I tried deploying Epic Games' Lore server to AWS Fargate + S3 + DynamoDB with Terraform

terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.40"
    }
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Project   = "blog-lore-article-c"
      ManagedBy = "terraform"
    }
  }
}

data "aws_caller_identity" "current" {}

variable "region" {
  description = "Deployment region"
  type        = string
  default     = "ap-northeast-1"
}

variable "name_prefix" {
  description = "Prefix for resource names"
  type        = string
  default     = "lorec"
}

variable "allowed_cidr" {
  description = "Source CIDR allowed to access the NLB (your global IP)"
  type        = string
  # Override with -var at runtime, or replace this with your own IP
  default     = "203.0.113.10/32"
}

variable "image_tag" {
  description = "Tag for the loreserver container image"
  type        = string
  default     = "v1"
}

variable "task_cpu" {
  description = "CPU units for the Fargate task"
  type        = number
  default     = 512
}

variable "task_memory" {
  description = "Memory for the Fargate task (MiB)"
  type        = number
  default     = 1024
}

# S3 bucket for immutable data
resource "aws_s3_bucket" "store" {
  bucket        = "${var.name_prefix}-store-${data.aws_caller_identity.current.account_id}"
  force_destroy = true
}

resource "aws_s3_bucket_public_access_block" "store" {
  bucket                  = aws_s3_bucket.store.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# fragments table
resource "aws_dynamodb_table" "fragments" {
  name         = "${var.name_prefix}-fragments"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "hash"
  range_key    = "repository_context"

  attribute {
    name = "hash"
    type = "B"
  }
  attribute {
    name = "repository_context"
    type = "B"
  }
}

# metadata table
resource "aws_dynamodb_table" "metadata" {
  name         = "${var.name_prefix}-metadata"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "hash"

  attribute {
    name = "hash"
    type = "B"
  }
}

# mutable table
resource "aws_dynamodb_table" "mutable" {
  name         = "${var.name_prefix}-mutable"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "repository_id"
  range_key    = "key"

  attribute {
    name = "repository_id"
    type = "B"
  }
  attribute {
    name = "key"
    type = "B"
  }
}

# locks table (3 GSIs)
resource "aws_dynamodb_table" "locks" {
  name         = "${var.name_prefix}-locks"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "hash"
  range_key    = "repositoryBranch"

  attribute {
    name = "hash"
    type = "B"
  }
  attribute {
    name = "repositoryBranch"
    type = "B"
  }
  attribute {
    name = "repository"
    type = "B"
  }
  attribute {
    name = "branch"
    type = "B"
  }
  attribute {
    name = "ownerId"
    type = "S"
  }
  attribute {
    name = "description"
    type = "S"
  }

  global_secondary_index {
    name            = "owner-repo-branch"
    hash_key        = "ownerId"
    range_key       = "repositoryBranch"
    projection_type = "ALL"
  }
  global_secondary_index {
    name            = "repo-branch"
    hash_key        = "repository"
    range_key       = "branch"
    projection_type = "ALL"
  }
  global_secondary_index {
    name            = "repo-branch-description"
    hash_key        = "repositoryBranch"
    range_key       = "description"
    projection_type = "ALL"
  }
}

data "aws_iam_policy_document" "ecs_assume" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

# Task execution role: pull from ECR and write to CloudWatch Logs
resource "aws_iam_role" "execution" {
  name               = "${var.name_prefix}-exec"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume.json
}

resource "aws_iam_role_policy_attachment" "execution" {
  role       = aws_iam_role.execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

# Task role: permissions for loreserver to access S3 and DynamoDB
resource "aws_iam_role" "task" {
  name               = "${var.name_prefix}-task"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume.json
}

data "aws_iam_policy_document" "task" {
  statement {
    sid     = "S3"
    actions = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"]
    resources = [
      aws_s3_bucket.store.arn,
      "${aws_s3_bucket.store.arn}/*",
    ]
  }
  statement {
    sid = "DynamoDB"
    actions = [
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteItem",
      "dynamodb:Query",
      "dynamodb:BatchGetItem",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
    ]
    resources = [
      aws_dynamodb_table.fragments.arn,
      aws_dynamodb_table.metadata.arn,
      aws_dynamodb_table.mutable.arn,
      aws_dynamodb_table.locks.arn,
      "${aws_dynamodb_table.locks.arn}/index/*",
    ]
  }
}

resource "aws_iam_role_policy" "task" {
  name   = "${var.name_prefix}-task-policy"
  role   = aws_iam_role.task.id
  policy = data.aws_iam_policy_document.task.json
}

data "aws_vpc" "default" {
  default = true
}

data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

# Security group for NLB: only allow ports 41337 / 41339 from your own IP
resource "aws_security_group" "nlb" {
  name        = "${var.name_prefix}-nlb"
  description = "Allow lore ports from the operator IP only"
  vpc_id      = data.aws_vpc.default.id

