Terraform ECS log router fluentbit to Grafana Cloud Loki

main.tf

# https://registry.terraform.io/modules/terraform-aws-modules/ecs/aws/latest
# aws ecs module definitions
# ...
container_definitions = {
  "log-router" = {
    image     = "public.ecr.aws/aws-observability/aws-for-fluent-bit:stable"
    essential = true
    cpu       = "128"
    memory    = "128"

    memory_reservation       = 50
    readonly_root_filesystem = false

    firelens_configuration = {
      type = "fluentbit"
      options = {
        enable-ecs-log-metadata = "true"
      }
    }
  }

  "my-web-app" = {
    image     = "traefik/whoami:latest"
    command   = ["--verbose"]
    essential = true
    cpu       = "384"
    memory    = "896"

    environment = [
      {
        name  = "WHOAMI_PORT_NUMBER"
        value = "80"
      },
      {
        name  = "WHOAMI_NAME"
        value = "my-web-app"
      }
    ]

    port_mappings = [
      {
        name          = "http"
        containerPort = 80
        protocol      = "tcp"
      },
    ]

    dependencies = [{
      containerName = "log-router"
      condition     = "START"
    }]

    log_configuration = {
      logDriver = "awsfirelens"
      options = {
        Name         = "loki"
        Host         = "logs-prod-006.grafana.net"
        port         = "443"
        "tls"        = "on"
        "tls.verify" = "on"
        labels       = "job=firelens,enviroment=${local.environment}"
        label_keys   = "$container_name,$ecs_task_definition,$source,$ecs_cluster"
        remove_keys  = "$container_id,$ecs_task_arn"
        line_format  = "key_value"
      }
      secretOptions = [
        {
          name      = "http_user"
          valueFrom = "arn:aws:ssm:us-west-2:12345678910:parameter/loki/http_user"
        },
        {
          name      = "http_passwd"
          valueFrom = "arn:aws:ssm:us-west-2:12345678910:parameter/loki/http_passwd"
        }
      ]
    }
  }
}