SkyForge

ecs-fargate/main.tf

data "aws_caller_identity" "current" {}

locals {
  tags = {
    Project = var.project
    Env     = var.env
    Owner   = var.owner
  }
  name = "${var.project}-ecs-${var.env}"
}

resource "aws_kms_key" "main" {
  description             = "${var.project} ${var.env} ecs"
  deletion_window_in_days = 7
  enable_key_rotation     = true
  tags                    = local.tags

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AllowAccountAdmin"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Sid       = "AllowCloudWatchLogs"
        Effect    = "Allow"
        Principal = { Service = "logs.${var.region}.amazonaws.com" }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncryptFrom",
          "kms:ReEncryptTo",
          "kms:GenerateDataKey",
          "kms:GenerateDataKeyWithoutPlaintext",
          "kms:DescribeKey",
        ]
        Resource = "*"
        Condition = {
          ArnLike = {
            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${var.region}:${data.aws_caller_identity.current.account_id}:*"
          }
        }
      },
    ]
  })
}

resource "aws_kms_alias" "main" {
  name          = "alias/${var.project}-${var.env}-ecs"
  target_key_id = aws_kms_key.main.key_id
}

resource "aws_ssm_parameter" "app_secret" {
  name   = "/${var.project}/${var.env}/checkout-api/app_secret"
  type   = "SecureString"
  key_id = aws_kms_key.main.key_id
  value  = var.app_secret
  tags   = local.tags
}

module "network" {
  source             = "../modules/network"
  name               = local.name
  project            = var.project
  env                = var.env
  owner              = var.owner
  region             = var.region
  vpc_cidr           = "10.40.0.0/16"
  az_count           = 2
  availability_zones = var.availability_zones
  public_subnet_cidrs = [
    "10.40.0.0/24",
    "10.40.1.0/24",
  ]
  private_subnet_cidrs = [
    "10.40.10.0/24",
    "10.40.11.0/24",
  ]
  enable_private = true
  enable_nat     = var.enable_nat
  kms_key_arn    = aws_kms_key.main.arn
}

module "ecr" {
  source      = "../modules/ecr"
  name        = "${var.project}-${var.env}"
  project     = var.project
  env         = var.env
  owner       = var.owner
  kms_key_arn = aws_kms_key.main.arn
}

module "alb" {
  source              = "../modules/alb"
  name                = local.name
  project             = var.project
  env                 = var.env
  owner               = var.owner
  vpc_id              = module.network.vpc_id
  vpc_cidr            = module.network.vpc_cidr
  public_subnet_ids   = module.network.public_subnet_ids
  certificate_arn     = var.certificate_arn
  kms_key_arn         = aws_kms_key.main.arn
  log_bucket_name     = var.alb_log_bucket
  deletion_protection = var.env == "prod"
}

module "service" {
  source                = "../modules/ecs_service"
  name                  = local.name
  project               = var.project
  env                   = var.env
  owner                 = var.owner
  region                = var.region
  vpc_id                = module.network.vpc_id
  subnet_ids            = module.network.private_subnet_ids
  alb_security_group_id = module.alb.security_group_id
  target_group_arn      = module.alb.target_group_arn
  ecr_repository_arn    = module.ecr.repository_arn
  container_image       = var.container_image
  secret_arn            = aws_ssm_parameter.app_secret.arn
  kms_key_arn           = aws_kms_key.main.arn
  task_cpu              = var.task_cpu
  task_memory           = var.task_memory
  desired_count         = var.desired_count
  min_capacity          = var.min_capacity
  max_capacity          = var.max_capacity
  cpu_target            = var.cpu_target
}