The Amazon Elastic Container Service (ECS), specifically Fargate allows you to run containers on an ad-hoc basis. <\/p>\n\n\n\n
The following guide assumes you have already deployed an Amazon Elastic Container Registry (ECR), built your image, pushed it to the ECR and have obtained the Repository URI.<\/p>\n\n\n\n
The guide also uses local Terraform state, please see the documentation on storing state remotely if that is what you require.<\/p>\n\n\n\n
The example Terraform definitions can be found within Gitlab. Two example deployments are given below:<\/p>\n\n\n\n
There are three variables to update within the variables.tf<\/strong> file:<\/p>\n\n\n\n * route53zone <\/strong>– The AWS Route53 Hosted Zone ID which you can obtain from the AWS console, obviously you need to have the domain already present as an AWS Route53 Hosted Zone. Update the variables by updating the “default” value within the variables.tf<\/strong> file.<\/p>\n\n\n\n Deploy the environment with:<\/p>\n\n\n\n Once deployed, the Terraform provides some Outputs. however all you need is to access your application at the domain name you entered, e.g. https:\/\/www.mydomain.com<\/a> or https:\/\/mydomain.com<\/a>, the ALB automatically redirects from HTTP to HTTPS if required.<\/p>\n\n\n\n Perform whatever tests you require.<\/p>\n\n\n\n To clean up, you need remove your ECS cluster, ALB by running a Terraform destroy, bear in mind that the image(s) stored in the Amazon Elastic Container Registry (ECR) are not removed, if you’ve deployed the ECR separately, you’ll need to remove this separately.<\/p>\n\n\n\n As we created using Terraform you can remove with Terraform thusly:<\/p>\n\n\n\n As you can see it is fairly simple to deploy a resilient container based workload and publish it to the Internet, obviously there is lots more that can be done to improve this deployment, but this provides you with the basis from which to build.<\/p>\n\n\n\n Let’s deep dive into each of the sections of the configuration, so we can understand what is being done at each stage. We’ll not include the Terraform provider within the explaination as it is hoped you’re aware of this and how they work already.<\/p>\n\n\n\n The “main.tf” file contains the creation of the VPC, followed by creation of two Subnets A and B which are created as “private subnets”. The VPC then has an Internet Gateway created, with a RouteTable and default Routes attached, so the VPC and the subnets have a direct Internet connection.<\/p>\n\n\n\n Creates the AWS ECS Cluster, Task Roles (i.e. the permissions of ECS and the Tasks), Task Definitions (i.e. deploys the containers) and defines the Service (through which the application is accessed.)<\/p>\n\n\n\n The Execution Role is used by the ECS Agent to make AWS API calls on the behalf of the user.<\/p>\n\n\n\n We first define the role with:<\/p>\n\n\n\n We then create an Assume Role Policy, which defines who (or what if the principal is a service) can use the role we just created.<\/p>\n\n\n\n Now we have defined the role and who\/what can use the role we need to define what the role can actually do, rather than specifying the Role Action Policy manually, we are using a pre-existing Policy with the necessary actions we need: ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, logs:CreateLogStream, logs:PutLogEvents. And one already exists for this purpose: AmazonECSTaskExecutionRolePolicy.<\/p>\n\n\n\n Task Role grants permissions specifically to the tasks, e.g. if a running task needs to access another AWS resource, e.g. a database. We don’t need a task role for this use case, the tasks (containers) don’t need to access anything else.<\/p>\n\n\n\n We now need to define the AWS ECS cluster.<\/p>\n\n\n\n Once defined we can now define the ECS Task, within this we are specifying the size of the containers, and also which image we are wanting to use for the task, here we specify the Repository URI where the image resides.<\/p>\n\n\n\n Finally we define the ECS Service Definition, this dectates how many containers are deployed, which subnets they will be deployed to, along with the security group to restrict access to them.<\/p>\n\n\n\n It also binds the Load Balancer Target Group to the ECS Service, so the Load Balancer will direct requests to the running container ports.<\/p>\n\n\n\n We define the Application Load Balancer (ALB), which consists of these main components:<\/p>\n\n\n\n * Application Load Balancer (ALB) Definition – The actual definition of the load balancer, which includes the security group that restricts access to it. These define the DNS records automatically, which includes defining the following:<\/p>\n\n\n\n The Terraform also creates the Amazon Certificate Manager (ACM) certificate automatically, it also inserts the validation record into the DNS zone automatically, so it is ready to be assigned to the load balancer.<\/p>\n","protected":false},"excerpt":{"rendered":" The Amazon Elastic Container Service (ECS), specifically Fargate allows you to run containers on an ad-hoc basis. The following guide assumes you have already deployed an Amazon Elastic Container Registry (ECR), built your image, pushed it to the ECR and have obtained the Repository URI. The guide also uses local Terraform state, please see the … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4496,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,46],"tags":[],"class_list":["post-4500","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws","category-docker"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4500"}],"version-history":[{"count":2,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4500\/revisions"}],"predecessor-version":[{"id":4502,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4500\/revisions\/4502"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4496"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
* domainname <\/strong>– The domain name (excluding sub-domain) that your application will be deployed at, this assumes you already have the domain in an AWS Route53 Hosted Zone.
