ECS Fargate Service

Why it mattersCopy Anchor Link

This module runs the app itself. It starts containers in private subnets with no public IP, injects secrets from SSM or Secrets Manager, and rolls back a bad deploy on its own. The same module call works in commercial AWS and GovCloud, and federal stacks turn on a read only filesystem, a non root user, and customer managed log encryption with a few settings.

Use it whenCopy Anchor Link

• You deploy a containerized web app or API behind the alb module.
• You run an internal service with no load balancer. Leave target_group_arn null and use Cloud Map with service_registry_arn.
• The customer account forbids creating IAM roles. Pass execution_role_arn and task_role_arn.

Reach for something else whenCopy Anchor Link

• You need a one off job such as a database migration. Write a separate aws_ecs_task_definition and run it with aws ecs run-task.
• You need a sidecar other than Fluent Bit, such as Envoy or an OpenTelemetry agent. The module supports only the Fluent Bit log router.

What it createsCopy Anchor Link

• aws_iam_role (task execution role, AmazonECSTaskExecutionRolePolicy with a partition aware ARN)
• aws_iam_role_policy (SSM, Secrets Manager, and KMS reads for the execution role)
• aws_iam_role (task role for app permissions)
• aws_security_group (ingress on container_port from the load balancer only)
• aws_cloudwatch_log_group (/ecs/<name>, optional CMK)
• aws_ecs_task_definition (Fargate, ARM64 by default, optional init and Fluent Bit sidecar containers)
• aws_ecs_service (platform 1.4.0, circuit breaker with rollback)
• aws_appautoscaling_target and aws_appautoscaling_policy (CPU target tracking)

Secure by defaultCopy Anchor Link

• Tasks never get a public IP (assign_public_ip = false, not configurable).
• The task security group accepts traffic only from the load balancer security group on container_port.
• Failed deploys roll back on their own (deployment circuit breaker with rollback).
• ECS Exec is off (enable_execute_command = false).
• Secrets reach the container from SSM or Secrets Manager, never as plain environment variables.

Commercial and GovCloudCopy Anchor Link

module "ecs_service" {
  source = "git::ssh://git@github.com/the-kaizen-labs/terraform-modules.git//ecs-service?ref=v1.7.0"

  app_name           = local.app_name
  cluster_name       = module.ecs_cluster.cluster_name
  vpc_id             = module.networking.vpc_id
  private_subnet_ids = module.networking.private_subnet_ids
  container_image    = "${module.ecr.repository_url}:latest"

  target_group_arn      = module.alb.target_group_arn
  alb_security_group_id = module.alb.alb_security_group_id

  container_secrets  = [{ name = "DATABASE_URL", valueFrom = aws_ssm_parameter.database_url.arn }]
  ssm_parameter_arns = [aws_ssm_parameter.database_url.arn]

  tags = local.tags
}

How it connectsCopy Anchor Link

• From networking: vpc_id, private_subnet_ids
• From ecs-cluster: cluster_name
• From ecr: repository_url (as container_image)
• From alb: target_group_arn, alb_security_group_id
• From rds-postgres: db_host, in an SSM DATABASE_URL passed through container_secrets
• From redis: endpoint_address, in an SSM REDIS_URL passed through container_secrets
• From s3-bucket: bucket_arn, in a policy on task_role_name
• From rum: app_monitor_id, identity_pool_id (as environment_variables)
• From openobserve: ingest_host, in main_container_log_configuration for Fluent Bit
• To rds-postgres: security_group_id (as allowed_security_group_ids)
• To redis: security_group_id (as allowed_security_group_ids)
• To openobserve: security_group_id (as caller_ingress_security_group_ids)

InputsCopy Anchor Link

OutputsCopy Anchor Link

Used byCopy Anchor Link