Browse the Repo

file-type-icon.circleci
file-type-icon_ci
file-type-icon_docs
file-type-iconexamples
file-type-iconmodules
file-type-iconaws-helpers
file-type-iconbuild-helpers
file-type-iconcheck-url
file-type-iconcircleci-helpers
file-type-icondocs-generator
file-type-iconec2-backup
file-type-iconecs-deploy-runner-invoke-iam-policy
file-type-iconecs-deploy-runner-standard-configuration
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconecs-deploy-runner
file-type-icongit-helpers
file-type-icongruntwork-module-circleci-helpers
file-type-iconiam-policies
file-type-iconinfrastructure-deploy-script
file-type-iconinfrastructure-deployer
file-type-iconinstall-jenkins
file-type-iconjenkins-server
file-type-iconkubernetes-circleci-helpers
file-type-iconterraform-helpers
file-type-icontest
file-type-icontestdep
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME-CircleCI.adoc
file-type-iconREADME-Jenkins.adoc
file-type-iconREADME-Terraform-Terragrunt-Pipeline.adoc
file-type-iconREADME-TravisCI.adoc
file-type-iconREADME.adoc
file-type-iconsetup.cfg

Browse the Repo

file-type-icon.circleci
file-type-icon_ci
file-type-icon_docs
file-type-iconexamples
file-type-iconmodules
file-type-iconaws-helpers
file-type-iconbuild-helpers
file-type-iconcheck-url
file-type-iconcircleci-helpers
file-type-icondocs-generator
file-type-iconec2-backup
file-type-iconecs-deploy-runner-invoke-iam-policy
file-type-iconecs-deploy-runner-standard-configuration
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconecs-deploy-runner
file-type-icongit-helpers
file-type-icongruntwork-module-circleci-helpers
file-type-iconiam-policies
file-type-iconinfrastructure-deploy-script
file-type-iconinfrastructure-deployer
file-type-iconinstall-jenkins
file-type-iconjenkins-server
file-type-iconkubernetes-circleci-helpers
file-type-iconterraform-helpers
file-type-icontest
file-type-icontestdep
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME-CircleCI.adoc
file-type-iconREADME-Jenkins.adoc
file-type-iconREADME-Terraform-Terragrunt-Pipeline.adoc
file-type-iconREADME-TravisCI.adoc
file-type-iconREADME.adoc
file-type-iconsetup.cfg
EC2 backup

EC2 backup

Snapshot your EC2 instances on a scheduled basis.

Code Preview

Preview the Code

mobile file icon

README.md

down

ECS Deploy Runner Standard Configuration module

This Terraform Module provides a streamlined interface to configure the ecs-deploy-runner module for a standard infrastructure and applications pipeline. This includes:

  • Base pipeline of build image, update variables, deploy infrastructure with Terraform/Terragrunt.
  • Restricting git repos that can deploy infrastructure.
  • Restricting git repos that can build AMIs or Docker images.
  • Restricting parameters that can be provided to underlying scripts

How to use the standard configuration

This module will output a map that can be passed directly into the container_images input variable of the ecs-deploy-runner module. For example:

module "standard_configuration" {
  source = "git::git@github.com:gruntwork-io/module-ci.git//modules/ecs-deploy-runner-standard-configuration?ref=v1.0.8"

  # ... other args omitted for brevity ...
}

module "ecs_deploy_runner" {
  source = "git::git@github.com:gruntwork-io/module-ci.git//modules/ecs-deploy-runner?ref=v1.0.8"

  container_images = module.standard_configuration.container_images

  # ... other args omitted for brevity ...
}

This will configure the ECS deploy runner to setup:

  • An ECS task for building docker images using kaniko.
  • An ECS task for building AMIs using packer.
  • An ECS task for running plan to review infrastructure deployments using terraform and terragrunt.
  • An ECS task for deploying infrastructure using terraform and terragrunt.
  • Container configurations that restrict the arguments you can pass in to the scripts, such as restricting which repos you can deploy infrastructure from. This is derived from the arguments you pass in to this module.

IAM Roles

Each ECS task in the standard configuration will get its own IAM role, leading to a total of four IAM roles in the standard deployment. To ensure that each step only has the minimal permissions necessary, the following IAM permissions are recommended for each container:

docker-image-builder

This task should only have the permissions necessary for building your application Docker images and pushing them to ECR (if using ECR to store images). Note that whatever permission you bind to this IAM role will be available to the Docker context.

ami-builder

This task requires enough permissions for Packer to build AMIs. This typically involves managing a new EC2 instance, including destroying the infrastructure at the end. It is oftentimes necessary to grant full EC2 permissions for packer to function (Allow ec2:* on all resources). Note that this permission will be made available to local actions in the packer template.

terraform-planner

This task requires enough permissions to run plan with terraform and terragrunt. This is typically limited to read only actions, unless you have external data sources that run arbitrary scripts that have side effects. Note that this permission will be made available to external scripts run through terraform and terragrunt. For example, you can call out to the aws CLI from an external data source to perform arbitrary actions against your account. Since all PRs typically go through a plan action, it is recommended to limit the permissions to read only access to your AWS account to limit the damage that can be done by attackers with write access to the repository.

terraform-applier

This task requires permissions necessary to deploy infrastructure terraform and terragrunt, which typically requires admin access. Like the terraform-planner, note that this permission will be made available to external scripts run through terraform and terragrunt. Given the potentially powerful permissions assigned to this container, it is important to restrict deployments to only be allowed from specific Git refs that are protected by external mechanisms (see Github protected branches for more information).

How do I invoke scripts in a given container?

You can use the infrastructure-deployer CLI to invoke a deployed ECS deploy runner. Refer to How do I invoke the ECS deploy runner for more information.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?