この前はECS/FargateでSSHのポートを開けただけのTerraformを紹介しましたが、今回はコンテナをALB配下に置いて80→443(ACM)でアクセスできるようTerraformを作ってみました。
■Resource: aws_ecs_service
https://www.terraform.io/docs/providers/aws/r/ecs_service.html
aws_ecs_service に load_balancer を追加するだけとなります。またクラスターは1つで adachin-app サービスを追加しています。
■Terraform
- aws_ecs.tf
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 |
## Cluster resource "aws_ecs_cluster" "adachin" { name = "adachin" } ## adachin-devops resource "aws_ecs_task_definition" "adachin-devops-task" { family = "adachin-devops" requires_compatibilities = ["FARGATE"] network_mode = "awsvpc" task_role_arn = "arn:aws:iam::${var.aws_account_id}:role/ecsTaskExecutionRole" execution_role_arn = "arn:aws:iam::${var.aws_account_id}:role/ecsTaskExecutionRole" cpu = 512 memory = 1024 container_definitions = file("files/task-definitions/devops.json") } resource "aws_ecs_service" "adachin-devops-service" { cluster = aws_ecs_cluster.adachin.id deployment_minimum_healthy_percent = 50 deployment_maximum_percent = 200 desired_count = var.aws_ecs_service_desired_count_devops launch_type = "FARGATE" name = "adachin-devops-service" deployment_circuit_breaker { enable = true rollback = true } lifecycle { ignore_changes = [ desired_count, task_definition, ] } network_configuration { subnets = [ aws_subnet.adachin-app-1a.id, ] security_groups = [ aws_security_group.adachin-devops.id, ] } task_definition = aws_ecs_task_definition.adachin-devops-task.arn } ## adachin-app resource "aws_ecs_task_definition" "adachin-app-task" { family = "adachin-app" requires_compatibilities = ["FARGATE"] network_mode = "awsvpc" task_role_arn = "arn:aws:iam::${var.aws_account_id}:role/ecsTaskExecutionRole" execution_role_arn = "arn:aws:iam::${var.aws_account_id}:role/ecsTaskExecutionRole" cpu = 512 memory = 1024 container_definitions = file("files/task-definitions/app.json") } resource "aws_ecs_service" "adachin-app-service" { cluster = aws_ecs_cluster.adachin.id deployment_minimum_healthy_percent = 50 deployment_maximum_percent = 200 desired_count = var.aws_ecs_service_desired_count_app launch_type = "FARGATE" name = "adachin-app-service" deployment_circuit_breaker { enable = true rollback = true } lifecycle { ignore_changes = [ desired_count, task_definition, ] } load_balancer { target_group_arn = aws_lb_target_group.adachin-app.arn container_name = "adachin-app" container_port = 80 } network_configuration { subnets = [ aws_subnet.adachin-app-1a.id, ] security_groups = [ aws_security_group.adachin-app.id, aws_security_group.adachin-rds.id ] } task_definition = aws_ecs_task_definition.adachin-app-task.arn } |
- files/task-definitions/app.json
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
[ { "image": "xxxxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/adachin-app-pre", "logConfiguration": { "logDriver": "awslogs", "options": { "awslogs-group": "/ecs/app", "awslogs-region": "ap-northeast-1", "awslogs-stream-prefix": "ecs" } }, "cpu": 512, "memory": 1024, "mountPoints": [], "environment": [ { "name" : "RAILS_ENV", "value" : "pre" } ], "networkMode": "awsvpc", "name": "adachin-app", "essential": true, "portMappings": [ { "hostPort": 80, "containerPort": 80, "protocol": "tcp" } ], "command": [ "/usr/bin/supervisord" ] } ] |
- aws_alb-ecs.tf
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
resource "aws_lb" "adachin-app" { name = "adachin-app" internal = false load_balancer_type = "application" security_groups = [aws_security_group.adachin-app-alb.id] subnets = [aws_subnet.adachin-public-1a.id, aws_subnet.adachin-public-1c.id, aws_subnet.adachin-public-1d.id] enable_deletion_protection = true tags = { Env = "pre" } } resource "aws_lb_target_group" "adachin-app" { name = "adachin-app" port = 80 protocol = "HTTP" vpc_id = aws_vpc.adachin-vpc.id target_type = "ip" deregistration_delay = "10" health_check { protocol = "HTTP" path = "/ping" port = 80 healthy_threshold = 5 unhealthy_threshold = 2 timeout = 5 interval = 10 matcher = 200 } } resource "aws_alb_listener" "adachin-app" { load_balancer_arn = aws_lb.adachin-app.arn port = "80" protocol = "HTTP" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } resource "aws_alb_listener" "adachin-app-https" { load_balancer_arn = aws_lb.adachin-app.arn port = "443" protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-2015-05" certificate_arn = aws_acm_certificate.pre-adachin-com.arn default_action { target_group_arn = aws_lb_target_group.adachin-app.arn type = "forward" } } |
- aws_acm.tf
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
## Common resource "aws_acm_certificate" "adachin-com" { domain_name = "adachin.com" subject_alternative_names = ["*.adachin.com"] validation_method = "DNS" tags = { Environment = "pre" } lifecycle { create_before_destroy = true } } |
■まとめ
あとはRoute53にALBのDNS名AliasをTerraformで追加すれば設定は完了です！
そういえばTerraform v0.12から変数 "${}" が必要なくなったので全部リファクタリングしましょう！ちなみにPHPの変数は "" なので混同してしまう。。。
0件のコメント