feat: add API ECS resources

[JoshuaLicense]

Description

Adds the ECS resources for the API.

Related issue: https://dvsa.atlassian.net/browse/VOL-5086

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[github-actions]

Terraform plan for environment: int

Commit: 7b739e1

API version: be6a3c6
Selfserve version: be6a3c6
Internal version: be6a3c6

Plan summary

0 to add, 0 to change, 0 to destroy

---

Show full plan

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform plan for environment: dev

Commit: 7b739e1

API version: be6a3c6
Selfserve version: be6a3c6
Internal version: be6a3c6

Plan summary

15 to add, 0 to change, 0 to destroy

🆕 Creates

module.service.module.ecs_cluster["api"].aws_cloudwatch_log_group.this[0]
module.service.module.ecs_cluster["api"].aws_ecs_cluster.this[0]
module.service.module.ecs_cluster["api"].aws_iam_policy.task_exec[0]
module.service.module.ecs_cluster["api"].aws_iam_role.task_exec[0]
module.service.module.ecs_cluster["api"].aws_iam_role_policy_attachment.task_exec[0]
module.service.module.ecs_service["api"].aws_appautoscaling_policy.this["cpu"]
module.service.module.ecs_service["api"].aws_appautoscaling_policy.this["memory"]
module.service.module.ecs_service["api"].aws_appautoscaling_target.this[0]
module.service.module.ecs_service["api"].aws_ecs_service.this[0]
module.service.module.ecs_service["api"].aws_ecs_task_definition.this[0]
module.service.module.ecs_service["api"].aws_iam_policy.task_exec[0]
module.service.module.ecs_service["api"].aws_iam_role.task_exec[0]
module.service.module.ecs_service["api"].aws_iam_role.tasks[0]
module.service.module.ecs_service["api"].aws_iam_role_policy_attachment.task_exec[0]
module.service.module.ecs_service["api"].module.container_definition["api"].aws_cloudwatch_log_group.this[0]

📖 Reads

module.service.module.ecs_service["api"].data.aws_ecs_task_definition.this[0]

---

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.service.module.ecs_cluster["api"].aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/ecs/vol-app-dev-api-cluster"
      + name_prefix       = (known after apply)
      + retention_in_days = 90
      + skip_destroy      = false
      + tags_all          = (known after apply)
    }

  # module.service.module.ecs_cluster["api"].aws_ecs_cluster.this[0] will be created
  + resource "aws_ecs_cluster" "this" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + name     = "vol-app-dev-api-cluster"
      + tags_all = (known after apply)

      + configuration {
          + execute_command_configuration {
              + logging = "DEFAULT"
            }
        }

      + setting {
          + name  = "containerInsights"
          + value = "enabled"
        }
    }

  # module.service.module.ecs_cluster["api"].aws_iam_policy.task_exec[0] will be created
  + resource "aws_iam_policy" "task_exec" {
      + arn         = (known after apply)
      + description = "Task execution role IAM policy"
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = "vol-app-dev-api-cluster-"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:CreateLogStream",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "Logs"
                    },
                  + {
                      + Action   = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "ECR"
                    },
                  + {
                      + Action   = "ssm:GetParameters"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:*:*:parameter/*"
                      + Sid      = "GetSSMParams"
                    },
                  + {
                      + Action   = "secretsmanager:GetSecretValue"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:secretsmanager:*:*:secret:*"
                      + Sid      = "GetSecrets"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # module.service.module.ecs_cluster["api"].aws_iam_role.task_exec[0] will be created
  + resource "aws_iam_role" "task_exec" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ecs-tasks.amazonaws.com"
                        }
                      + Sid       = "ECSTaskExecutionAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Task execution role for vol-app-dev-api-cluster"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "vol-app-dev-api-cluster-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.service.module.ecs_cluster["api"].aws_iam_role_policy_attachment.task_exec[0] will be created
  + resource "aws_iam_role_policy_attachment" "task_exec" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.service.module.ecs_service["api"].data.aws_ecs_task_definition.this[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_ecs_task_definition" "this" {
      + arn                  = (known after apply)
      + arn_without_revision = (known after apply)
      + execution_role_arn   = (known after apply)
      + family               = (known after apply)
      + id                   = (known after apply)
      + network_mode         = (known after apply)
      + revision             = (known after apply)
      + status               = (known after apply)
      + task_definition      = "vol-app-dev-api-service"
      + task_role_arn        = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_appautoscaling_policy.this["cpu"] will be created
  + resource "aws_appautoscaling_policy" "this" {
      + alarm_arns         = (known after apply)
      + arn                = (known after apply)
      + id                 = (known after apply)
      + name               = "cpu"
      + policy_type        = "TargetTrackingScaling"
      + resource_id        = (known after apply)
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"

      + target_tracking_scaling_policy_configuration {
          + disable_scale_in   = false
          + scale_in_cooldown  = 300
          + scale_out_cooldown = 60
          + target_value       = 75

          + predefined_metric_specification {
              + predefined_metric_type = "ECSServiceAverageCPUUtilization"
            }
        }
    }

  # module.service.module.ecs_service["api"].aws_appautoscaling_policy.this["memory"] will be created
  + resource "aws_appautoscaling_policy" "this" {
      + alarm_arns         = (known after apply)
      + arn                = (known after apply)
      + id                 = (known after apply)
      + name               = "memory"
      + policy_type        = "TargetTrackingScaling"
      + resource_id        = (known after apply)
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"

      + target_tracking_scaling_policy_configuration {
          + disable_scale_in   = false
          + scale_in_cooldown  = 300
          + scale_out_cooldown = 60
          + target_value       = 75

          + predefined_metric_specification {
              + predefined_metric_type = "ECSServiceAverageMemoryUtilization"
            }
        }
    }

