ECS Exec のログ記録はタスクロールで行われるため注意しよう

######################################
# CloudWatch Logs Configuration
######################################
resource "aws_cloudwatch_log_group" "nginx" {
  name              = "/ecs/${local.prefix}/nginx"
  retention_in_days = 1

  tags = {
    Name = "/ecs/${local.prefix}/nginx/"
  }
}

resource "aws_cloudwatch_log_group" "nginx_exec" {
  name              = "/ecs/${local.prefix}/nginx-ecs-exec"
  retention_in_days = 1

  tags = {
    Name = "/ecs/${local.prefix}/nginx-ecs-exec"
  }
}

######################################
# ECS Cluster Configuration
######################################
resource "aws_ecs_cluster" "cluster" {
  name = "${local.prefix}-cluster"

  configuration {
    execute_command_configuration {
      # logging    = "OVERRIDE"
      logging = "DEFAULT"

      log_configuration {
        cloud_watch_log_group_name     = aws_cloudwatch_log_group.nginx_exec.name
      }
    }
  }

  tags = {
    Name = "${local.prefix}-cluster"
  }
}

######################################
# ECS Task Configuration
######################################
resource "aws_iam_role" "task_exec" {
  name               = "${local.prefix}-task-exec-role"
  assume_role_policy = file("${path.module}/iam_policy_document/assume_ecs_task.json")

  tags = {
    Name = "${local.prefix}-task-exec-role"
  }
}

resource "aws_iam_role_policy_attachment" "task_exec" {
  role       = aws_iam_role.task_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "task_nginx" {
  name               = "${local.prefix}-task-nginx-role"
  assume_role_policy = file("${path.module}/iam_policy_document/assume_ecs_task.json")

  tags = {
    Name = "${local.prefix}-task-nginx-role"
  }
}

resource "aws_iam_policy" "task_nginx" {
  name   = "${local.prefix}-task-nginx-policy"
  policy = file("${path.module}/iam_policy_document/iam_task_nginx.json")

  tags = {
    Name = "${local.prefix}-task-nginx-policy"
  }
}

resource "aws_iam_role_policy_attachment" "task_nginx" {
  role       = aws_iam_role.task_nginx.name
  policy_arn = aws_iam_policy.task_nginx.arn
}

data "aws_ecr_repository" "amazon_linux" {
  name = "ecr-public/amazonlinux/amazonlinux"
}

resource "aws_ecs_task_definition" "nginx" {
  family                   = "${local.prefix}-nginx-td"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  memory                   = 512
  cpu                      = 256
  execution_role_arn       = aws_iam_role.task_exec.arn
  task_role_arn            = aws_iam_role.task_nginx.arn
  container_definitions = templatefile("${path.module}/task_definition/nginx.json", {
    image_url         = "public.ecr.aws/nginx/nginx:latest",
    log_group_name    = aws_cloudwatch_log_group.nginx.name,
    region            = data.aws_region.current.name,
    log_stream_prefix = "sample-nginx"
  })
  lifecycle {
    ignore_changes = [
      container_definitions
    ]
  }
}

######################################
# ECS Task Configuration
######################################
resource "aws_security_group" "nginx" {
  name        = "${local.prefix}-nginx-sg"
  description = "${local.prefix}-nginx-sg"
  vpc_id      = aws_vpc.vpc.id

  ingress {
    description = "My IP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["${chomp(data.http.ifconfig.response_body)}/32"]
  }

  egress {
    description = "All Connection"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${local.prefix}-nginx-sg"
  }
}

resource "aws_ecs_service" "nginx" {
  name                   = "${local.prefix}-nginx-service"
  cluster                = aws_ecs_cluster.cluster.id
  task_definition        = aws_ecs_task_definition.nginx.arn
  launch_type            = "FARGATE"
  desired_count          = 1
  enable_execute_command = true

  network_configuration {
    security_groups  = [aws_security_group.nginx.id]
    subnets          = [aws_subnet.public_a.id]
    assign_public_ip = true
  }

  tags = {
    Name = "${local.prefix}-nginx-service"
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ],
      "Resource": "*"
    }
  ]
}

######################################
# Provider Configuration
######################################
terraform {
  required_version = "~> 1.3.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "4.46.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

######################################
# Data Configuration
######################################

data "aws_caller_identity" "self" {}
data "aws_region" "current" {}

data "http" "ifconfig" {
  url = "http://ipv4.icanhazip.com/"
}

######################################
# Environment Variables Configuration
######################################
variable "system" {
  type    = string
  default = "nginx"
}

variable "env" {
  type    = string
  default = "sample"
}

locals {
  prefix = "${var.system}-${var.env}"
}

[
  {
    "name": "nginx",
    "image": "${image_url}",
    "essential": true,
    "linuxParameters": {
      "initProcessEnabled": true
    },
    "portMappings": [
      {
        "containerPort": 80,
        "hostPort": 80,
        "protocol": "tcp"
      }
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "${log_group_name}",
        "awslogs-region": "${region}",
        "awslogs-stream-prefix": "${log_stream_prefix}"
      }
    }
  }
]

######################################
# VPC Configuration
######################################
resource "aws_vpc" "vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "${local.prefix}-vpc"
  }
}

######################################
# Public Subnet Configuration
######################################
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "${local.prefix}-igw"
  }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "${local.prefix}-public-rtb"
  }
}

resource "aws_route" "public_igw" {
  route_table_id         = aws_route_table.public.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.igw.id
}

resource "aws_subnet" "public_a" {
  vpc_id            = aws_vpc.vpc.id
  availability_zone = "${data.aws_region.current.name}a"
  cidr_block        = "10.0.0.0/24"

  tags = {
    Name = "${local.prefix}-public-a-subnet"
  }
}

resource "aws_route_table_association" "public_a" {
  subnet_id      = aws_subnet.public_a.id
  route_table_id = aws_route_table.public.id
}