68 | ```hcl
69 | module "container_definition" {
70 | source = "cloudposse/ecs-container-definition/aws"
71 | # Cloud Posse recommends pinning every module to a specific version
72 | # version = "x.x.x"
73 |
74 | container_name = "geodesic"
75 | container_image = "cloudposse/geodesic"
76 | }
77 | ```
78 |
79 | The output of this module can then be used with one of our other modules.
80 |
81 | ```hcl
82 | module "ecs_alb_service_task" {
83 | source = "cloudposse/ecs-alb-service-task/aws"
84 | # Cloud Posse recommends pinning every module to a specific version
85 | # version = "x.x.x"
86 |
87 | # ...
88 | container_definition_json = module.container_definition.json_map_encoded_list
89 | # ...
90 | }
91 | ```
92 |
93 | > [!IMPORTANT]
94 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation
95 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version
96 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic
97 | > approach for updating versions to avoid unexpected changes.
98 |
99 |
100 |
101 |
102 |
103 |
104 |
105 |
106 |
107 | ## Requirements
108 |
109 | | Name | Version |
110 | |------|---------|
111 | | [terraform](#requirement\_terraform) | >= 1.3.0 |
112 | | [local](#requirement\_local) | >= 1.2 |
113 |
114 | ## Providers
115 |
116 | No providers.
117 |
118 | ## Modules
119 |
120 | No modules.
121 |
122 | ## Resources
123 |
124 | No resources.
125 |
126 | ## Inputs
127 |
128 | | Name | Description | Type | Default | Required |
129 | |------|-------------|------|---------|:--------:|
130 | | [command](#input\_command) | The command that is passed to the container | `list(string)` | `null` | no |
131 | | [container\_cpu](#input\_container\_cpu) | The number of cpu units to reserve for the container. This is optional for tasks using Fargate launch type and the total amount of container\_cpu of all containers in a task will need to be lower than the task-level cpu value | `number` | `0` | no |
132 | | [container\_definition](#input\_container\_definition) | Container definition overrides which allows for extra keys or overriding existing keys. | object({
command = optional(list(string))
cpu = optional(number)
dependsOn = optional(list(object({
condition = string
containerName = string
})))
disableNetworking = optional(bool)
dnsSearchDomains = optional(list(string))
dnsServers = optional(list(string))
dockerLabels = optional(map(string))
dockerSecurityOptions = optional(list(string))
entryPoint = optional(list(string))
environment = optional(list(object({
name = string
value = string
})))
environmentFiles = optional(list(object({
type = string
value = string
})))
essential = optional(bool)
extraHosts = optional(list(object({
hostname = string
ipAddress = string
})))
firelensConfiguration = optional(object({
options = optional(map(string))
type = string
}))
healthCheck = optional(object({
command = list(string)
interval = optional(number)
retries = optional(number)
startPeriod = optional(number)
timeout = optional(number)
}))
hostname = optional(string)
image = optional(string)
interactive = optional(bool)
links = optional(list(string))
linuxParameters = optional(object({
capabilities = optional(object({
add = optional(list(string))
drop = optional(list(string))
}))
devices = optional(list(object({
containerPath = string
hostPath = string
permissions = optional(list(string))
})))
initProcessEnabled = optional(bool)
maxSwap = optional(number)
sharedMemorySize = optional(number)
swappiness = optional(number)
tmpfs = optional(list(object({
containerPath = string
mountOptions = optional(list(string))
size = number
})))
}))
logConfiguration = optional(object({
logDriver = string
options = optional(map(string))
secretOptions = optional(list(object({
name = string
valueFrom = string
})))
}))
memory = optional(number)
memoryReservation = optional(number)
mountPoints = optional(list(object({
containerPath = optional(string)
readOnly = optional(bool)
sourceVolume = optional(string)
})))
name = optional(string)
portMappings = optional(list(object({
containerPort = number
hostPort = optional(number)
protocol = optional(string)
name = optional(string)
appProtocol = optional(string)
})))
privileged = optional(bool)
pseudoTerminal = optional(bool)
readonlyRootFilesystem = optional(bool)
repositoryCredentials = optional(object({
credentialsParameter = string
}))
resourceRequirements = optional(list(object({
type = string
value = string
})))
restartPolicy = optional(object({
enabled = bool
ignoredExitCodes = optional(list(number))
restartAttemptPeriod = optional(number)
}))
secrets = optional(list(object({
name = string
valueFrom = string
})))
startTimeout = optional(number)
stopTimeout = optional(number)
systemControls = optional(list(object({
namespace = string
value = string
})))
ulimits = optional(list(object({
hardLimit = number
name = string
softLimit = number
})))
user = optional(string)
versionConsistency = optional(string)
volumesFrom = optional(list(object({
readOnly = optional(bool)
sourceContainer = string
})))
workingDirectory = optional(string)
}) | `{}` | no |
133 | | [container\_depends\_on](#input\_container\_depends\_on) | The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. The condition can be one of START, COMPLETE, SUCCESS or HEALTHY | list(object({
condition = string
containerName = string
})) | `null` | no |
134 | | [container\_image](#input\_container\_image) | The image used to start the container. Images in the Docker Hub registry available by default | `string` | n/a | yes |
135 | | [container\_memory](#input\_container\_memory) | The amount of memory (in MiB) to allow the container to use. This is a hard limit, if the container attempts to exceed the container\_memory, the container is killed. This field is optional for Fargate launch type and the total amount of container\_memory of all containers in a task will need to be lower than the task memory value | `number` | `null` | no |
136 | | [container\_memory\_reservation](#input\_container\_memory\_reservation) | The amount of memory (in MiB) to reserve for the container. If container needs to exceed this threshold, it can do so up to the set container\_memory hard limit | `number` | `null` | no |
137 | | [container\_name](#input\_container\_name) | The name of the container. Up to 255 characters ([a-z], [A-Z], [0-9], -, \_ allowed) | `string` | n/a | yes |
138 | | [disable\_networking](#input\_disable\_networking) | When this parameter is true, networking is disabled within the container. | `bool` | `null` | no |
139 | | [dns\_search\_domains](#input\_dns\_search\_domains) | Container DNS search domains. A list of DNS search domains that are presented to the container | `list(string)` | `null` | no |
140 | | [dns\_servers](#input\_dns\_servers) | Container DNS servers. This is a list of strings specifying the IP addresses of the DNS servers | `list(string)` | `null` | no |
141 | | [docker\_labels](#input\_docker\_labels) | The configuration options to send to the `docker_labels` | `map(string)` | `null` | no |
142 | | [docker\_security\_options](#input\_docker\_security\_options) | A list of strings to provide custom labels for SELinux and AppArmor multi-level security systems. | `list(string)` | `null` | no |
143 | | [entrypoint](#input\_entrypoint) | The entry point that is passed to the container | `list(string)` | `null` | no |
144 | | [environment](#input\_environment) | The environment variables to pass to the container. This is a list of maps. map\_environment overrides environment | list(object({
name = string
value = string
})) | `null` | no |
145 | | [environment\_files](#input\_environment\_files) | One or more files containing the environment variables to pass to the container. This maps to the --env-file option to docker run. The file must be hosted in Amazon S3. This option is only available to tasks using the EC2 launch type. This is a list of maps | list(object({
type = string
value = string
})) | `null` | no |
146 | | [essential](#input\_essential) | Determines whether all other containers in a task are stopped, if this container fails or stops for any reason. Due to how Terraform type casts booleans in json it is required to double quote this value | `bool` | `true` | no |
147 | | [extra\_hosts](#input\_extra\_hosts) | A list of hostnames and IP address mappings to append to the /etc/hosts file on the container. This is a list of maps | list(object({
hostname = string
ipAddress = string
})) | `null` | no |
148 | | [firelens\_configuration](#input\_firelens\_configuration) | The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html | object({
options = optional(map(string))
type = string
}) | `null` | no |
149 | | [healthcheck](#input\_healthcheck) | A map containing command (string), timeout, interval (duration in seconds), retries (1-10, number of times to retry before marking container unhealthy), and startPeriod (0-300, optional grace period to wait, in seconds, before failed healthchecks count toward retries) | object({
command = list(string)
interval = optional(number)
retries = optional(number)
startPeriod = optional(number)
timeout = optional(number)
}) | `null` | no |
150 | | [hostname](#input\_hostname) | The hostname to use for your container. | `string` | `null` | no |
151 | | [interactive](#input\_interactive) | When this parameter is true, this allows you to deploy containerized applications that require stdin or a tty to be allocated. | `bool` | `null` | no |
152 | | [links](#input\_links) | List of container names this container can communicate with without port mappings | `list(string)` | `null` | no |
153 | | [linux\_parameters](#input\_linux\_parameters) | Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LinuxParameters.html | object({
capabilities = optional(object({
add = optional(list(string))
drop = optional(list(string))
}))
devices = optional(list(object({
containerPath = string
hostPath = string
permissions = optional(list(string))
})))
initProcessEnabled = optional(bool)
maxSwap = optional(number)
sharedMemorySize = optional(number)
swappiness = optional(number)
tmpfs = optional(list(object({
containerPath = string
mountOptions = optional(list(string))
size = number
})))
}) | `null` | no |
154 | | [log\_configuration](#input\_log\_configuration) | Log configuration options to send to a custom log driver for the container. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html | object({
