config.yml

polling_interval: 30

auto_scaling_groups:
  - name: ag_woshidan_test
    region: ap-northeast-1
    buffer: 1

services:
  - name: woshidan-test-service
    cluster: woshidan-test-cluster
    region: ap-northeast-1
    auto_scaling_group_name: ag_woshidan_test
    step: 3
    idle_time: 120
    max_task_count: [15]
    cooldown_time_for_reach_max: 600
    min_task_count: 3
    upscale_triggers:
      - alarm_name: "TEST ALARM TO TRIGGER UPSCALE"
        state: ALARM
    downscale_triggers:
      - alarm_name: "TEST ALARM TO TRIGGER DOWNSCALE"
        state: ALARM
        step: 6

ecs.tf

resource "aws_ecs_cluster" "woshidan-test-cluster" {
  name = "woshidan-test-cluster"
}

resource "aws_ecs_task_definition" "woshidan_nginx" {
  family = "nginx"

  container_definitions = <<DEFINITION
[
  {
    "cpu": 128,
    "environment": [{
      "name": "SECRET",
      "value": "KEY"
    }],
    "essential": true,
    "image": "nginx:latest",
    "memory": 128,
    "memoryReservation": 64,
    "name": "nginx"
  }
]
DEFINITION
}

resource "aws_ecs_service" "woshidan-test-service" {
  name            = "woshidan-test-service"
  cluster         = "${aws_ecs_cluster.woshidan-test-cluster.id}"
  task_definition = "${aws_ecs_task_definition.woshidan_nginx.arn}"
  desired_count   = 6
}

resource "aws_ecs_task_definition" "woshidan_httpd" {
  family = "httpd"

  container_definitions = <<DEFINITION
[
  {
    "cpu": 128,
    "environment": [{
      "name": "SECRET",
      "value": "KEY"
    }],
    "essential": true,
    "image": "httpd:latest",
    "memory": 128,
    "memoryReservation": 64,
    "name": "httpd"
  }
]
DEFINITION
}

resource "aws_ecs_service" "woshidan-test-service-2" {
  name            = "woshidan-test-service-2"
  cluster         = "${aws_ecs_cluster.woshidan-test-cluster.id}"
  task_definition = "${aws_ecs_task_definition.woshidan_httpd.arn}"
  desired_count   = 6
}

ecs_autoscaler.tf

resource "aws_ecs_cluster" "woshidan-test-cluster-autoscaler" {
  name = "woshidan-test-cluster-autoscaler"
}

resource "aws_iam_role" "woshidan_test_role_autoscaler_task" {
  name = "woshidan_test_role_autoscaler_task"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
       "Action": "sts:AssumeRole",
       "Principal": {
         "Service": "ecs-tasks.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
    }
    ]
}
EOF
}

resource "aws_iam_policy" "woshidan_test_policy_autoscaler_task" {
  name = "woshidan_test_policy_autoscaler_task"
  path = "/"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:Describe*",
        "ecs:List*",
        "ecs:RegisterContainerInstance",
        "ecs:DeregisterContainerInstance",
        "ecs:RunTask",
        "ecs:StopTask",
        "ecs:StartTask",
        "ecs:UpdateContainerInstancesState",
        "ecs:UpdateService",
        "ecs:Submit*",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "ec2:DescribeInstances",
        "ec2:TerminateInstances",
        "autoscaling:Describe*",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:DetachInstances",
        "cloudwatch:DescribeAlarms"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "test-attachment-autoscaler-task" {
  role       = "${aws_iam_role.woshidan_test_role_autoscaler_task.name}"
  policy_arn = "${aws_iam_policy.woshidan_test_policy_autoscaler_task.arn}"
}