  ingress {
    description = "gRPC/QUIC"
    from_port   = 41337
    to_port     = 41337
    protocol    = "tcp"
    cidr_blocks = [var.allowed_cidr]
  }
  ingress {
    description = "HTTP health"
    from_port   = 41339
    to_port     = 41339
    protocol    = "tcp"
    cidr_blocks = [var.allowed_cidr]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Security group for Fargate tasks: only accept traffic from the NLB
resource "aws_security_group" "task" {
  name        = "${var.name_prefix}-task"
  description = "Allow lore ports from the NLB security group"
  vpc_id      = data.aws_vpc.default.id

  ingress {
    description     = "gRPC/QUIC from NLB"
    from_port       = 41337
    to_port         = 41337
    protocol        = "tcp"
    security_groups = [aws_security_group.nlb.id]
  }
  ingress {
    description     = "HTTP health from NLB"
    from_port       = 41339
    to_port         = 41339
    protocol        = "tcp"
    security_groups = [aws_security_group.nlb.id]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_lb" "nlb" {
  name               = "${var.name_prefix}-nlb"
  internal           = false
  load_balancer_type = "network"
  security_groups    = [aws_security_group.nlb.id]
  subnets            = data.aws_subnets.default.ids
}

# Target group for gRPC/TCP (target_type = ip because of Fargate awsvpc)
resource "aws_lb_target_group" "grpc" {
  name        = "${var.name_prefix}-grpc"
  port        = 41337
  protocol    = "TCP"
  target_type = "ip"
  vpc_id      = data.aws_vpc.default.id

  health_check {
    protocol = "HTTP"
    port     = "41339"
    path     = "/health_check"
    interval = 30
  }
}

resource "aws_lb_listener" "grpc" {
  load_balancer_arn = aws_lb.nlb.arn
  port              = 41337
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.grpc.arn
  }
}

resource "aws_ecr_repository" "lore" {
  name                 = "${var.name_prefix}-server"
  image_tag_mutability = "MUTABLE"
  force_delete         = true
}

resource "aws_cloudwatch_log_group" "lore" {
  name              = "/ecs/${var.name_prefix}-server"
  retention_in_days = 7
}

resource "aws_ecs_cluster" "lore" {
  name = "${var.name_prefix}-cluster"
}

resource "aws_ecs_task_definition" "lore" {
  family                   = "${var.name_prefix}-server"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = var.task_cpu
  memory                   = var.task_memory
  execution_role_arn       = aws_iam_role.execution.arn
  task_role_arn            = aws_iam_role.task.arn

  runtime_platform {
    operating_system_family = "LINUX"
    cpu_architecture        = "X86_64"
  }

  container_definitions = jsonencode([
    {
      name      = "loreserver"
      image     = "${aws_ecr_repository.lore.repository_url}:${var.image_tag}"
      essential = true
      portMappings = [
        { containerPort = 41337, protocol = "tcp" },
        { containerPort = 41339, protocol = "tcp" },
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.lore.name
          "awslogs-region"        = var.region
          "awslogs-stream-prefix" = "loreserver"
        }
      }
    }
  ])
}

resource "aws_ecs_service" "lore" {
  name            = "${var.name_prefix}-server"
  cluster         = aws_ecs_cluster.lore.id
  task_definition = aws_ecs_task_definition.lore.arn
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = data.aws_subnets.default.ids
    security_groups  = [aws_security_group.task.id]
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.grpc.arn
    container_name   = "loreserver"
    container_port   = 41337
  }

  depends_on = [aws_lb_listener.grpc]
}

output "nlb_dns" {
  description = "DNS name of the NLB. Clients connect via grpc://<this value>:41337"
  value       = aws_lb.nlb.dns_name
}

output "ecr_repository_url" {
  description = "Push destination for the loreserver image"
  value       = aws_ecr_repository.lore.repository_url
}

output "s3_bucket" {
  value = aws_s3_bucket.store.bucket
}

output "dynamodb_tables" {
  value = {
    fragments = aws_dynamodb_table.fragments.name
    metadata  = aws_dynamodb_table.metadata.name
    mutable   = aws_dynamodb_table.mutable.name
    locks     = aws_dynamodb_table.locks.name
  }
}

output "ecs_cluster" {
  value = aws_ecs_cluster.lore.name
}

output "ecs_service" {
  value = aws_ecs_service.lore.name
}

# An overlay that bakes an AWS-backend local.toml into the official
# pre-built image (lore-server:base-amd64). local.toml is placed at
# /etc/lore/config and is read after docker.toml (for LORE_ENV=docker),
# overriding the mode to aws.
FROM lore-server:base-amd64
COPY local.toml /etc/lore/config/local.toml

[immutable_store]
mode = "aws"

[mutable_store]
mode = "aws"

[lock_store]
mode = "aws"

[plugins.aws.immutable_store]
s3_bucket = "lorec-store-<account ID>"
s3_region = "ap-northeast-1"
s3_force_path_style = false
dynamodb_fragments_table = "lorec-fragments"
dynamodb_metadata_table = "lorec-metadata"
dynamodb_region = "ap-northeast-1"
timeout_millis = 120000

[plugins.aws.mutable_store]
dynamodb_table = "lorec-mutable"
dynamodb_region = "ap-northeast-1"
timeout_millis = 120000

[plugins.aws.lock_store]
dynamodb_table = "lorec-locks"
dynamodb_region = "ap-northeast-1"
timeout_millis = 120000