logDriver = string
options = optional(map(string))
secretOptions = optional(list(object({
name = string
valueFrom = string
})))
}) | `null` | no |
155 | | [map\_environment](#input\_map\_environment) | The environment variables to pass to the container. This is a map of string: {key: value}. map\_environment overrides environment | `map(string)` | `null` | no |
156 | | [map\_secrets](#input\_map\_secrets) | The secrets variables to pass to the container. This is a map of string: {key: value}. map\_secrets overrides secrets | `map(string)` | `null` | no |
157 | | [mount\_points](#input\_mount\_points) | Container mount points. This is a list of maps, where each map should contain `containerPath`, `sourceVolume` and `readOnly` | list(object({
containerPath = optional(string)
readOnly = optional(bool)
sourceVolume = optional(string)
})) | `null` | no |
158 | | [port\_mappings](#input\_port\_mappings) | The port mappings to configure for the container. This is a list of maps. Each map should contain "containerPort", "hostPort", and "protocol", where "protocol" is one of "tcp" or "udp". If using containers in a task with the awsvpc or host network mode, the hostPort can either be left blank or set to the same value as the containerPort | list(object({
containerPort = number
hostPort = optional(number)
protocol = optional(string)
name = optional(string)
appProtocol = optional(string)
})) | `null` | no |
159 | | [privileged](#input\_privileged) | When this variable is `true`, the container is given elevated privileges on the host container instance (similar to the root user). This parameter is not supported for Windows containers or tasks using the Fargate launch type. | `bool` | `null` | no |
160 | | [pseudo\_terminal](#input\_pseudo\_terminal) | When this parameter is true, a TTY is allocated. | `bool` | `null` | no |
161 | | [readonly\_root\_filesystem](#input\_readonly\_root\_filesystem) | Determines whether a container is given read-only access to its root filesystem. Due to how Terraform type casts booleans in json it is required to double quote this value | `bool` | `false` | no |
162 | | [repository\_credentials](#input\_repository\_credentials) | Container repository credentials; required when using a private repo. This map currently supports a single key; "credentialsParameter", which should be the ARN of a Secrets Manager's secret holding the credentials | object({
credentialsParameter = string
}) | `null` | no |
163 | | [resource\_requirements](#input\_resource\_requirements) | The type and amount of a resource to assign to a container. The only supported resource is a GPU. | list(object({
type = string
value = string
})) | `null` | no |
164 | | [restart\_policy](#input\_restart\_policy) | The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. | object({
enabled = bool
ignoredExitCodes = optional(list(number))
restartAttemptPeriod = optional(number)
}) | `null` | no |
165 | | [secrets](#input\_secrets) | The secrets to pass to the container. This is a list of maps | list(object({
name = string
valueFrom = string
})) | `null` | no |
166 | | [start\_timeout](#input\_start\_timeout) | Time duration (in seconds) to wait before giving up on resolving dependencies for a container | `number` | `null` | no |
167 | | [stop\_timeout](#input\_stop\_timeout) | Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own | `number` | `null` | no |
168 | | [system\_controls](#input\_system\_controls) | A list of namespaced kernel parameters to set in the container, mapping to the --sysctl option to docker run. This is a list of maps: { namespace = "", value = ""} | list(object({
namespace = string
value = string
})) | `null` | no |
169 | | [ulimits](#input\_ulimits) | Container ulimit settings. This is a list of maps, where each map should contain "name", "hardLimit" and "softLimit" | list(object({
hardLimit = number
name = string
softLimit = number
})) | `null` | no |
170 | | [user](#input\_user) | The user to run as inside the container. Can be any of these formats: user, user:group, uid, uid:gid, user:gid, uid:group. The default (null) will use the container's configured `USER` directive or root if not set. | `string` | `null` | no |
171 | | [version\_consistency](#input\_version\_consistency) | Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. | `string` | `null` | no |
172 | | [volumes\_from](#input\_volumes\_from) | A list of VolumesFrom maps which contain "sourceContainer" (name of the container that has the volumes to mount) and "readOnly" (whether the container can write to the volume) | list(object({
readOnly = optional(bool)
sourceContainer = string
})) | `null` | no |
173 | | [working\_directory](#input\_working\_directory) | The working directory to run commands inside the container | `string` | `null` | no |
174 |
175 | ## Outputs
176 |
177 | | Name | Description |
178 | |------|-------------|
179 | | [json\_map\_encoded](#output\_json\_map\_encoded) | JSON string encoded container definitions for use with other terraform resources such as aws\_ecs\_task\_definition |
180 | | [json\_map\_encoded\_list](#output\_json\_map\_encoded\_list) | JSON string encoded list of container definitions for use with other terraform resources such as aws\_ecs\_task\_definition |
181 | | [json\_map\_object](#output\_json\_map\_object) | JSON map encoded container definition |
182 | | [sensitive\_json\_map\_encoded](#output\_sensitive\_json\_map\_encoded) | JSON string encoded container definitions for use with other terraform resources such as aws\_ecs\_task\_definition (sensitive) |
183 | | [sensitive\_json\_map\_encoded\_list](#output\_sensitive\_json\_map\_encoded\_list) | JSON string encoded list of container definitions for use with other terraform resources such as aws\_ecs\_task\_definition (sensitive) |
184 | | [sensitive\_json\_map\_object](#output\_sensitive\_json\_map\_object) | JSON map encoded container definition (sensitive) |
185 |
186 |
187 |
188 |
189 |
190 |
191 |
192 |
193 | ## Related Projects
194 |
195 | Check out these related projects.
196 |
197 | - [terraform-aws-ecs-codepipeline](https://github.com/cloudposse/terraform-aws-ecs-codepipeline) - Terraform module for CI/CD with AWS Code Pipeline and Code Build for ECS
198 | - [terraform-aws-ecs-events](https://github.com/cloudposse/terraform-aws-ecs-events) - Provides a standard set of ECS events that notify an SNS topic
199 | - [terraform-aws-ecs-cloudwatch-autoscaling](https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-autoscaling) - Terraform module to autoscale ECS Service based on CloudWatch metrics
200 | - [terraform-aws-ecs-container-definition](https://github.com/cloudposse/terraform-aws-ecs-container-definition) - Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource
201 | - [terraform-aws-ecs-launch-template](https://github.com/cloudposse/terraform-aws-ecs-launch-template) - Terraform module for generating an AWS Launch Template for ECS that handles draining on Spot Termination Requests
202 | - [terraform-aws-ecs-web-app](https://github.com/cloudposse/terraform-aws-ecs-web-app) - Terraform module that implements a web app on ECS and supporting AWS resources
203 | - [terraform-aws-ecs-spot-fleet](https://github.com/cloudposse/terraform-aws-ecs-spot-fleet) - Terraform module to create a diversified spot fleet for ECS clusters
204 | - [terraform-aws-ecs-cloudwatch-sns-alarms](https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-sns-alarms) - Terraform module to create CloudWatch Alarms on ECS Service level metrics
205 | - [terraform-aws-ecs-alb-service-task](https://github.com/cloudposse/terraform-aws-ecs-alb-service-task) - Terraform module which implements an ECS service which exposes a web service via ALB
206 |
207 |
208 | > [!TIP]
209 | > #### Use Terraform Reference Architectures for AWS
210 | >
211 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly.
212 | >
213 | > ✅ We build it together with your team.
214 | > ✅ Your team owns everything.
215 | > ✅ 100% Open Source and backed by fanatical support.
216 | >
217 | > 
218 | > 📚 Learn More
219 | >
220 | >
221 | >
222 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ecs-container-definition&utm_content=commercial_support) for funded startups and enterprises.
223 | >
224 | > *Your team can operate like a pro today.*
225 | >
226 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed.
227 | > #### Day-0: Your Foundation for Success
228 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code.
229 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases.
230 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance.
231 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations.
232 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions.
233 | >
234 | >
235 | >
236 | > #### Day-2: Your Operational Mastery
237 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency.
238 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it.
239 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity.
240 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration.
241 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly.
242 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value.
243 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate.
244 | >
245 | >
246 | > 
258 |
259 |
260 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-ecs-container-definition/issues).
261 |
262 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
263 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-ecs-container-definition/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md).
264 | 2. **Fork** the repo on GitHub
265 | 3. **Clone** the project to your own machine
266 | 4. **Commit** changes to your own branch
267 | 5. **Push** your work back up to your fork
268 | 6. Submit a **Pull Request** so that we can review your changes
269 |
270 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request!## Running Terraform Tests
271 |
272 | We use [Atmos](https://atmos.tools) to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands.
273 |
274 | All tests are located in the [`test/`](test) folder.
275 |
276 | Under the hood, tests are powered by Terratest together with our internal [Test Helpers](https://github.com/cloudposse/test-helpers) library, providing robust infrastructure validation.