  # module.service.module.ecs_service["api"].aws_appautoscaling_target.this[0] will be created
  + resource "aws_appautoscaling_target" "this" {
      + arn                = (known after apply)
      + id                 = (known after apply)
      + max_capacity       = 10
      + min_capacity       = 1
      + resource_id        = (known after apply)
      + role_arn           = (known after apply)
      + scalable_dimension = "ecs:service:DesiredCount"
      + service_namespace  = "ecs"
      + tags_all           = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_ecs_service.this[0] will be created
  + resource "aws_ecs_service" "this" {
      + cluster                            = (known after apply)
      + deployment_maximum_percent         = 200
      + deployment_minimum_healthy_percent = 66
      + desired_count                      = 1
      + enable_ecs_managed_tags            = true
      + enable_execute_command             = false
      + force_new_deployment               = true
      + iam_role                           = (known after apply)
      + id                                 = (known after apply)
      + launch_type                        = "FARGATE"
      + name                               = "vol-app-dev-api-service"
      + platform_version                   = (known after apply)
      + scheduling_strategy                = "REPLICA"
      + tags_all                           = (known after apply)
      + task_definition                    = (known after apply)
      + triggers                           = (known after apply)
      + wait_for_steady_state              = false

      + network_configuration {
          + assign_public_ip = false
          + security_groups  = [
              + "sg-bc4847db",
            ]
          + subnets          = [
              + "subnet-014020d10790169c3",
              + "subnet-076eafebec6c014ea",
              + "subnet-0e0b1b7eaf8d674f3",
            ]
        }

      + timeouts {}
    }

  # module.service.module.ecs_service["api"].aws_ecs_task_definition.this[0] will be created
  + resource "aws_ecs_task_definition" "this" {
      + arn                      = (known after apply)
      + arn_without_revision     = (known after apply)
      + container_definitions    = jsonencode(
            [
              + {
                  + cpu                    = 512
                  + environment            = [
                      + {
                          + name  = "ENVIRONMENT_NAME"
                          + value = "dev"
                        },
                    ]
                  + essential              = true
                  + image                  = "054614622558.dkr.ecr.eu-west-1.amazonaws.com/vol-app/api:latest"
                  + interactive            = false
                  + linuxParameters        = {
                      + initProcessEnabled = false
                    }
                  + logConfiguration       = {
                      + logDriver = "awslogs"
                      + options   = {
                          + awslogs-group         = "/aws/ecs/vol-app-dev-api-service/api"
                          + awslogs-region        = "eu-west-1"
                          + awslogs-stream-prefix = "ecs"
                        }
                    }
                  + memory                 = 1024
                  + memoryReservation      = 100
                  + mountPoints            = []
                  + name                   = "api"
                  + portMappings           = [
                      + {
                          + containerPort = 80
                          + name          = "http"
                          + protocol      = "tcp"
                        },
                    ]
                  + privileged             = false
                  + pseudoTerminal         = false
                  + readonlyRootFilesystem = false
                  + startTimeout           = 30
                  + stopTimeout            = 120
                  + systemControls         = []
                  + user                   = "0"
                  + volumesFrom            = []
                },
            ]
        )
      + cpu                      = "1024"
      + execution_role_arn       = (known after apply)
      + family                   = "vol-app-dev-api-service"
      + id                       = (known after apply)
      + memory                   = "4096"
      + network_mode             = "awsvpc"
      + requires_compatibilities = [
          + "FARGATE",
        ]
      + revision                 = (known after apply)
      + skip_destroy             = false
      + tags_all                 = (known after apply)
      + task_role_arn            = (known after apply)
      + track_latest             = false

      + runtime_platform {
          + cpu_architecture        = "X86_64"
          + operating_system_family = "LINUX"
        }
    }

  # module.service.module.ecs_service["api"].aws_iam_policy.task_exec[0] will be created
  + resource "aws_iam_policy" "task_exec" {
      + arn         = (known after apply)
      + description = "Task execution role IAM policy"
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = "vol-app-dev-api-service-"
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:CreateLogStream",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "Logs"
                    },
                  + {
                      + Action   = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "ECR"
                    },
                  + {
                      + Action   = "ssm:GetParameters"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:*:*:parameter/*"
                      + Sid      = "GetSSMParams"
                    },
                  + {
                      + Action   = "secretsmanager:GetSecretValue"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:secretsmanager:*:*:secret:*"
                      + Sid      = "GetSecrets"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_iam_role.task_exec[0] will be created
  + resource "aws_iam_role" "task_exec" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ecs-tasks.amazonaws.com"
                        }
                      + Sid       = "ECSTaskExecutionAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Task execution role for vol-app-dev-api-service"
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "vol-app-dev-api-service-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_iam_role.tasks[0] will be created
  + resource "aws_iam_role" "tasks" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + ArnLike      = {
                              + "aws:SourceArn" = "arn:aws:ecs:eu-west-1:054614622558:*"
                            }
                          + StringEquals = {
                              + "aws:SourceAccount" = "054614622558"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ecs-tasks.amazonaws.com"
                        }
                      + Sid       = "ECSTasksAssumeRole"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = true
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = "vol-app-dev-api-service-"
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # module.service.module.ecs_service["api"].aws_iam_role_policy_attachment.task_exec[0] will be created
  + resource "aws_iam_role_policy_attachment" "task_exec" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = (known after apply)
    }

  # module.service.module.ecs_service["api"].module.container_definition["api"].aws_cloudwatch_log_group.this[0] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/ecs/vol-app-dev-api-service/api"
      + name_prefix       = (known after apply)
      + retention_in_days = 14
      + skip_destroy      = false
      + tags_all          = (known after apply)
    }

Plan: 15 to add, 0 to change, 0 to destroy.

[clorro]

initial code looks good to me