ECS Fargateでサポートされたtmpfsマウントを試してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: 'ECS Fargate with tmpfs mounts on default VPC'

Resources:
  # ECS Cluster
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: tmpfs-test-cluster

  # CloudWatch Log Group
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/tmpfs-test
      RetentionInDays: 7

  # IAM Roles (Execution & Task)
  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ECSExecPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Resource: '*'

  # Task Definition with tmpfs
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: tmpfs-test-task
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: '256'
      Memory: '512'
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      TaskRoleArn: !GetAtt TaskRole.Arn
      ContainerDefinitions:
        - Name: tmpfs-container
          Image: amazonlinux:2023
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref LogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ecs
          LinuxParameters:
            Tmpfs:
              - ContainerPath: /mnt/tmpfs
                Size: 256
              - ContainerPath: /tmp
                Size: 128
                MountOptions:
                  - noexec
                  - nosuid
          Command:
            - /bin/sh
            - -c
            - |
              echo "=== tmpfs mounts verification ==="
              df -h | grep tmpfs
              echo ""
              echo "=== Creating test file in /mnt/tmpfs ==="
              echo "test data $(date)" > /mnt/tmpfs/test.txt
              cat /mnt/tmpfs/test.txt
              echo ""
              echo "=== Verification complete ==="
              sleep 3600

  # Network Resources
  FargateSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Fargate tmpfs test
      VpcId: vpc-********

  ECSService:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: tmpfs-test-service
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 1
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref FargateSecurityGroup
          Subnets:
            - subnet-********