277 |
278 | Setup dependencies:
279 | - Install Atmos ([installation guide](https://atmos.tools/install/))
280 | - Install Go [1.24+ or newer](https://go.dev/doc/install)
281 | - Install Terraform or OpenTofu
282 |
283 | To run tests:
284 |
285 | - Run all tests:
286 | ```sh
287 | atmos test run
288 | ```
289 | - Clean up test artifacts:
290 | ```sh
291 | atmos test clean
292 | ```
293 | - Explore additional test options:
294 | ```sh
295 | atmos test --help
296 | ```
297 | The configuration for test commands is centrally managed. To review what's being imported, see the [`atmos.yaml`](https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml) file.
298 |
299 | Learn more about our [automated testing in our documentation](https://docs.cloudposse.com/community/contribute/automated-testing/) or implementing [custom commands](https://atmos.tools/core-concepts/custom-commands/) with atmos.
300 |
301 | ### 🌎 Slack Community
302 |
303 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ecs-container-definition&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure.
304 |
305 | ### 📰 Newsletter
306 |
307 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ecs-container-definition&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know.
308 | Dropped straight into your Inbox every week — and usually a 5-minute read.
309 |
310 | ### 📆 Office Hours 
311 |
312 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ecs-container-definition&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else.
313 | It's **FREE** for everyone!
314 | ## License
315 |
316 | 
317 |
318 |
319 | Preamble to the Apache License, Version 2.0
320 |
321 |
322 |
323 | Complete license is available in the [`LICENSE`](LICENSE) file.
324 |
325 | ```text
326 | Licensed to the Apache Software Foundation (ASF) under one
327 | or more contributor license agreements. See the NOTICE file
328 | distributed with this work for additional information
329 | regarding copyright ownership. The ASF licenses this file
330 | to you under the Apache License, Version 2.0 (the
331 | "License"); you may not use this file except in compliance
332 | with the License. You may obtain a copy of the License at
333 |
334 | https://www.apache.org/licenses/LICENSE-2.0
335 |
336 | Unless required by applicable law or agreed to in writing,
337 | software distributed under the License is distributed on an
338 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
339 | KIND, either express or implied. See the License for the
340 | specific language governing permissions and limitations
341 | under the License.
342 | ```
343 |
344 |
345 | ## Trademarks
346 |
347 | All other trademarks referenced herein are the property of their respective owners.
348 |
349 |
350 | ---
351 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright)
352 |
353 |
354 | 
355 |
356 | 
357 |
--------------------------------------------------------------------------------
/README.yaml:
--------------------------------------------------------------------------------
1 | name: terraform-aws-ecs-container-definition
2 | license: APACHE2
3 | github_repo: cloudposse/terraform-aws-ecs-container-definition
4 | badges:
5 | - name: Latest Release
6 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-ecs-container-definition.svg?style=for-the-badge
7 | url: https://github.com/cloudposse/terraform-aws-ecs-container-definition/releases/latest
8 | - name: Last Updated
9 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-ecs-container-definition.svg?style=for-the-badge
10 | url: https://github.com/cloudposse/terraform-aws-ecs-container-definition/commits
11 | - name: Slack Community
12 | image: https://slack.cloudposse.com/for-the-badge.svg
13 | url: https://cloudposse.com/slack
14 |
15 | # List any related terraform modules that this module may be used with or that this module depends on.
16 | related:
17 | - name: terraform-aws-ecs-codepipeline
18 | description: Terraform module for CI/CD with AWS Code Pipeline and Code Build for ECS
19 | url: https://github.com/cloudposse/terraform-aws-ecs-codepipeline
20 | - name: terraform-aws-ecs-events
21 | description: Provides a standard set of ECS events that notify an SNS topic
22 | url: https://github.com/cloudposse/terraform-aws-ecs-events
23 | - name: terraform-aws-ecs-cloudwatch-autoscaling
24 | description: Terraform module to autoscale ECS Service based on CloudWatch metrics
25 | url: https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-autoscaling
26 | - name: terraform-aws-ecs-container-definition
27 | description: Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource
28 | url: https://github.com/cloudposse/terraform-aws-ecs-container-definition
29 | - name: terraform-aws-ecs-launch-template
30 | description: Terraform module for generating an AWS Launch Template for ECS that handles draining on Spot Termination Requests
31 | url: https://github.com/cloudposse/terraform-aws-ecs-launch-template
32 | - name: terraform-aws-ecs-web-app
33 | description: Terraform module that implements a web app on ECS and supporting AWS resources
34 | url: https://github.com/cloudposse/terraform-aws-ecs-web-app
35 | - name: terraform-aws-ecs-spot-fleet
36 | description: Terraform module to create a diversified spot fleet for ECS clusters
37 | url: https://github.com/cloudposse/terraform-aws-ecs-spot-fleet
38 | - name: terraform-aws-ecs-cloudwatch-sns-alarms
39 | description: Terraform module to create CloudWatch Alarms on ECS Service level metrics
40 | url: https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-sns-alarms
41 | - name: terraform-aws-ecs-alb-service-task
42 | description: Terraform module which implements an ECS service which exposes a web service via ALB
43 | url: https://github.com/cloudposse/terraform-aws-ecs-alb-service-task
44 | description: Terraform module to generate well-formed JSON documents that are passed to the `aws_ecs_task_definition` Terraform resource as [container definitions](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definitions).
45 | usage: |-
46 | This module is meant to be used as output only, meaning it will be used to create outputs which are consumed as a parameter by Terraform resources or other modules.
47 |
48 | Caution: This module, unlike nearly all other Cloud Posse Terraform modules, does not use [terraform-null-label](https://github.com/cloudposse/terraform-null-label/).
49 | Furthermore, it has an input named `environment` which has a completely different meaning than the one in `terraform-null-label`.
50 | Do not call this module with the conventional `context = module.this.context`. See the documentation below for the usage of `environment`.
51 |
52 | For complete examples, see
53 |
54 | - [multi-port mappings](examples/multi_port_mappings)
55 | - [multi-type env vars](examples/multi_type_env_vars)
56 | - [multiple definitions](examples/multiple_definitions)
57 | - [string env vars](examples/string_env_vars)
58 |
59 | For a complete example with automated tests, see [examples/complete](examples/complete) with `bats` and `Terratest` for the example [test](test).
60 |
61 | ```hcl
62 | module "container_definition" {
63 | source = "cloudposse/ecs-container-definition/aws"
64 | # Cloud Posse recommends pinning every module to a specific version
65 | # version = "x.x.x"
66 |
67 | container_name = "geodesic"
68 | container_image = "cloudposse/geodesic"
69 | }
70 | ```
71 |
72 | The output of this module can then be used with one of our other modules.
73 |
74 | ```hcl
75 | module "ecs_alb_service_task" {
76 | source = "cloudposse/ecs-alb-service-task/aws"
77 | # Cloud Posse recommends pinning every module to a specific version
78 | # version = "x.x.x"
79 |
80 | # ...
81 | container_definition_json = module.container_definition.json_map_encoded_list
82 | # ...
83 | }
84 | ```
85 |
86 | include: []
87 | contributors: []
88 |
--------------------------------------------------------------------------------
/atmos.yaml:
--------------------------------------------------------------------------------
1 | # Atmos Configuration — powered by https://atmos.tools
2 | #
3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos.
4 | #
5 | # Included features:
6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands
7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate
8 | #
9 |
10 | # Import shared configuration used by all modules
11 | import:
12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml
13 |
--------------------------------------------------------------------------------
/examples/complete/context.tf:
--------------------------------------------------------------------------------
1 | #
2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3 | # All other instances of this file should be a copy of that one
4 | #
5 | #
6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7 | # and then place it in your Terraform module to automatically get
8 | # Cloud Posse's standard configuration inputs suitable for passing
9 | # to Cloud Posse modules.
10 | #
11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12 | #
13 | # Modules should access the whole context as `module.this.context`
14 | # to get the input variables with nulls for defaults,
15 | # for example `context = module.this.context`,
16 | # and access individual variables as `module.this.`,
17 | # with final values filled in.
18 | #
19 | # For example, when using defaults, `module.this.context.delimiter`
20 | # will be null, and `module.this.delimiter` will be `-` (hyphen).
21 | #
22 |
23 | module "this" {
24 | source = "cloudposse/label/null"
25 | version = "0.25.0" # requires Terraform >= 0.13.0
26 |
27 | enabled = var.enabled
28 | namespace = var.namespace
29 | tenant = var.tenant
30 | environment = var.environment
31 | stage = var.stage
32 | name = var.name
33 | delimiter = var.delimiter
34 | attributes = var.attributes
35 | tags = var.tags
36 | additional_tag_map = var.additional_tag_map
37 | label_order = var.label_order
38 | regex_replace_chars = var.regex_replace_chars
39 | id_length_limit = var.id_length_limit
40 | label_key_case = var.label_key_case
41 | label_value_case = var.label_value_case
42 | descriptor_formats = var.descriptor_formats
43 | labels_as_tags = var.labels_as_tags
44 |
45 | context = var.context
46 | }
47 |
48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here
49 |
50 | variable "context" {
51 | type = any
52 | default = {
53 | enabled = true
54 | namespace = null
55 | tenant = null
56 | environment = null
57 | stage = null
58 | name = null
59 | delimiter = null
60 | attributes = []
61 | tags = {}
62 | additional_tag_map = {}
63 | regex_replace_chars = null
64 | label_order = []
65 | id_length_limit = null
66 | label_key_case = null
67 | label_value_case = null
68 | descriptor_formats = {}
69 | # Note: we have to use [] instead of null for unset lists due to
70 | # https://github.com/hashicorp/terraform/issues/28137
71 | # which was not fixed until Terraform 1.0.0,
72 | # but we want the default to be all the labels in `label_order`
73 | # and we want users to be able to prevent all tag generation
74 | # by setting `labels_as_tags` to `[]`, so we need
75 | # a different sentinel to indicate "default"
76 | labels_as_tags = ["unset"]
77 | }
78 | description = <<-EOT
79 | Single object for setting entire context at once.