// このGist内の config.yml を利用した ecs_autoscaler のイメージを利用
resource "aws_ecs_task_definition" "woshidan_autoscaler" {
  family = "autoscaler"
  task_role_arn = "${aws_iam_role.woshidan_test_role_autoscaler_task.arn}"
  container_definitions = <<DEFINITION
[
  {
    "essential": true,
    "image": "${var.ecr_repo_url}/woshidan/ecs_autoscaler:latest",
    "memoryReservation": 512,
    "name": "autoscaler"
  }
]
DEFINITION
}

resource "aws_ecs_service" "woshidan-test-service-autoscaler" {
  name            = "woshidan-test-service-autoscaler"
  cluster         = "${aws_ecs_cluster.woshidan-test-cluster-autoscaler.id}"
  task_definition = "${aws_ecs_task_definition.woshidan_autoscaler.arn}"
  desired_count   = 1
}

main.tf

provider "aws" {
  access_key = "${var.aws_access_key}"
  secret_key = "${var.aws_secret_key}"
  region     = "ap-northeast-1"
}

resource "aws_key_pair" "auth" {
  key_name   = "${var.key_name}"
  public_key = "${file(var.public_key_path)}"
}

resource "aws_iam_instance_profile" "woshidan_test_iam_instance_profile" {
  name = "woshidan_test_iam_instance_profile"
  role = "${aws_iam_role.woshidan_test_role.name}"
}

resource "aws_launch_template" "woshidan_test_template" {
  name_prefix = "woshidan_test_template"

  image_id = "ami-e4657283"
  instance_type = "t2.micro"
  key_name      = "${aws_key_pair.auth.id}"

  user_data = <<EOF
IyEvYmluL2Jhc2gKZWNobyBFQ1NfQ0xVU1RFUj13b3NoaWRhbi10ZXN0LWNsdXN0
ZXIgPj4gL2V0Yy9lY3MvZWNzLmNvbmZpZw==
EOF

  # https://www.terraform.io/docs/providers/aws/r/instance.html#iam_instance_profile
  iam_instance_profile = {
    arn = "${aws_iam_instance_profile.woshidan_test_iam_instance_profile.arn}"
  }

  vpc_security_group_ids = ["${aws_security_group.woshidan_sample_security_group.id}"]

  tag_specifications {
    resource_type = "instance"
    tags {
      Name = "woshidan_test_template"
    }
  }

  provisioner "local-exec" {
    command = "sleep 10"
  }

  depends_on = ["aws_iam_instance_profile.woshidan_test_iam_instance_profile", "aws_security_group.woshidan_sample_security_group"]
}

resource "aws_autoscaling_group" "ag_woshidan_test" {
  name = "ag_woshidan_test"
  availability_zones = ["ap-northeast-1a"]
  desired_capacity = 6
  max_size = 7
  min_size = 1
  launch_template = {
    id = "${aws_launch_template.woshidan_test_template.id}"
    version = "$$Latest"
  }
}

main_autoscaler.tf

provider "aws" {
  access_key = "${var.aws_access_key}"
  secret_key = "${var.aws_secret_key}"
  region     = "ap-northeast-1"
}

resource "aws_iam_instance_profile" "woshidan_test_iam_instance_profile_autoscaler" {
  name = "woshidan_test_autoscaler_iam_instance_profile"
  role = "${aws_iam_role.woshidan_test_role_autoscaler.name}"
}

data "aws_security_group" "woshidan_sample_security_group" {
  id = "${var.security_group_id}"
}

resource "aws_launch_template" "woshidan_test_template_autoscaler" {
  name_prefix = "woshidan_test_template_autoscaler"

  image_id = "ami-e4657283"
  instance_type = "t2.micro"
  key_name      = "${var.key_name}"

  user_data = <<EOF
IyEvYmluL2Jhc2gKZWNobyBFQ1NfQ0xVU1RFUj13b3NoaWRhbi10ZXN0LWNsdXN0
ZXItYXV0b3NjYWxlciA+PiAvZXRjL2Vjcy9lY3MuY29uZmln
EOF

