Resources the Runtime Terraform Module creates
Overview
This page lists the AWS resources the aws-ecs-runtime module creates in your account. Use it to review a plan, to scope IAM permissions for the pipeline that applies the module, or to find a resource in the AWS console.
With the default settings the module creates 30 resources. It creates 2 more when you deploy on managed instances. The module deploys onto an existing ECS cluster. It does not create the cluster, its instances, or its capacity providers.
In the names below, <cluster> is the value of ecs_cluster_name. A name that ends in * is a prefix that AWS completes with a random suffix.
For a diagram of how these resources connect, see How the components connect.
Resources by component
Upwind credentials
| Resource | Name | Notes |
|---|
aws_secretsmanager_secret.this | upwind-sensor-* | Holds your client ID and client secret. |
aws_secretsmanager_secret_version.this | | The client ID and client secret values. |
aws_secretsmanager_secret.upwind_registry_credentials | upwind-registry-* | Holds the registry token the Lambda writes. |
Registry credential rotation
| Resource | Name | Notes |
|---|
archive_file.lambda | | Packages the Lambda code that ships with the module. |
aws_lambda_function.registry_credentials_loader | UWRegCred-<cluster> | Python 3.12, 30 second timeout. |
aws_lambda_invocation.generate_registry_credentials | | Runs the Lambda once during apply. |
aws_lambda_permission.allow_eventbridge | | Lets EventBridge invoke the Lambda. |
aws_cloudwatch_event_rule.regenerate_registry_credentials | regen-registry-creds-* | rate(1 hour). |
aws_cloudwatch_event_target.regenerate_registry_credentials_target | | Targets the Lambda. |
Cluster manager
| Resource | Name | Notes |
|---|
aws_ecs_task_definition.cluster_manager | <cluster>-upwind-cluster-manager | awsvpc network mode. |
aws_ecs_service.cluster_manager | upwind-cluster-manager | One replica by default. |
aws_security_group.cluster_manager_traffic | cluster-manager-traffic-* | |
aws_vpc_security_group_ingress_rule.cluster_manager_allow_grpc_ipv4 | | TCP 8082, gRPC. |
aws_vpc_security_group_ingress_rule.cluster_manager_allow_tls_grpc_ipv4 | | TCP 8444, TLS gRPC. |
aws_vpc_security_group_egress_rule.cluster_manager_allow_traffic_ipv4 | | All outbound traffic. |
aws_service_discovery_private_dns_namespace.this | upwind-<cluster>.private | Not created when you pass an existing namespace. |
aws_service_discovery_service.this | upwind-cluster-manager | |
Sensor and scanner
The sensor and the scanner each get the same set of resources.
| Resource | Name | Notes |
|---|
aws_ecs_task_definition.sensor, aws_ecs_task_definition.scanner | <cluster>-upwind-sensor, <cluster>-upwind-scanner | host network mode. |
aws_ecs_service.sensor, aws_ecs_service.scanner | upwind-sensor, upwind-scanner | Daemon services on your EC2 container instances. They skip managed instances. |
aws_cloudformation_stack.sensor_daemon, aws_cloudformation_stack.scanner_daemon | <cluster>-upwind-sensor-daemon, <cluster>-upwind-scanner-daemon | Managed instances only. Each stack holds an AWS::ECS::DaemonTaskDefinition and an AWS::ECS::Daemon. |
IAM
These come from the module's nested iam module. To use roles you create yourself, see Pre-created IAM roles.
| Resource | Name | Notes |
|---|
aws_iam_role.task_execution | upwind-task-execution-* | Used by all Upwind tasks to pull images and read the secrets. |
aws_iam_role_policy_attachment.task_execution | | AmazonECSTaskExecutionRolePolicy. |
aws_iam_role_policy.task_execution_credentials | sensorCredentials | Reads the two Upwind secrets. |
aws_iam_role.cluster_manager_task | upwind-cluster-manager-task-* | Task role for the cluster manager. |
aws_iam_role_policy.describe_tasks | describeTasks | Lets the cluster manager describe ECS tasks. |
aws_iam_role.lambda | upwind-credentials-loader-* | Role for the registry credentials Lambda. |
aws_iam_role_policy.manage_registry_credentials | registryCredentials | Reads the client credentials and writes the registry token. |
aws_iam_role_policy_attachment.lambda_execution | | AWSLambdaBasicExecutionRole. |
Logging
| Resource | Name | Notes |
|---|
aws_cloudwatch_log_group.logs | /aws/ecs/upwind/<cluster> | One day retention by default. |
Change what the module creates
| Setting | Effect |
|---|
credentials.secret_arn | Uses your existing client credentials secret. The module does not create the secret or its version. See Credentials and secrets. |
credentials.registry_secret_arn or credentials.registry_auth_enabled = false | No registry secret, Lambda, EventBridge rule, or Lambda IAM role. |
iam_roles | Uses your pre-created roles. The module creates no IAM resources. |
cluster_manager.create = false | No cluster manager service, task definition, security group, Cloud Map resources, or cluster manager task role. |
sensor.enabled = false, scanner.enabled = false | Skips that component's task definition, daemon service, and managed daemon stack. |
logging.log_configuration or logging.cloudwatch_log_group.enabled = false | No log group. See Logging. |
managed_instances_capacity_provider_names | Adds the managed daemon stacks for the sensor and scanner. |
cluster_manager.service_discovery.use_internal_lb = true | Puts the cluster manager behind an internal Network Load Balancer instead of Cloud Map. Adds the load balancer, plus a target group and a listener for each of 8082 and 8444. Removes the Cloud Map namespace and service. Net 3 more resources. |
cluster_manager.privatelink | Requires the internal load balancer. Adds a VPC endpoint service in front of it, so 1 more resource. See PrivateLink. |