80 | See description of individual variables for details.
81 | Leave string and numeric variables as `null` to use default value.
82 | Individual variable settings (non-null) override settings in context object,
83 | except for attributes, tags, and additional_tag_map, which are merged.
84 | EOT
85 |
86 | validation {
87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88 | error_message = "Allowed values: `lower`, `title`, `upper`."
89 | }
90 |
91 | validation {
92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94 | }
95 | }
96 |
97 | variable "enabled" {
98 | type = bool
99 | default = null
100 | description = "Set to false to prevent the module from creating any resources"
101 | }
102 |
103 | variable "namespace" {
104 | type = string
105 | default = null
106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107 | }
108 |
109 | variable "tenant" {
110 | type = string
111 | default = null
112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113 | }
114 |
115 | variable "environment" {
116 | type = string
117 | default = null
118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119 | }
120 |
121 | variable "stage" {
122 | type = string
123 | default = null
124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125 | }
126 |
127 | variable "name" {
128 | type = string
129 | default = null
130 | description = <<-EOT
131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132 | This is the only ID element not also included as a `tag`.
133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134 | EOT
135 | }
136 |
137 | variable "delimiter" {
138 | type = string
139 | default = null
140 | description = <<-EOT
141 | Delimiter to be used between ID elements.
142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143 | EOT
144 | }
145 |
146 | variable "attributes" {
147 | type = list(string)
148 | default = []
149 | description = <<-EOT
150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151 | in the order they appear in the list. New attributes are appended to the
152 | end of the list. The elements of the list are joined by the `delimiter`
153 | and treated as a single ID element.
154 | EOT
155 | }
156 |
157 | variable "labels_as_tags" {
158 | type = set(string)
159 | default = ["default"]
160 | description = <<-EOT
161 | Set of labels (ID elements) to include as tags in the `tags` output.
162 | Default is to include all labels.
163 | Tags with empty values will not be included in the `tags` output.
164 | Set to `[]` to suppress all generated tags.
165 | **Notes:**
166 | The value of the `name` tag, if included, will be the `id`, not the `name`.
167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168 | changed in later chained modules. Attempts to change it will be silently ignored.
169 | EOT
170 | }
171 |
172 | variable "tags" {
173 | type = map(string)
174 | default = {}
175 | description = <<-EOT
176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177 | Neither the tag keys nor the tag values will be modified by this module.
178 | EOT
179 | }
180 |
181 | variable "additional_tag_map" {
182 | type = map(string)
183 | default = {}
184 | description = <<-EOT
185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186 | This is for some rare cases where resources want additional configuration of tags
187 | and therefore take a list of maps with tag key, value, and additional configuration.
188 | EOT
189 | }
190 |
191 | variable "label_order" {
192 | type = list(string)
193 | default = null
194 | description = <<-EOT
195 | The order in which the labels (ID elements) appear in the `id`.
196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198 | EOT
199 | }
200 |
201 | variable "regex_replace_chars" {
202 | type = string
203 | default = null
204 | description = <<-EOT
205 | Terraform regular expression (regex) string.
206 | Characters matching the regex will be removed from the ID elements.
207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208 | EOT
209 | }
210 |
211 | variable "id_length_limit" {
212 | type = number
213 | default = null
214 | description = <<-EOT
215 | Limit `id` to this many characters (minimum 6).
216 | Set to `0` for unlimited length.
217 | Set to `null` for keep the existing setting, which defaults to `0`.
218 | Does not affect `id_full`.
219 | EOT
220 | validation {
221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223 | }
224 | }
225 |
226 | variable "label_key_case" {
227 | type = string
228 | default = null
229 | description = <<-EOT
230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231 | Does not affect keys of tags passed in via the `tags` input.
232 | Possible values: `lower`, `title`, `upper`.
233 | Default value: `title`.
234 | EOT
235 |
236 | validation {
237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238 | error_message = "Allowed values: `lower`, `title`, `upper`."
239 | }
240 | }
241 |
242 | variable "label_value_case" {
243 | type = string
244 | default = null
245 | description = <<-EOT
246 | Controls the letter case of ID elements (labels) as included in `id`,
247 | set as tag values, and output by this module individually.
248 | Does not affect values of tags passed in via the `tags` input.
249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251 | Default value: `lower`.
252 | EOT
253 |
254 | validation {
255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257 | }
258 | }
259 |
260 | variable "descriptor_formats" {
261 | type = any
262 | default = {}
263 | description = <<-EOT
264 | Describe additional descriptors to be output in the `descriptors` output map.
265 | Map of maps. Keys are names of descriptors. Values are maps of the form
266 | `{
267 | format = string
268 | labels = list(string)
269 | }`
270 | (Type is `any` so the map values can later be enhanced to provide additional options.)
271 | `format` is a Terraform format string to be passed to the `format()` function.
272 | `labels` is a list of labels, in order, to pass to `format()` function.
273 | Label values will be normalized before being passed to `format()` so they will be
274 | identical to how they appear in `id`.
275 | Default is `{}` (`descriptors` output will be empty).
276 | EOT
277 | }
278 |
279 | #### End of copy of cloudposse/terraform-null-label/variables.tf
280 |
--------------------------------------------------------------------------------
/examples/complete/fixtures.us-east-2.tfvars:
--------------------------------------------------------------------------------
1 | region = "us-east-2"
2 |
3 | namespace = "eg"
4 |
5 | stage = "test"
6 |
7 | name = "container-definition"
8 |
9 | container_name = "app"
10 | container_image = "cloudposse/geodesic"
11 | container_memory = 256
12 | container_memory_reservation = 128
13 | container_cpu = 256
14 | essential = true
15 | readonly_root_filesystem = false
16 |
17 | container_environment = [
18 | {
19 | name = "string_var"
20 | value = "I am a string"
21 | },
22 | {
23 | name = "true_boolean_var"
24 | value = true
25 | },
26 | {
27 | name = "false_boolean_var"
28 | value = false
29 | },
30 | {
31 | name = "integer_var"
32 | value = 42
33 | }
34 | ]
35 |
36 | port_mappings = [
37 | {
38 | containerPort = 8080
39 | hostPort = 80
40 | protocol = "tcp"
41 | name = "http"
42 | appProtocol = "http"
43 | },
44 | {
45 | containerPort = 8081
46 | hostPort = 443
47 | protocol = "udp"
48 | name = "https"
49 | appProtocol = "http"
50 | }
51 | ]
52 |
53 | log_configuration = {
54 | logDriver = "json-file"
55 | options = {
56 | max-size = "10m"
57 | max-file = "3"
58 | }
59 | secretOptions = null
60 | }
61 |
62 | privileged = false
63 |
64 | extra_hosts = [
65 | {
66 | ipAddress = "127.0.0.1"
67 | hostname = "app.local"
68 | },
69 | ]
70 |
71 | hostname = "hostname"
72 | pseudo_terminal = true
73 | interactive = true
74 |
75 | restart_policy = {
76 | enabled = true
77 | ignoredExitCodes = [0]
78 | }
79 |
80 | version_consistency = "enabled"
81 |
--------------------------------------------------------------------------------
/examples/complete/main.tf:
--------------------------------------------------------------------------------
1 | provider "aws" {
2 | region = var.region
3 | }
4 |
5 | module "container" {
6 | source = "../.."