  # https://www.terraform.io/docs/providers/aws/r/instance.html#iam_instance_profile
  iam_instance_profile = {
      arn = "${aws_iam_instance_profile.woshidan_test_iam_instance_profile_autoscaler.arn}"
  }

  vpc_security_group_ids = ["${data.aws_security_group.woshidan_sample_security_group.id}"]

  tag_specifications {
    resource_type = "instance"
    tags {
      Name = "woshidan_test_template_autoscaler"
    }
  }

  provisioner "local-exec" {
    command = "sleep 10"
  }

  depends_on = ["aws_iam_instance_profile.woshidan_test_iam_instance_profile_autoscaler"]
}

resource "aws_autoscaling_group" "ag_woshidan_test_autoscaler" {
  name = "ag_woshidan_test_autoscaler"
  availability_zones = ["ap-northeast-1a"]
  desired_capacity = 1
  max_size = 2
  min_size = 1
  launch_template = {
    id = "${aws_launch_template.woshidan_test_template_autoscaler.id}"
    version = "$$Latest"
  }
}

role.tf

resource "aws_iam_role" "woshidan_test_role" {
  name = "woshidan_test_role"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
       "Action": "sts:AssumeRole",
       "Principal": {
         "Service": "ec2.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
    }
    ]
}
EOF
}

resource "aws_iam_policy" "woshidan_test_policy" {
  name = "woshidan_test_policy"
  path = "/"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:DeregisterContainerInstance",
        "ecs:DiscoverPollEndpoint",
        "ecs:Poll",
        "ecs:RegisterContainerInstance",
        "ecs:StartTelemetrySession",
        "ecs:UpdateContainerInstancesState",
        "ecs:Submit*",
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "test-attachment" {
  role       = "${aws_iam_role.woshidan_test_role.name}"
  policy_arn = "${aws_iam_policy.woshidan_test_policy.arn}"
}

role_autoscaler.tf

resource "aws_iam_role" "woshidan_test_role_autoscaler" {
  name = "woshidan_test_role_autoscaler"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
       "Action": "sts:AssumeRole",
       "Principal": {
         "Service": "ec2.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
    }
    ]
}
EOF
}

resource "aws_iam_policy" "woshidan_test_policy_autoscaler" {
  name = "woshidan_test_policy_autoscaler"
  path = "/"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:Describe*",
        "ecs:List*",
        "ecs:RegisterContainerInstance",
        "ecs:DiscoverPollEndpoint",
        "ecs:DiscoverPollEndpoint",
        "ecs:Poll",
        "ecs:StartTelemetrySession",
        "ecs:UpdateContainerInstancesState",
        "ecs:Submit*",
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "test-attachment-autoscaler" {
  role       = "${aws_iam_role.woshidan_test_role_autoscaler.name}"
  policy_arn = "${aws_iam_policy.woshidan_test_policy_autoscaler.arn}"
}

security_group.tf

resource "aws_security_group" "woshidan_sample_security_group" {
  name        = "woshidan_sample_security_group"
  description = "Used in the terraform"

  # SSH access from anywhere
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTP access from anywhere
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTPS access from anywhere
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
      from_port = 0
      to_port = 0
      protocol = "-1"
      cidr_blocks = ["0.0.0.0/0"]
  }
}

variables.tf

variable "aws_access_key" {}
variable "aws_secret_key" {}

variable "key_name" {}

variable "public_key_path" {
	description = <<DESCRIPTION
cf. ~/.ssh/terraform.pub
DESCRIPTION
}

variable ecr_repo_url {}

variable security_group_id {}

.
├── ecs_autoscaler
│   ├── ecs_autoscaler.tf
│   ├── main_autoscaler.tf
│   ├── role_autoscaler.tf
│   ├── security_group.tf
│   └── variables.tf
├── main
│   ├── ecs.tf
│   ├── main.tf
│   ├── role.tf
│   ├── security_group.tf
│   └── variables.tf
└── vars.tfvars

cd ./main
terraform apply -var-file=../vars.tfvars

# add security_group_id to vars.tfvars

cd ./ecs_autoscaler
terraform apply -var-file=../vars.tfvars