* ecrimageuri <\/strong>– The Amazon Elastic Container Registry (ECR) URI which you can obtain from the AWS console for the image you wish to deploy from the repository.<\/p>\n\n\n\nStep 2 – Deploy Terraform<\/h1>\n\n\n\n
terraform apply [--auto-approve]<\/code><\/pre>\n\n\n\nStep 3 – Verify Behaviour<\/h1>\n\n\n\n
Step 4 – Clean-Up<\/h1>\n\n\n\n
terraform destroy [--auto-approve]<\/code><\/pre>\n\n\n\nTerraform and Configuration Explaination<\/h1>\n\n\n\n
main.tf – VPC, Subnets, IGW, Route Table(s) and Security Group<\/h2>\n\n\n\n
ecs.tf – AWS ECS Cluster, Task Roles, Task Definition and Service Definition<\/h2>\n\n\n\n
AWS ECS Execution Roles<\/h3>\n\n\n\n
resource \"aws_iam_role\" \"ecsTaskExecutionRole\" {\n name = \"ecsTaskExecutionRole\"\n assume_role_policy = \"${data.aws_iam_policy_document.assume_role_policy.json}\"\n}<\/code><\/pre>\n\n\n\ndata \"aws_iam_policy_document\" \"assume_role_policy\" {\n statement {\n actions = [\"sts:AssumeRole\"]\n \n principals {\n type = \"Service\"\n identifiers = [\"ecs-tasks.amazonaws.com\"]\n }\n }\n}<\/code><\/pre>\n\n\n\nresource \"aws_iam_role_policy_attachment\" \"ecsTaskExecutionRole_policy\" {\n role = \"${aws_iam_role.ecsTaskExecutionRole.name}\"\n policy_arn = \"arn:aws:iam::aws:policy\/service-role\/AmazonECSTaskExecutionRolePolicy\"\n}<\/code><\/pre>\n\n\n\nAWS ECS Task Roles<\/h3>\n\n\n\n
AWS ECS Cluster, ECS Task Definition and ECS Service Definition<\/h3>\n\n\n\n
resource \"aws_ecs_cluster\" \"example\" {\n name = \"fargate-cluster\"\n}<\/code><\/pre>\n\n\n\nresource \"aws_ecs_task_definition\" \"example\" {\n family = \"fargate-task\"\n execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn # Execution Role is used by the ECS Agent to make AWS API calls on the behalf of the user.\n # task_role_arn = aws_iam_role.ecs_task_role.arn # Task Role grants permissions specifically to the tasks, e.g. if a running task needs to access another AWS resource.\n network_mode = \"awsvpc\"\n requires_compatibilities = [\"FARGATE\"]\n cpu = \"256\" # Adjust based on your needs\n memory = \"512\" # Adjust based on your needs\n \n container_definitions = jsonencode([{\n name = \"my-container\"\n #image = \"nginx\" # Replace with your container image\n image = var.ecrimageuri\n essential = true\n portMappings = [{\n containerPort = 80\n hostPort = 80\n protocol = \"tcp\"\n }]\n }])\n}<\/code><\/pre>\n\n\n\nresource \"aws_ecs_service\" \"example\" {\n name = \"fargate-service\"\n cluster = aws_ecs_cluster.example.id\n task_definition = aws_ecs_task_definition.example.arn\n desired_count = 2\n launch_type = \"FARGATE\"\n \n load_balancer {\n target_group_arn = aws_lb_target_group.ecs_target_group.arn\n container_name = \"my-container\"\n container_port = 80\n }\n \n network_configuration {\n subnets = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]\n security_groups = [aws_security_group.ecs_sg.id]\n assign_public_ip = false\n }\n \n depends_on = [\n aws_lb_listener.http\n ]\n}<\/code><\/pre>\n\n\n\nalb.tf – Application Load Balancer<\/h2>\n\n\n\n
* Application Load Balancer (ALB) Target Group – The definition of the target group which links the listeners, i.e. the things that the end user will hit when connecting and the, in this case containers that the connections will be redirected to.
* Application Load Balancer (ALB) Listener (HTTP) – The definition of the listener that the end user will hit, this is the HTTP one which redirects to HTTPS.
* Application Load Balancer (ALB) Listener (HTTPS) – The definition of the listener that the end user will hit, this is the HTTPS one which has a certificate binding and directs the connections to the Target Group, which in turn goes to the containers running in AWS ECS.<\/p>\n\n\n\n# Application Load Balancer (ALB) Definition\nresource \"aws_lb\" \"app_lb\" {\n name = \"fargate-alb\"\n internal = false\n load_balancer_type = \"application\"\n security_groups = [aws_security_group.ecs_sg.id]\n subnets = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]\n \n enable_deletion_protection = false\n enable_cross_zone_load_balancing = true\n \n tags = {\n Name = \"fargate-alb\"\n }\n}\n \n# ALB Target Group\nresource \"aws_lb_target_group\" \"ecs_target_group\" {\n name = \"ecs-target-group\"\n port = 80\n protocol = \"HTTP\"\n vpc_id = aws_vpc.main.id\n target_type = \"ip\"\n \n health_check {\n path = \"\/\"\n interval = 30\n timeout = 5\n healthy_threshold = 3\n unhealthy_threshold = 3\n matcher = \"200\"\n }\n \n tags = {\n Name = \"ecs-target-group\"\n }\n}\n \n# ALB Listener (HTTP) with Redirect to HTTPS\nresource \"aws_lb_listener\" \"http\" {\n load_balancer_arn = aws_lb.app_lb.arn\n port = 80\n protocol = \"HTTP\"\n \n default_action {\n type = \"redirect\"\n redirect {\n port = 443\n protocol = \"HTTPS\"\n status_code = \"HTTP_301\"\n }\n }\n}\n \n# ALB Listener (HTTPS)\nresource \"aws_lb_listener\" \"https\" {\n load_balancer_arn = aws_lb.app_lb.arn\n port = 443\n protocol = \"HTTPS\"\n certificate_arn = aws_acm_certificate.example.arn\n \n default_action {\n type = \"forward\"\n target_group_arn = aws_lb_target_group.ecs_target_group.arn\n }\n}<\/code><\/pre>\n\n\n\ndnscert.tf – DNS Record and certificate<\/h2>\n\n\n\n
\n