Skip to main content

Runtime Terraform Module

Overview​

The aws-ecs-runtime Terraform module installs the Upwind runtime components on an Amazon ECS cluster. One module covers EC2, Fargate, and mixed clusters.

It replaces the earlier aws-ecs-sensor and aws-ecs-fargate modules. Use it for new installations. If you already run one of the older modules, see Migrate to the Runtime Terraform Module.

Supported cluster types​

Cluster typeHow the module deploys Upwind
EC2Sensor and scanner run as daemon services on every container instance. The cluster manager runs as an ECS service.
Fargate-onlyYou set cluster_manager.launch_type = "FARGATE" (the default is EC2) and turn off the sensor and scanner daemon services, which need EC2 instances.
MixedEC2 instances run the sensor and scanner daemons. Fargate tasks in the same cluster use the tracer sidecar.
Managed instancesSensor and scanner daemons are created for your ECS managed instances capacity providers through CloudFormation.

What the module deploys​

  • Sensor daemon service. Collects runtime data on each EC2 container instance. Enabled by default.
  • Scanner daemon service. Scans the container images of running tasks on each EC2 container instance. Enabled by default.
  • Cluster manager. An ECS service that coordinates the Upwind components in the cluster. It runs on EC2 by default. When you set the launch type to FARGATE, the tracer sidecar is added to the cluster manager task. It is optional: set cluster_manager.create = false to skip it, or set cluster_manager.create = false together with cluster_manager.domain to use an external cluster manager.
  • Tracer. The module returns the tracer container definition as the tracer output. You add it to the task definitions of Fargate workloads.
  • Secrets. A secret for the Upwind client credentials and a secret for the registry credentials.
  • Registry credentials Lambda. A Lambda function that refreshes the registry credentials secret.
  • IAM roles. The task execution and task roles that the components use. If your pipeline cannot create IAM roles, see pre-created IAM roles.
The module does not create the ECS cluster or its capacity

The module deploys onto an existing ECS cluster. It does not create the cluster or its EC2 instances.

Prerequisites​

  • Terraform >= 1.3.
  • AWS provider hashicorp/aws >= 6.0.
  • Archive provider hashicorp/archive >= 2.0.0.
  • Upwind client credentials (a client ID and a client secret).
  • An existing ECS cluster. You pass its name as ecs_cluster_name.
  • A VPC (vpc_id) and subnets (subnets). These are required only when the module deploys its own cluster manager, which is when cluster_manager.create = true and cluster_manager.domain is empty.

Install​

To install the module, follow the install guide.

Release notes​

For the changes in each module version, see the aws-ecs-runtime release notes.