tf-aws-module_collection-ecs_appmesh_platform

Overview

This terraform module creates a ECS Platform with App Mesh enabled. The following resources are created

• VPC (optional)
  • Private Subnets
  • Public Subnets
  • Nat Gateway (optional)
  • Route Tables (optional)
• VPC endpoints (optional)
• VPC endpoint Security group (optional)
• ECS Fargate Cluster
• CloudMap Namespace
• App Mesh

Usage

A sample variable file example.tfvars is available in the root directory which can be used to test this module. User needs to follow the below steps to execute this module

1. Update the sample-tfvars/example.tfvars to manually enter values for all fields marked within <> to make the variable file usable
2. Create a file provider.tf with the below contents

    provider "aws" {
      profile = "<profile_name>"
      region  = "<region_name>"
    }
   

   If using SSO, make sure you are logged in aws sso login --profile <profile_name>
3. Make sure terraform binary is installed on your local. Use command type terraform to find the installation location. If you are using asdf, you can run asfd install and it will install the correct terraform version for you. .tool-version contains all the dependencies.
4. Run the terraform to provision infrastructure on AWS

   # Initialize
   terraform init
   # Plan
   terraform plan -var-file example.tfvars
   # Apply (this is create the actual infrastructure)
   terraform apply -var-file example.tfvars -auto-approve
   

Known Issues

1. NA

Pre-Commit hooks

.pre-commit-config.yaml file defines certain pre-commit hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.

commitlint hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:

• fix: a commit of the type fix patches a bug in your codebase (this correlates with PATCH in Semantic Versioning).
• feat: a commit of the type feat introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning).
• BREAKING CHANGE: a commit that has a footer BREAKING CHANGE:, or appends a ! after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type. footers other than BREAKING CHANGE: may be provided and follow a convention similar to git trailer format.
• build: a commit of the type build adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
• chore: a commit of the type chore adds changes that don't modify src or test files
• ci: a commit of the type ci adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
• docs: a commit of the type docs adds documentation only changes
• perf: a commit of the type perf adds code change that improves performance
• refactor: a commit of the type refactor adds code change that neither fixes a bug nor adds a feature
• revert: a commit of the type revert reverts a previous commit
• style: a commit of the type style adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
• test: a commit of the type test adds missing tests or correcting existing tests

Base configuration used for this project is commitlint-config-conventional (based on the Angular convention)

If you are a developer using vscode, this plugin may be helpful.

detect-secrets-hook prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS

In order for pre-commit hooks to work properly

• You need to have the pre-commit package manager installed. Here are the installation instructions.
• pre-commit would install all the hooks when commit message is added by default except for commitlint hook. commitlint hook would need to be installed manually using the command below

pre-commit install --hook-type commit-msg

To test the resource group module locally

1. For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the configure target in the project's Makefile. Before you can run configure, familiarize yourself with the variables in the Makefile and ensure they're pointing to the right places.

make configure

This adds in several files and directories that are ignored by git. They expose many new Make targets.

2. The first target you care about is env. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.

make configure command will bring down aws_env.sh file on local workstation. Developer would need to modify this file, replace the environment variable values with relevant values.

These environment variables are used by terratest integration suit.

Then run this make target to set the environment variables on developer workstation.

make env

3. The first target you care about is check.

Pre-requisites Before running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are aws specific. If primitive/segment under development uses any other cloud provider than AWS, this section may not be relevant.

• A file named provider.tf with contents below

provider "aws" {
  profile = "<profile_name>"
  region  = "<region_name>"
}

• A file named terraform.tfvars which contains key value pair of variables used.

Note that since these files are added in gitignore they would not be checked in into primitive/segment's git repo.

After creating these files, for running tests associated with the primitive/segment, run

make check

If make check target is successful, developer is good to commit the code to primitive/segment's git repo.

make check target

• runs terraform commands to lint,validate and plan terraform code.
• runs conftests. conftests make sure policy checks are successful.
• runs terratest. This is integration test suit.
• runs opa tests

Requirements

Name	Version
terraform	~> 1.0
aws	>= 3.28.0

Providers

No providers.

Modules

Name	Source	Version
security_group_vpce	terraform-aws-modules/security-group/aws	~> 4.17.1
resource_names	terraform.registry.launch.nttdata.com/module_library/resource_name/launch	~> 2.0
ecs	terraform-aws-modules/ecs/aws	~> 4.1.3
interface_endpoints	terraform-aws-modules/vpc/aws//modules/vpc-endpoints	~> 3.19.0
gateway_endpoints	terraform-aws-modules/vpc/aws//modules/vpc-endpoints	~> 3.19.0
namespace	terraform.registry.launch.nttdata.com/module_primitive/private_dns_namespace/aws	~> 1.0
app_mesh	terraform.registry.launch.nttdata.com/module_primitive/appmesh/aws	~> 1.0
vpc	terraform-aws-modules/vpc/aws	~> 5.8.1

