Cadence on ECS / NLB

config.tf

resource "aws_service_discovery_service" "cadence_dc1" {
  name = "cadence"

  dns_config {
    namespace_id = data.aws_service_discovery_dns_namespace.dc1.id

    dns_records {
      ttl  = 10
      type = "A"
    }

    routing_policy = "MULTIVALUE"
  }
}

resource "aws_ecs_service" "cadence_dc1" {
  name            = local.cadence_dc1_name
  cluster         = module.dc1.ecs_cluster.arn
  task_definition = module.cadence_dc1.task_definition_arn
  desired_count   = 1
  network_configuration {
    subnets = module.dc1.private_subnets
  }
  launch_type    = "FARGATE"
  propagate_tags = "TASK_DEFINITION"
  load_balancer {
    target_group_arn = aws_lb_target_group.cadence_dc1_tc.arn
    container_name   = "cadence"
    container_port   = 7933
  }
  load_balancer {
    target_group_arn = aws_lb_target_group.cadence_dc1_grpc.arn
    container_name   = "cadence"
    container_port   = 7833
  }
  enable_execute_command = true

  service_registries {
    registry_arn = aws_service_discovery_service.cadence_dc1.arn
  }
}

resource "aws_lb" "cadence_dc1" {
  name               = local.cadence_dc1_name
  internal           = false
  load_balancer_type = "network"
  security_groups    = [aws_security_group.cadence_dc1_nlb.id]
  subnets            = module.dc1.public_subnets
}

resource "aws_security_group" "cadence_dc1_nlb" {
  name   = "${local.cadence_dc1_name}-nlb"
  vpc_id = module.dc1_vpc.vpc_id

  ingress {
    description = "Access to Cadence tchannel"
    from_port   = 7933
    to_port     = 7933
    protocol    = "tcp"
    cidr_blocks = ["${var.lb_ingress_ip}/32"]
  }

  ingress {
    description = "Access to Cadence grpc"
    from_port   = 7833
    to_port     = 7833
    protocol    = "tcp"
    cidr_blocks = ["${var.lb_ingress_ip}/32"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group_rule" "ingress_from_client_nlb_to_ecs" {
  type                     = "ingress"
  from_port                = 0
  to_port                  = 65535
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.cadence_dc1_nlb.id
  security_group_id        = module.dc1_vpc.default_security_group_id
}

resource "aws_lb_target_group" "cadence_dc1_tc" {
  name        = local.cadence_dc1_name
  port        = 7933
  protocol    = "TCP"
  vpc_id      = module.dc1_vpc.vpc_id
  target_type = "ip"
}

resource "aws_lb_listener" "cadence_dc1_tc" {
  load_balancer_arn = aws_lb.cadence_dc1.arn
  port              = "7933"
  protocol          = "TCP"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.cadence_dc1_tc.arn
  }
}

resource "aws_lb_target_group" "cadence_dc1_grpc" {
  name        = "${local.cadence_dc1_name}-grpc"
  port        = 7833
  protocol    = "TCP"
  vpc_id      = module.dc1_vpc.vpc_id
  target_type = "ip"
}

resource "aws_lb_listener" "cadence_dc1_grpc" {
  load_balancer_arn = aws_lb.cadence_dc1.arn
  port              = "7833"
  protocol          = "TCP"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.cadence_dc1_grpc.arn
  }
}