7 | container_name = var.container_name
8 | container_image = var.container_image
9 | container_memory = var.container_memory
10 | container_memory_reservation = var.container_memory_reservation
11 | container_cpu = var.container_cpu
12 | essential = var.essential
13 | readonly_root_filesystem = var.readonly_root_filesystem
14 | environment = var.container_environment
15 | port_mappings = var.port_mappings
16 | log_configuration = var.log_configuration
17 | privileged = var.privileged
18 | extra_hosts = var.extra_hosts
19 | hostname = var.hostname
20 | pseudo_terminal = var.pseudo_terminal
21 | interactive = var.interactive
22 | restart_policy = var.restart_policy
23 | version_consistency = var.version_consistency
24 | }
25 |
26 | resource "aws_ecs_task_definition" "task" {
27 | family = module.this.id
28 | container_definitions = module.container.json_map_encoded_list
29 |
30 | tags = module.this.tags
31 | }
32 |
--------------------------------------------------------------------------------
/examples/complete/outputs.tf:
--------------------------------------------------------------------------------
1 | output "json_map_encoded_list" {
2 | description = "JSON encoded list of container definitions for use with other terraform resources such as aws_ecs_task_definition"
3 | value = module.container.json_map_encoded_list
4 | }
5 |
6 | output "json_map_encoded" {
7 | description = "JSON encoded container definitions for use with other terraform resources such as aws_ecs_task_definition"
8 | value = module.container.json_map_encoded
9 | }
10 |
11 | output "json_map_object" {
12 | description = "JSON map encoded container definition"
13 | value = module.container.json_map_object
14 | }
15 |
16 | output "task_definition_container_definition" {
17 | description = "The aws_ecs_task_definition container definition"
18 | value = jsondecode(aws_ecs_task_definition.task.container_definitions)[0]
19 | }
--------------------------------------------------------------------------------
/examples/complete/variables.tf:
--------------------------------------------------------------------------------
1 | variable "region" {
2 | type = string
3 | description = "AWS Region"
4 | }
5 |
6 | variable "container_name" {
7 | type = string
8 | description = "The name of the container. Up to 255 characters ([a-z], [A-Z], [0-9], -, _ allowed)"
9 | }
10 |
11 | variable "container_image" {
12 | type = string
13 | description = "The image used to start the container. Images in the Docker Hub registry available by default"
14 | }
15 |
16 | variable "container_memory" {
17 | type = number
18 | description = "The amount of memory (in MiB) to allow the container to use. This is a hard limit, if the container attempts to exceed the container_memory, the container is killed. This field is optional for Fargate launch type and the total amount of container_memory of all containers in a task will need to be lower than the task memory value"
19 | default = null
20 | }
21 |
22 | variable "container_memory_reservation" {
23 | type = number
24 | description = "The amount of memory (in MiB) to reserve for the container. If container needs to exceed this threshold, it can do so up to the set container_memory hard limit"
25 | default = null
26 | }
27 |
28 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PortMapping.html
29 | variable "port_mappings" {
30 | type = list(object({
31 | containerPort = number
32 | hostPort = optional(number)
33 | protocol = optional(string)
34 | name = optional(string)
35 | appProtocol = optional(string)
36 | }))
37 | description = "The port mappings to configure for the container. This is a list of maps. Each map should contain \"containerPort\", \"hostPort\", and \"protocol\", where \"protocol\" is one of \"tcp\" or \"udp\". If using containers in a task with the awsvpc or host network mode, the hostPort can either be left blank or set to the same value as the containerPort"
38 | default = null
39 | }
40 |
41 | variable "container_cpu" {
42 | type = number
43 | description = "The number of cpu units to reserve for the container. This is optional for tasks using Fargate launch type and the total amount of container_cpu of all containers in a task will need to be lower than the task-level cpu value"
44 | default = 0
45 | }
46 |
47 | variable "essential" {
48 | type = bool
49 | description = "Determines whether all other containers in a task are stopped, if this container fails or stops for any reason. Due to how Terraform type casts booleans in json it is required to double quote this value"
50 | default = true
51 | }
52 |
53 | variable "entrypoint" {
54 | type = list(string)
55 | description = "The entry point that is passed to the container"
56 | default = null
57 | }
58 |
59 | variable "command" {
60 | type = list(string)
61 | description = "The command that is passed to the container"
62 | default = null
63 | }
64 |
65 | variable "working_directory" {
66 | type = string
67 | description = "The working directory to run commands inside the container"
68 | default = null
69 | }
70 |
71 | variable "container_environment" {
72 | type = list(object({
73 | name = string
74 | value = string
75 | }))
76 | description = "The environment variables to pass to the container. This is a list of maps. map_environment overrides environment"
77 | default = null
78 | }
79 |
80 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_HostEntry.html
81 | variable "extra_hosts" {
82 | type = list(object({
83 | hostname = string
84 | ipAddress = string
85 | }))
86 | description = "A list of hostnames and IP address mappings to append to the /etc/hosts file on the container. This is a list of maps"
87 | default = null
88 | }
89 |
90 | variable "map_environment" {
91 | type = map(string)
92 | description = "The environment variables to pass to the container. This is a map of string: {key: value}. map_environment overrides environment"
93 | default = null
94 | }
95 |
96 | variable "readonly_root_filesystem" {
97 | type = bool
98 | description = "Determines whether a container is given read-only access to its root filesystem. Due to how Terraform type casts booleans in json it is required to double quote this value"
99 | default = false
100 | }
101 |
102 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html
103 | variable "log_configuration" {
104 | type = object({
105 | logDriver = string
106 | options = optional(map(string))
107 | secretOptions = optional(list(object({
108 | name = string
109 | valueFrom = string
110 | })))
111 | })
112 | description = "Log configuration options to send to a custom log driver for the container. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html"
113 | default = null
114 | }
115 |
116 | variable "privileged" {
117 | type = bool
118 | description = "When this variable is `true`, the container is given elevated privileges on the host container instance (similar to the root user). This parameter is not supported for Windows containers or tasks using the Fargate launch type."
119 | default = null
120 | }
121 |
122 | variable "hostname" {
123 | type = string
124 | description = "The hostname to use for your container."
125 | default = null
126 | }
127 |
128 | variable "disable_networking" {
129 | type = bool
130 | description = "When this parameter is true, networking is disabled within the container."
131 | default = null
132 | }
133 |
134 | variable "interactive" {
135 | type = bool
136 | description = "When this parameter is true, this allows you to deploy containerized applications that require stdin or a tty to be allocated."
137 | default = null
138 | }
139 |
140 | variable "pseudo_terminal" {
141 | type = bool
142 | description = "When this parameter is true, a TTY is allocated. "
143 | default = null
144 | }
145 |
146 | variable "docker_security_options" {
147 | type = list(string)
148 | description = "A list of strings to provide custom labels for SELinux and AppArmor multi-level security systems."
149 | default = null
150 | }
151 |
152 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerRestartPolicy.html
153 | variable "restart_policy" {
154 | type = object({
155 | enabled = bool
156 | ignoredExitCodes = optional(list(number))
157 | restartAttemptPeriod = optional(number)
158 | })
159 | description = "The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task."
160 | default = null
161 | }
162 |
163 | variable "version_consistency" {
164 | type = string
165 | description = "Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest."
166 | default = null
167 | }
168 |
--------------------------------------------------------------------------------
/examples/complete/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.3.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | aws = {
10 | source = "hashicorp/aws"
11 | }
12 | }
13 | }
14 |
--------------------------------------------------------------------------------
/examples/env_vars_files/main.tf:
--------------------------------------------------------------------------------
1 | module "container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | environment_files = [
7 | {
8 | value = "arn:aws:s3:::s3_bucket_name/envfile_01.env"
9 | type = "s3"
10 | },
11 | {
12 | value = "arn:aws:s3:::s3_bucket_name/another_envfile.env"
13 | type = "s3"
14 | }
15 | ]
16 | }
17 |
18 | output "json_map_encoded" {
19 | description = "Container definition in JSON format"
20 | value = module.container.json_map_encoded
21 | }
22 |
--------------------------------------------------------------------------------
/examples/env_vars_files/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/examples/map_environment/main.tf:
--------------------------------------------------------------------------------
1 | module "container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | map_environment = {
7 | "string_var" = "I am a string"
8 | "true_boolean_var" = true
9 | "false_boolean_var" = false
10 | "integer_var" = 42
11 | }
12 | }
13 |
14 | output "json" {
15 | description = "Container definition in JSON format"
16 | value = module.container.json_map_encoded_list
17 | }
18 |
--------------------------------------------------------------------------------
/examples/map_environment/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/examples/multi_port_mappings/main.tf:
--------------------------------------------------------------------------------
1 | module "container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | environment = [
7 | {
8 | name = "string_var"
9 | value = "I am a string"
10 | },
11 | {
12 | name = "true_boolean_var"
13 | value = true
14 | },
15 | {
16 | name = "false_boolean_var"
17 | value = false
18 | },
19 | {
20 | name = "integer_var"
21 | value = 42
22 | }
23 | ]
24 |
25 | port_mappings = [
26 | {
27 | containerPort = 8080
28 | hostPort = 80
29 | protocol = "tcp"
30 | },
31 | {
32 | containerPort = 8081
33 | hostPort = 443
34 | protocol = "udp"
35 | }
36 | ]
37 | }
38 |
39 | output "json" {
40 | description = "Container definition in JSON format"
41 | value = module.container.json_map_encoded_list
42 | }
43 |
--------------------------------------------------------------------------------
/examples/multi_port_mappings/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/examples/multi_type_env_vars/main.tf:
--------------------------------------------------------------------------------
1 | module "container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | environment = [
7 | {
