Tracer

Overview

The tracer runs as a sidecar container. Fargate tasks cannot run the sensor daemon, so each Fargate workload uses the tracer instead. The module also adds the tracer to the cluster manager task when cluster_manager.launch_type is FARGATE.

The module returns the tracer container definition, its entrypoint, and its environment variables as the tracer output. To add it to your task definitions, see Add the tracer to your workloads.

Variables

The tracer variable configures the image and environment of the sidecar.

Attribute	Type	Default	Description
image.registry	string	"public.ecr.aws/upwindsecurity"	The image registry.
image.repository	string	"images/tracer"	The image repository.
image.tag	string	"0.10.0"	The image tag.
image.requires_auth	bool	derived	Whether the image pull uses the registry credentials.
extra_env	map(string)	{}	Extra environment variables. They are added to tracer.env.

When you leave image.requires_auth unset, the module attaches registry credentials only if the registry starts with registry.upwind.. The default public ECR registry needs no credentials, and a private ECR repository in the same account is authorized by the task execution role. Registry credentials are never attached when credentials.registry_auth_enabled is false.

Example

Pull the tracer from your own ECR repository and add an environment variable:

module "upwind_ecs_runtime" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-1.5.1.tar.gz"

  ecs_cluster_name = "my-ecs-cluster"
  vpc_id           = "vpc-0123456789abcdef0"
  subnets          = ["subnet-0123456789abcdef0", "subnet-0fedcba9876543210"]

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }

  sensor  = { enabled = false }
  scanner = { enabled = false }

  cluster_manager = { launch_type = "FARGATE" }

  tracer = {
    image = {
      registry = "111122223333.dkr.ecr.us-east-1.amazonaws.com"
    }

    extra_env = {
      EXAMPLE_VARIABLE = "value"
    }
  }
}