AWS 服务与 Terraform 连接

Question

寻找工作 terraform 计划来配置 AWS Service Connect With ECS (FARGATE)。

这就是我所拥有的：

resource "aws_service_discovery_http_namespace" "my-cloudmap-namespace" {
  name        = "<namespace>"
  description = "Namespace for Service Discovery"
}

容器定义：

[
    {
        "name": "my-service-container",
        "image": "XXXXXXXXXXX",
        "cpu": 0,
        "essential": true,
        "portMappings": [{
            "name": "my-service",
            "containerPort": 4002,
            "hostPort": 4002,
            "protocol": "tcp",
            "appProtocol": "http"
        }]
    }
]

然后在服务定义中：

service_connect_configuration {
    enabled = true
    namespace = aws_service_discovery_http_namespace.my-cloudmap-namespace.arn
    service {
      client_alias {
        dns_name = "my-service"
        port = "4002"
      }
      discovery_name = "my-service"
      port_name = "my-service"
    }
}

这似乎不起作用。我无法从另一个实例访问 http://my-service:4002/ 上的服务。

是否有人使用 terraform 成功配置了 Service Connect with ECS (FARGATE)？

Answer 1

您应该检查您是否具有执行代理 API 调用的角色。如果您的工作不重要，您还应该尝试使用一个安全组来允许一切都在开始时进行，因此您要确保在这一侧没有任何锁定。然后你可以根据需要定义你的安全组（因为安全组可以阻止代理部分）。

您应该像这样创建任务和服务：

# Your task definition.
resource "aws_ecs_task_definition" "your_task" {
  family                   = "your_service_family"
  cpu                      = 512
  memory                   = 1024
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_instance_role.arn
  container_definitions = jsonencode([{
    name      = "your_name"
    image     = "your_image"
    cpu       = 1
    memory    = 1024
    essential = true
    portMappings = [{ containerPort = 8000, hostPort = 8000, name = "my-port" }]
  }])
}

# And your service.
resource "aws_ecs_service" "your_service" {
  cluster         = your_cluster.arn
  name            = "your_service_name"
  desired_count   = 1
  launch_type     = "FARGATE"
  task_definition = aws_ecs_task_definition.your_task.arn
  ...
  service_connect_configuration {
    enabled   = true
    namespace = aws_service_discovery_http_namespace.service_discovery.arn
    service {
      discovery_name = "service"
      port_name      = "my-port"
      client_alias {
        dns_name = "your-dns"
        port     = 8000
      }
    }
  }
}

小心有角色：

# Default ECS Task Execution policy defined directly by AWS.
data "aws_iam_policy" "amazon_ecs_task_execution_role_policy" {
  name = "AmazonECSTaskExecutionRolePolicy"
}

# Default ECS Task Instance policy defined directly by AWS.
data "aws_iam_policy" "amazon_ec2_container_service_for_ec2_role" {
  name = "AmazonEC2ContainerServiceforEC2Role"
}

data "aws_iam_policy_document" "ecs_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    sid     = ""
    effect  = "Allow"
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com", "ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecs_tasks_secrets_policy" {
  statement {
    resources = ["*"]
    effect    = "Allow"
    actions = [
      "kms:Decrypt",
      "ssm:GetParameters",
      "secretsmanager:GetSecretValue"
    ]
  }
}

resource "aws_iam_policy" "ecs_tasks_secrets" {
  name        = "ecsTasksSecrets"
  description = "Access Secrets in ECS Tasks"
  policy      = data.aws_iam_policy_document.ecs_tasks_secrets_policy.json
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name = "ecsTaskExecutionRole"
  managed_policy_arns = [
    data.aws_iam_policy.amazon_ecs_task_execution_role_policy.arn,
    aws_iam_policy.ecs_tasks_secrets.arn,
  ]
  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
}

resource "aws_iam_role" "ecs_instance_role" {
  name                = "ecsInstanceRole"
  managed_policy_arns = [data.aws_iam_policy.amazon_ec2_container_service_for_ec2_role.arn]
  assume_role_policy  = data.aws_iam_policy_document.ecs_assume_role.json
}

注意在您的任务中使用task_role_arn，否则代理无法将您的 API 调用转换为 IP。

Some AWS Docs for the Container Instance role. Some AWS Docs for Service Connect. Some AWS Docs for Task Execution role.