8 | name = "string_var"
9 | value = "I am a string"
10 | },
11 | {
12 | name = "true_boolean_var"
13 | value = true
14 | },
15 | {
16 | name = "false_boolean_var"
17 | value = false
18 | },
19 | {
20 | name = "integer_var"
21 | value = 42
22 | }
23 | ]
24 | }
25 |
26 | output "json" {
27 | description = "Container definition in JSON format"
28 | value = module.container.json_map_encoded_list
29 | }
30 |
--------------------------------------------------------------------------------
/examples/multi_type_env_vars/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/examples/multiple_definitions/main.tf:
--------------------------------------------------------------------------------
1 | module "first_container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | port_mappings = [
7 | {
8 | containerPort = 8080
9 | hostPort = 80
10 | protocol = "tcp"
11 | },
12 | {
13 | containerPort = 8081
14 | hostPort = 443
15 | protocol = "udp"
16 | }
17 | ]
18 | }
19 |
20 | module "second_container" {
21 | source = "../../"
22 | container_name = "name2"
23 | container_image = "cloudposse/geodesic"
24 |
25 | port_mappings = [
26 | {
27 | containerPort = 8080
28 | hostPort = 8080
29 | protocol = "tcp"
30 | },
31 | {
32 | containerPort = 8081
33 | hostPort = 444
34 | protocol = "udp"
35 | }
36 | ]
37 | }
38 |
39 | output "first_container_json" {
40 | description = "Container definition in JSON format"
41 | value = module.first_container.json_map_encoded_list
42 | }
43 |
44 | output "second_container_json" {
45 | description = "Container definition in JSON format"
46 | value = module.second_container.json_map_encoded_list
47 | }
48 |
49 | resource "aws_ecs_task_definition" "task" {
50 | family = "foo"
51 | container_definitions = jsonencode([
52 | module.first_container.json_map_object,
53 | module.second_container.json_map_object
54 | ])
55 | }
56 |
--------------------------------------------------------------------------------
/examples/multiple_definitions/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | aws = {
10 | source = "hashicorp/aws"
11 | }
12 | }
13 | }
14 |
--------------------------------------------------------------------------------
/examples/string_env_vars/main.tf:
--------------------------------------------------------------------------------
1 | module "container" {
2 | source = "../../"
3 | container_name = "name"
4 | container_image = "cloudposse/geodesic"
5 |
6 | environment = [
7 | {
8 | name = "string_var"
9 | value = "123"
10 | },
11 | {
12 | name = "another_string_var"
13 | value = "true"
14 | },
15 | {
16 | name = "yet_another_string_var"
17 | value = "false"
18 | }
19 | ]
20 | }
21 |
22 | output "json" {
23 | description = "Container definition in JSON format"
24 | value = module.container.json_map_encoded_list
25 | }
26 |
--------------------------------------------------------------------------------
/examples/string_env_vars/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 0.13.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/main.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | # Sort environment variables & secrets so terraform will not try to recreate on each plan/apply
3 | env_as_map = var.map_environment != null ? var.map_environment : var.environment != null ? { for m in var.environment : m.name => m.value } : null
4 | secrets_as_map = var.map_secrets != null ? var.map_secrets : var.secrets != null ? { for m in var.secrets : m.name => m.valueFrom } : null
5 |
6 | # https://www.terraform.io/docs/configuration/expressions.html#null
7 | final_environment_vars = local.env_as_map != null ? [
8 | for k, v in local.env_as_map :
9 | {
10 | name = k
11 | value = v
12 | }
13 | ] : null
14 | final_secrets_vars = local.secrets_as_map != null ? [
15 | for k, v in local.secrets_as_map :
16 | {
17 | name = k
18 | valueFrom = v
19 | }
20 | ] : null
21 |
22 | log_configuration_without_null = var.log_configuration == null ? null : {
23 | for k, v in var.log_configuration :
24 | k => v
25 | if v != null
26 | }
27 | user = var.firelens_configuration != null ? "0" : var.user
28 |
29 | restart_policy_without_null = var.restart_policy == null ? null : {
30 | for k, v in var.restart_policy :
31 | k => v
32 | if v != null
33 | }
34 |
35 | container_definition = {
36 | name = var.container_name
37 | image = var.container_image
38 | essential = var.essential
39 | entryPoint = var.entrypoint
40 | command = var.command
41 | workingDirectory = var.working_directory
42 | readonlyRootFilesystem = var.readonly_root_filesystem
43 | mountPoints = var.mount_points
44 | dnsServers = var.dns_servers
45 | dnsSearchDomains = var.dns_search_domains
46 | ulimits = var.ulimits
47 | repositoryCredentials = var.repository_credentials
48 | links = var.links
49 | volumesFrom = var.volumes_from
50 | user = local.user
51 | dependsOn = var.container_depends_on
52 | privileged = var.privileged
53 | portMappings = var.port_mappings
54 | healthCheck = var.healthcheck
55 | firelensConfiguration = var.firelens_configuration
56 | linuxParameters = var.linux_parameters
57 | logConfiguration = local.log_configuration_without_null
58 | memory = var.container_memory
59 | memoryReservation = var.container_memory_reservation
60 | cpu = var.container_cpu
61 | environment = local.final_environment_vars
62 | environmentFiles = var.environment_files
63 | secrets = local.final_secrets_vars
64 | dockerLabels = var.docker_labels
65 | startTimeout = var.start_timeout
66 | stopTimeout = var.stop_timeout
67 | systemControls = var.system_controls
68 | extraHosts = var.extra_hosts
69 | hostname = var.hostname
70 | disableNetworking = var.disable_networking
71 | interactive = var.interactive
72 | pseudoTerminal = var.pseudo_terminal
73 | dockerSecurityOptions = var.docker_security_options
74 | resourceRequirements = var.resource_requirements
75 | restartPolicy = local.restart_policy_without_null
76 | versionConsistency = var.version_consistency
77 | }
78 |
79 | container_definition_without_null = {
80 | for k, v in local.container_definition :
81 | k => v
82 | if v != null
83 | }
84 |
85 | container_definition_override_without_null = {
86 | for k, v in var.container_definition :
87 | k => v
88 | if v != null
89 | }
90 |
91 | final_container_definition = merge(local.container_definition_without_null, local.container_definition_override_without_null)
92 | json_map = jsonencode(local.final_container_definition)
93 | }
94 |
--------------------------------------------------------------------------------
/outputs.tf:
--------------------------------------------------------------------------------
1 | output "json_map_encoded_list" {
2 | description = "JSON string encoded list of container definitions for use with other terraform resources such as aws_ecs_task_definition"
3 | value = "[${local.json_map}]"
4 | }
5 |
6 | output "json_map_encoded" {
7 | description = "JSON string encoded container definitions for use with other terraform resources such as aws_ecs_task_definition"
8 | value = local.json_map
9 | }
10 |
11 | output "json_map_object" {
12 | description = "JSON map encoded container definition"
13 | value = local.final_container_definition
14 | }
15 |
16 | output "sensitive_json_map_encoded_list" {
17 | description = "JSON string encoded list of container definitions for use with other terraform resources such as aws_ecs_task_definition (sensitive)"
18 | value = "[${local.json_map}]"
19 | sensitive = true
20 | }
21 |
22 | output "sensitive_json_map_encoded" {
23 | description = "JSON string encoded container definitions for use with other terraform resources such as aws_ecs_task_definition (sensitive)"
24 | value = local.json_map
25 | sensitive = true
26 | }
27 |
28 | output "sensitive_json_map_object" {
29 | description = "JSON map encoded container definition (sensitive)"
30 | value = local.final_container_definition
31 | sensitive = true
32 | }
33 |
--------------------------------------------------------------------------------
/test/.gitignore:
--------------------------------------------------------------------------------
1 | .test-harness
2 |
--------------------------------------------------------------------------------
/test/Makefile:
--------------------------------------------------------------------------------
1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git
2 | TEST_HARNESS_BRANCH ?= master
3 | TEST_HARNESS_PATH = $(realpath .test-harness)
4 | BATS_ARGS ?= --tap
5 | BATS_LOG ?= test.log
6 |
7 | # Define a macro to run the tests
8 | define RUN_TESTS
9 | @echo "Running tests in $(1)"
10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS)))
11 | endef
12 |
13 | default: all
14 |
15 | -include Makefile.*
16 |
17 | ## Provision the test-harnesss
18 | .test-harness:
19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@
20 |
21 | ## Initialize the tests
22 | init: .test-harness
23 |
24 | ## Install all dependencies (OS specific)
25 | deps::
26 | @exit 0
27 |
28 | ## Clean up the test harness
29 | clean:
30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH)
31 |
32 | ## Run all tests
33 | all: module examples/complete
34 |
35 | ## Run basic sanity checks against the module itself
36 | module: export TESTS ?= installed lint get-modules module-pinning get-plugins provider-pinning validate terraform-docs input-descriptions output-descriptions
37 | module: deps
38 | $(call RUN_TESTS, ../)
39 |
40 | ## Run tests against example
41 | examples/complete: export TESTS ?= installed lint get-modules get-plugins validate
42 | examples/complete: deps
43 | $(call RUN_TESTS, ../$@)
44 |
--------------------------------------------------------------------------------
/test/Makefile.alpine:
--------------------------------------------------------------------------------
1 | ifneq (,$(wildcard /sbin/apk))
2 | ## Install all dependencies for alpine
3 | deps:: init
4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse
5 | endif
6 |
--------------------------------------------------------------------------------
/test/src/.gitignore:
--------------------------------------------------------------------------------
1 | .gopath
2 | vendor/
3 |
--------------------------------------------------------------------------------
/test/src/Makefile:
--------------------------------------------------------------------------------
1 | export TF_CLI_ARGS_init ?= -get-plugins=true
2 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1-2)
3 |
4 | .DEFAULT_GOAL : all
5 |
6 | .PHONY: all
7 | ## Default target
8 | all: test
9 |
10 | .PHONY : init
11 | ## Initialize tests
12 | init:
13 | @exit 0
14 |
15 | .PHONY : test
16 | ## Run tests
17 | test: init
18 | go mod download
19 | go test -v -timeout 60m -run TestExamplesComplete
20 |
21 | ## Run tests in docker container
22 | docker/test:
23 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \
24 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
25 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test
26 |
27 | .PHONY : clean
28 | ## Clean up files
29 | clean:
30 | rm -rf ../../examples/complete/*.tfstate*
--------------------------------------------------------------------------------
/test/src/examples_complete_test.go:
--------------------------------------------------------------------------------
1 | package test
2 |
3 | import (
4 | "testing"
5 |
6 | "encoding/json"
7 | "github.com/gruntwork-io/terratest/modules/terraform"
8 | "github.com/stretchr/testify/assert"
9 | )
10 |
11 | // Test the Terraform module in examples/complete using Terratest.