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
logical_product_family	(Required) Name of the product family for which the resource is created. Example: org_name, department_name.	string	"launch"	no
logical_product_service	(Required) Name of the product service for which the resource is created. For example, backend, frontend, middleware etc.	string	"ecs"	no
environment	Environment in which the resource should be provisioned like dev, qa, prod etc.	string	"dev"	no
environment_number	The environment count for the respective environment. Defaults to 000. Increments in value of 1	string	"000"	no
resource_number	The resource count for the respective resource. Defaults to 000. Increments in value of 1	string	"000"	no
region	AWS Region in which the infra needs to be provisioned	string	"us-east-2"	no
resource_names_map	A map of key to resource_name that will be used by tf-launch-module_library-resource_name to generate resource names	map(object( { name = string max_length = optional(number, 60) } ))	{ "app_mesh": { "max_length": 60, "name": "mesh" }, "ecs_cluster": { "max_length": 60, "name": "fargate" }, "namespace": { "max_length": 60, "name": "ns" }, "vpce_sg": { "max_length": 60, "name": "vpcesg" } }	no
create_vpc	Whether to create the VPC or not. Set this value to true to create a new VPC for ECS cluster. Default is false	bool	false	no
vpc_id	The VPC ID of the VPC where infrastructure will be provisioned	string	null	no
private_subnets	List of private subnets. Required when create_vpc=false. Will be ignored when create_vpc=true	list(string)	[]	no
vpc	VPC related variables. Required when create_vpc=true. Public subnets are required when user wants to provision internet facing ALBs also when enable_nat_gateway=true, If single_nat_gateway=true, 1 Nat Gateway will be created, else if one_nat_gateway_per_az=true, 1 Nat Gateway per AZ will be created, else that many Nat gateways will be created as the number of max(public, private) subnets	object({ vpc_name = string vpc_cidr = string private_subnet_cidr_ranges = list(string) public_subnet_cidr_ranges = optional(list(string), []) availability_zones = list(string) default_security_group_ingress = optional(list(map(string)), []) enable_nat_gateway = optional(bool, false) single_nat_gateway = optional(bool, true) one_nat_gateway_per_az = optional(bool, false) })	null	no
gateway_vpc_endpoints	List of VPC endpoints to be created. AWS currently only supports S3 and DynamoDB gateway interfaces	map(object({ service_name = string subnet_names = optional(list(string), []) private_dns_enabled = optional(bool, false) route_table_ids = optional(list(string)) tags = optional(map(string), {}) }))	{}	no
interface_vpc_endpoints	List of VPC endpoints to be created. Must create endpoints for all AWS services that the ECS services needs to communicate over the private network. For example: ECR, CloudWatch, AppMesh etc. In absence of NAT gateway, pull images from ECR too needs private endpoint.	map(object({ service_name = string subnet_names = optional(list(string), []) private_dns_enabled = optional(bool, false) tags = optional(map(string), {}) }))	{}	no
route_table_ids	List of route tables for Gateway VPC endpoints	list(string)	[]	no
vpce_security_group	Default security group to be attached to all VPC endpoints. Must allow relevant ingress and egress traffic.	object({ ingress_rules = optional(list(string)) ingress_cidr_blocks = optional(list(string)) ingress_with_cidr_blocks = optional(list(map(string))) egress_rules = optional(list(string)) egress_cidr_blocks = optional(list(string)) egress_with_cidr_blocks = optional(list(map(string))) })	null	no
container_insights_enabled	Whether to enable container Insights or not. Default is true	bool	true	no
namespace_name	The Cloud Map namespace to be created. Should be a valid domain name. Example test.example.local. Mostly used for service discovery and AppMesh	string	""	no
namespace_description	Description for the Cloud Map Namespace	string	""	no
tags	A map of custom tags to be attached to resources	map(string)	{}	no

Outputs

Name	Description
interface_endpoints	A map of interface VPC endpoint IDs
gateway_endpoints	A map of gateway VPC endpoint IDs
resource_names	A map of resource_name_types to generated resource names used in this module
vpce_sg_id	The ID of the VPC Endpoint Security Group
namespace_name	# CloudMap related outputs
namespace_id	ID of the Cloud Map Namespace
namespace_arn	ARN of the Cloud Map Namespace
namespace_hosted_zone	Hosted Zone of Cloud Map Namespace
app_mesh_id	ID of the App Mesh
app_mesh_arn	ARN of the App Mesh
fargate_arn	The ARN of the ECS fargate cluster
vpc_id	ID of the VPC
private_subnet_ids	IDs of the private subnets
public_subnet_ids	List of IDs of public subnets
nat_gateway_ids	List of IDs of NAT Gateways
nat_gateway_public_ips	List of NAT Gateway Public IPs