services.tf

# https://github.com/alex/ecs-terraform/blob/master/policies/ecs-service-role-policy.json

resource "aws_iam_role" "ecs_service_role" {
  name               = "ecs_service_role"
  assume_role_policy = "${file("policies/ecs-role.json")}"
}

resource "aws_iam_role_policy" "ecs_service_role_policy" {
  name   = "ecs_service_role_policy"
  policy = "${file("policies/ecs-service-role-policy.json")}"
  role   = "${aws_iam_role.ecs_service_role.id}"
}

resource "aws_security_group" "load_balancers" {
  name        = "${var.client}-${var.environment}-load_balancers"
  description = "Allows all HTTP/HTTPS traffic"
  vpc_id      = "${module.network.vpc_id}"

  # HTTP access from anywhere
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTPS access from anywhere
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Outbound internet access
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags {
    Name        = "${var.client}-${var.environment}-elb-ecs"
    Client      = "${var.client}"
    Environment = "${var.environment}"
  }
}

/*
* A simple nginx demo service
*/

/*
resource "aws_elb" "nginx-demo" {
  name            = "nginx-http"
  security_groups = ["${aws_security_group.load_balancers.id}"]
  # subnets         = ["${element(split(",", module.network.private_subnet_ids), 0)}"]

  listener {
    lb_protocol       = "http"
    lb_port           = 80
    instance_protocol = "http"
    instance_port     = 80
  }

  health_check {
    healthy_threshold   = 2
    unhealthy_threshold = 2
    timeout             = 3
    target              = "TCP:80"
    interval            = 30
  }

  cross_zone_load_balancing   = true
  idle_timeout                = 400
  connection_draining         = true
  connection_draining_timeout = 400
  internal                    = true
}
*/

resource "aws_alb" "front" {
  name            = "front-alb-ecs"
  subnets         = ["${split(",", module.network.public_subnet_ids)}"]
  security_groups = ["${aws_security_group.load_balancers.id}","${module.bastion.sg_default_id}"]
}

resource "aws_alb_target_group" "nginx-demo" {
  name     = "nginx-demo"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "${module.network.vpc_id}"
}

resource "aws_alb_listener" "front_end" {
  load_balancer_arn = "${aws_alb.front.id}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    target_group_arn = "${aws_alb_target_group.nginx-demo.id}"
    type             = "forward"
  }
}

resource "aws_ecs_task_definition" "nginx-demo" {
  family                = "nginx-demo"
  container_definitions = "${file("${path.module}/task-definitions/nginx-demo.json")}"

  volume {
    name      = "webdata"
    host_path = "/ecs/webdata"
  }
}

resource "aws_ecs_service" "nginx-demo" {
  name            = "nginx-demo"
  cluster         = "${var.ecs_cluster}-${var.client}-${var.environment}"
  task_definition = "${aws_ecs_task_definition.nginx-demo.arn}"
  desired_count   = "1"
  iam_role        = "${aws_iam_role.ecs_service_role.arn}"
  depends_on      = ["aws_iam_role_policy.ecs_service_role_policy"]

  load_balancer {
    target_group_arn = "${aws_alb_target_group.nginx-demo.id}"
    container_name   = "nginx-demo"
    container_port   = "80"
  }

}