12 | func TestExamplesComplete(t *testing.T) {
13 | t.Parallel()
14 |
15 | terraformOptions := &terraform.Options{
16 | // The path to where our Terraform code is located
17 | TerraformDir: "../../examples/complete",
18 | Upgrade: true,
19 | // Variables to pass to our Terraform code using -var-file options
20 | VarFiles: []string{"fixtures.us-east-2.tfvars"},
21 | }
22 |
23 | // At the end of the test, run `terraform destroy` to clean up any resources that were created
24 | defer terraform.Destroy(t, terraformOptions)
25 |
26 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors
27 | terraform.InitAndApply(t, terraformOptions)
28 |
29 | // Run `terraform output` to get the value of an output variable
30 | jsonMap := terraform.OutputRequired(t, terraformOptions, "json_map_encoded")
31 |
32 | // Verify we're getting back the outputs we expect
33 | var jsonObject map[string]interface{}
34 | err := json.Unmarshal([]byte(jsonMap), &jsonObject)
35 | assert.NoError(t, err)
36 |
37 | assert.Equal(t, "app", jsonObject["name"])
38 | assert.Equal(t, "cloudposse/geodesic", jsonObject["image"])
39 | assert.Equal(t, 256, int((jsonObject["memory"]).(float64)))
40 | assert.Equal(t, 128, int((jsonObject["memoryReservation"]).(float64)))
41 | assert.Equal(t, 256, int((jsonObject["cpu"]).(float64)))
42 | assert.Equal(t, true, jsonObject["essential"])
43 | assert.Equal(t, false, jsonObject["readonlyRootFilesystem"])
44 |
45 | // Run `terraform output` to compare the expected container definition with the actual aws_ecs_task_definition container definition
46 | containerDefinitionExpected := terraform.OutputRequired(t, terraformOptions, "json_map_object")
47 | containerDefinition := terraform.OutputRequired(t, terraformOptions, "task_definition_container_definition")
48 | assert.Equal(t, containerDefinitionExpected, containerDefinition)
49 | }
50 |
--------------------------------------------------------------------------------
/test/src/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/cloudposse/terraform-aws-ecs-container-definition
2 |
3 | go 1.15
4 |
5 | require (
6 | github.com/gruntwork-io/terratest v0.43.0
7 | github.com/stretchr/testify v1.8.1
8 | )
9 |
--------------------------------------------------------------------------------
/variables.tf:
--------------------------------------------------------------------------------
1 | variable "container_name" {
2 | type = string
3 | description = "The name of the container. Up to 255 characters ([a-z], [A-Z], [0-9], -, _ allowed)"
4 | }
5 |
6 | variable "container_image" {
7 | type = string
8 | description = "The image used to start the container. Images in the Docker Hub registry available by default"
9 | }
10 |
11 | variable "container_memory" {
12 | type = number
13 | description = "The amount of memory (in MiB) to allow the container to use. This is a hard limit, if the container attempts to exceed the container_memory, the container is killed. This field is optional for Fargate launch type and the total amount of container_memory of all containers in a task will need to be lower than the task memory value"
14 | default = null
15 | }
16 |
17 | variable "container_memory_reservation" {
18 | type = number
19 | description = "The amount of memory (in MiB) to reserve for the container. If container needs to exceed this threshold, it can do so up to the set container_memory hard limit"
20 | default = null
21 | }
22 |
23 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html
24 | variable "container_definition" {
25 | type = object({
26 | command = optional(list(string))
27 | cpu = optional(number)
28 | dependsOn = optional(list(object({
29 | condition = string
30 | containerName = string
31 | })))
32 | disableNetworking = optional(bool)
33 | dnsSearchDomains = optional(list(string))
34 | dnsServers = optional(list(string))
35 | dockerLabels = optional(map(string))
36 | dockerSecurityOptions = optional(list(string))
37 | entryPoint = optional(list(string))
38 | environment = optional(list(object({
39 | name = string
40 | value = string
41 | })))
42 | environmentFiles = optional(list(object({
43 | type = string
44 | value = string
45 | })))
46 | essential = optional(bool)
47 | extraHosts = optional(list(object({
48 | hostname = string
49 | ipAddress = string
50 | })))
51 | firelensConfiguration = optional(object({
52 | options = optional(map(string))
53 | type = string
54 | }))
55 | healthCheck = optional(object({
56 | command = list(string)
57 | interval = optional(number)
58 | retries = optional(number)
59 | startPeriod = optional(number)
60 | timeout = optional(number)
61 | }))
62 | hostname = optional(string)
63 | image = optional(string)
64 | interactive = optional(bool)
65 | links = optional(list(string))
66 | linuxParameters = optional(object({
67 | capabilities = optional(object({
68 | add = optional(list(string))
69 | drop = optional(list(string))
70 | }))
71 | devices = optional(list(object({
72 | containerPath = string
73 | hostPath = string
74 | permissions = optional(list(string))
75 | })))
76 | initProcessEnabled = optional(bool)
77 | maxSwap = optional(number)
78 | sharedMemorySize = optional(number)
79 | swappiness = optional(number)
80 | tmpfs = optional(list(object({
81 | containerPath = string
82 | mountOptions = optional(list(string))
83 | size = number
84 | })))
85 | }))
86 | logConfiguration = optional(object({
87 | logDriver = string
88 | options = optional(map(string))
89 | secretOptions = optional(list(object({
90 | name = string
91 | valueFrom = string
92 | })))
93 | }))
94 | memory = optional(number)
95 | memoryReservation = optional(number)
96 | mountPoints = optional(list(object({
97 | containerPath = optional(string)
98 | readOnly = optional(bool)
99 | sourceVolume = optional(string)
100 | })))
101 | name = optional(string)
102 | portMappings = optional(list(object({
103 | containerPort = number
104 | hostPort = optional(number)
105 | protocol = optional(string)
106 | name = optional(string)
107 | appProtocol = optional(string)
108 | })))
109 | privileged = optional(bool)
110 | pseudoTerminal = optional(bool)
111 | readonlyRootFilesystem = optional(bool)
112 | repositoryCredentials = optional(object({
113 | credentialsParameter = string
114 | }))
115 | resourceRequirements = optional(list(object({
116 | type = string
117 | value = string
118 | })))
119 | restartPolicy = optional(object({
120 | enabled = bool
121 | ignoredExitCodes = optional(list(number))
122 | restartAttemptPeriod = optional(number)
123 | }))
124 | secrets = optional(list(object({
125 | name = string
126 | valueFrom = string
127 | })))
128 | startTimeout = optional(number)
129 | stopTimeout = optional(number)
130 | systemControls = optional(list(object({
131 | namespace = string
132 | value = string
133 | })))
134 | ulimits = optional(list(object({
135 | hardLimit = number
136 | name = string
137 | softLimit = number
138 | })))
139 | user = optional(string)
140 | versionConsistency = optional(string)
141 | volumesFrom = optional(list(object({
142 | readOnly = optional(bool)
143 | sourceContainer = string
144 | })))
145 | workingDirectory = optional(string)
146 | })
147 | description = "Container definition overrides which allows for extra keys or overriding existing keys."
148 | default = {}
149 | }
150 |
151 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PortMapping.html
152 | variable "port_mappings" {
153 | type = list(object({
154 | containerPort = number
155 | hostPort = optional(number)
156 | protocol = optional(string)
157 | name = optional(string)
158 | appProtocol = optional(string)
159 | }))
160 | description = "The port mappings to configure for the container. This is a list of maps. Each map should contain \"containerPort\", \"hostPort\", and \"protocol\", where \"protocol\" is one of \"tcp\" or \"udp\". If using containers in a task with the awsvpc or host network mode, the hostPort can either be left blank or set to the same value as the containerPort"
161 | default = null
162 | }
163 |
164 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_HealthCheck.html
165 | variable "healthcheck" {
166 | type = object({
167 | command = list(string)
168 | interval = optional(number)
169 | retries = optional(number)
170 | startPeriod = optional(number)
171 | timeout = optional(number)
172 | })
173 | description = "A map containing command (string), timeout, interval (duration in seconds), retries (1-10, number of times to retry before marking container unhealthy), and startPeriod (0-300, optional grace period to wait, in seconds, before failed healthchecks count toward retries)"
174 | default = null
175 | }
176 |
177 | variable "container_cpu" {
178 | type = number
179 | description = "The number of cpu units to reserve for the container. This is optional for tasks using Fargate launch type and the total amount of container_cpu of all containers in a task will need to be lower than the task-level cpu value"
180 | default = 0
181 | }
182 |
183 | variable "essential" {
184 | type = bool
185 | description = "Determines whether all other containers in a task are stopped, if this container fails or stops for any reason. Due to how Terraform type casts booleans in json it is required to double quote this value"
186 | default = true
187 | }
188 |
189 | variable "entrypoint" {
190 | type = list(string)
191 | description = "The entry point that is passed to the container"
192 | default = null
193 | }
194 |
195 | variable "command" {
196 | type = list(string)
197 | description = "The command that is passed to the container"
198 | default = null
199 | }
200 |
201 | variable "working_directory" {
202 | type = string
203 | description = "The working directory to run commands inside the container"
204 | default = null
205 | }
206 |
207 | variable "environment" {
208 | type = list(object({
209 | name = string
210 | value = string
211 | }))
212 | description = "The environment variables to pass to the container. This is a list of maps. map_environment overrides environment"
213 | default = null
214 | }
215 |
216 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_HostEntry.html
217 | variable "extra_hosts" {
218 | type = list(object({
219 | hostname = string
220 | ipAddress = string
221 | }))
222 | description = "A list of hostnames and IP address mappings to append to the /etc/hosts file on the container. This is a list of maps"
223 | default = null
224 | }
225 |
226 | variable "map_environment" {
227 | type = map(string)
228 | description = "The environment variables to pass to the container. This is a map of string: {key: value}. map_environment overrides environment"
229 | default = null
230 | }
231 |
232 | variable "map_secrets" {
233 | type = map(string)
234 | description = "The secrets variables to pass to the container. This is a map of string: {key: value}. map_secrets overrides secrets"
235 | default = null
236 | }
237 |
238 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_EnvironmentFile.html
239 | variable "environment_files" {
240 | type = list(object({
241 | type = string
242 | value = string
243 | }))
244 | description = "One or more files containing the environment variables to pass to the container. This maps to the --env-file option to docker run. The file must be hosted in Amazon S3. This option is only available to tasks using the EC2 launch type. This is a list of maps"
245 | default = null
246 | }
247 |
248 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Secret.html
249 | variable "secrets" {
250 | type = list(object({
251 | name = string
252 | valueFrom = string
253 | }))
254 | description = "The secrets to pass to the container. This is a list of maps"
255 | default = null
256 | }
257 |
258 | variable "readonly_root_filesystem" {
259 | type = bool
260 | description = "Determines whether a container is given read-only access to its root filesystem. Due to how Terraform type casts booleans in json it is required to double quote this value"
261 | default = false
262 | }
263 |
264 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LinuxParameters.html
265 | variable "linux_parameters" {
266 | type = object({
267 | capabilities = optional(object({
268 | add = optional(list(string))
269 | drop = optional(list(string))
270 | }))
271 | devices = optional(list(object({
272 | containerPath = string
273 | hostPath = string
274 | permissions = optional(list(string))
275 | })))
276 | initProcessEnabled = optional(bool)
277 | maxSwap = optional(number)
278 | sharedMemorySize = optional(number)
279 | swappiness = optional(number)
280 | tmpfs = optional(list(object({
281 | containerPath = string
282 | mountOptions = optional(list(string))
283 | size = number
284 | })))
285 | })
286 | description = "Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LinuxParameters.html"
287 | default = null
288 | }
289 |
290 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html
291 | variable "log_configuration" {
292 | type = object({
293 | logDriver = string
294 | options = optional(map(string))
295 | secretOptions = optional(list(object({
296 | name = string
297 | valueFrom = string
298 | })))
299 | })
300 | description = "Log configuration options to send to a custom log driver for the container. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html"
301 | default = null
302 | }
303 |
304 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html
305 | variable "firelens_configuration" {
306 | type = object({
307 | options = optional(map(string))
308 | type = string
309 | })
310 | description = "The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html"
311 | default = null
312 | }
313 |
314 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_MountPoint.html
315 | variable "mount_points" {
316 | type = list(object({
317 | containerPath = optional(string)
318 | readOnly = optional(bool)
319 | sourceVolume = optional(string)
320 | }))
321 | description = "Container mount points. This is a list of maps, where each map should contain `containerPath`, `sourceVolume` and `readOnly`"
322 | default = null
323 | }
324 |
325 | variable "dns_servers" {
326 | type = list(string)
327 | description = "Container DNS servers. This is a list of strings specifying the IP addresses of the DNS servers"
328 | default = null
329 | }
330 |
331 | variable "dns_search_domains" {
332 | type = list(string)
333 | description = "Container DNS search domains. A list of DNS search domains that are presented to the container"
334 | default = null
335 | }
336 |
337 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Ulimit.html
338 | variable "ulimits" {
339 | type = list(object({
340 | hardLimit = number
341 | name = string
342 | softLimit = number
343 | }))
344 | description = "Container ulimit settings. This is a list of maps, where each map should contain \"name\", \"hardLimit\" and \"softLimit\""
345 | default = null
346 | }
347 |
348 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RepositoryCredentials.html
349 | variable "repository_credentials" {
350 | type = object({
351 | credentialsParameter = string
352 | })
353 | description = "Container repository credentials; required when using a private repo. This map currently supports a single key; \"credentialsParameter\", which should be the ARN of a Secrets Manager's secret holding the credentials"
354 | default = null
355 | }
356 |
357 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_VolumeFrom.html
358 | variable "volumes_from" {
359 | type = list(object({
360 | readOnly = optional(bool)
361 | sourceContainer = string
362 | }))
363 | description = "A list of VolumesFrom maps which contain \"sourceContainer\" (name of the container that has the volumes to mount) and \"readOnly\" (whether the container can write to the volume)"
364 | default = null
365 | }
366 |
367 | variable "links" {
368 | type = list(string)
369 | description = "List of container names this container can communicate with without port mappings"
370 | default = null
371 | }
372 |
373 | variable "user" {
374 | type = string
375 | description = "The user to run as inside the container. Can be any of these formats: user, user:group, uid, uid:gid, user:gid, uid:group. The default (null) will use the container's configured `USER` directive or root if not set."
376 | default = null
377 | }
378 |
379 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDependency.html
380 | variable "container_depends_on" {
381 | type = list(object({
382 | condition = string
383 | containerName = string
384 | }))
385 | description = "The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. The condition can be one of START, COMPLETE, SUCCESS or HEALTHY"
386 | default = null
387 | }
388 |
389 | variable "docker_labels" {
390 | type = map(string)
391 | description = "The configuration options to send to the `docker_labels`"
392 | default = null
393 | }
394 |
395 | variable "start_timeout" {
396 | type = number
397 | description = "Time duration (in seconds) to wait before giving up on resolving dependencies for a container"
398 | default = null
399 | }
400 |
401 | variable "stop_timeout" {
402 | type = number
403 | description = "Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own"
404 | default = null
405 | }
406 |
407 | variable "privileged" {
408 | type = bool
409 | description = "When this variable is `true`, the container is given elevated privileges on the host container instance (similar to the root user). This parameter is not supported for Windows containers or tasks using the Fargate launch type."
410 | default = null
411 | }
412 |
413 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SystemControl.html
414 | variable "system_controls" {
415 | type = list(object({
416 | namespace = string
417 | value = string
418 | }))
419 | description = "A list of namespaced kernel parameters to set in the container, mapping to the --sysctl option to docker run. This is a list of maps: { namespace = \"\", value = \"\"}"
420 | default = null
421 | }
422 |
423 | variable "hostname" {
424 | type = string
425 | description = "The hostname to use for your container."
426 | default = null
427 | }
428 |
429 | variable "disable_networking" {
430 | type = bool
431 | description = "When this parameter is true, networking is disabled within the container."
432 | default = null
433 | }
434 |
435 | variable "interactive" {
436 | type = bool
437 | description = "When this parameter is true, this allows you to deploy containerized applications that require stdin or a tty to be allocated."
438 | default = null
439 | }
440 |
441 | variable "pseudo_terminal" {
442 | type = bool
443 | description = "When this parameter is true, a TTY is allocated. "
444 | default = null
445 | }
446 |
447 | variable "docker_security_options" {
448 | type = list(string)
449 | description = "A list of strings to provide custom labels for SELinux and AppArmor multi-level security systems."
450 | default = null
451 | }
452 |
453 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ResourceRequirement.html
454 | variable "resource_requirements" {
455 | type = list(object({
456 | type = string
457 | value = string
458 | }))
459 | description = "The type and amount of a resource to assign to a container. The only supported resource is a GPU."
460 | default = null
461 | }
462 |
463 | # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerRestartPolicy.html
464 | variable "restart_policy" {
465 | type = object({
466 | enabled = bool
467 | ignoredExitCodes = optional(list(number))
468 | restartAttemptPeriod = optional(number)
469 | })
470 | description = "The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task."
471 | default = null
472 | }
473 |
474 | variable "version_consistency" {
475 | type = string
476 | description = "Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest."
477 | default = null
478 | }
479 |
--------------------------------------------------------------------------------
/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.3.0"
3 |
4 | required_providers {
5 | local = {
6 | source = "hashicorp/local"
7 | version = ">= 1.2"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
8 |
9 |