Skip to content

ECS Fargate

Runs your application as a Docker container. ECS Fargate manages the underlying compute, so you only define the container image, memory, and CPU. BYM runs Fargate services inside the private network with access to shared databases, secrets, and monitoring.

Byks guides

GitHub actions

Terraform configuration

Each entry in the ecs_services map deploys one container behind the shared ALB. The map key becomes the service name and the default hostname, for example kattehotell becomes kattehotell.test.bymoslo.net.

main.tf
module "application" {
  source = "git@github.com:BYM-IKT/terraform-byks-module.git?ref=v12"
  # ...

  ecs_services = {
    kattehotell = {
      # options go here
    }
  }
}

Options

Option Type Default Description
ecr_uri string required URI of the ECR repository the container image is pulled from.
image_tag string required Tag of the image to deploy.
port number required Port the container listens on. Used for the ALB target group and health check.
cpu number 512 CPU units allocated to the task.
memory number 1024 Memory, in MB, allocated to the task.
desired_count number 1 Number of task instances to run.
log_group_retention number 30 Days to keep the service's CloudWatch log group.
minimum_healthy_percent number 100 Minimum percentage of desired_count that must stay healthy during a deployment.
maximum_healthy_percent number 200 Maximum percentage of desired_count that can run during a deployment.
alarm_topic_arn string null Not currently applied. Use the module's top-level alarm_topic_arn input instead.
container_sgs map(string) {} Extra security group IDs attached to the container, keyed by an arbitrary identifier.
ssm_secrets map(string) {} SSM parameter ARNs injected as container secrets. Map key is the environment variable name, value is the parameter ARN.
secretsmanager_secrets map(string) {} Secrets Manager secret ARNs injected as container secrets. Map key is the environment variable name, value is the secret ARN.
environment_variables map(string) {} Plain-text environment variables passed to the container.
readonly_root_filesystem bool true Mount the container's root filesystem as read-only.
healthcheck_url string "/api/healthcheck" Path the ALB target group calls to check container health.
additional_task_policies map(string) {} Extra IAM policy ARNs attached to the task role and task execution role, keyed by an arbitrary identifier.
enable_observability bool false Deploy the OTEL Collector sidecar and send traces, metrics, and logs to Datadog. See Instrumenting ECS Fargate Services.
enable_custom_metrics bool false Collect custom application metrics through the OTEL Collector. Only relevant when enable_observability is true.
override_hostname string null Custom hostname, instead of the generated default, which is the map key.
override_target_group_name_suffix string null Custom suffix for the ALB target group name, instead of the generated default <port>-tcp.
override_log_group_name string null Custom CloudWatch log group name, instead of the generated default /ecs/<environment>/<key>.
override_secrets_prefix string null Not currently applied.
override_ssm_prefix string null Not currently applied.
override_opensearch_url_env_var_name string "OpenSearch__Url" Name of the environment variable that receives the OpenSearch endpoint URL, when opensearch_config is set.
override_alarms object see below Override the default CloudWatch alarm thresholds. See Override alarms object.
additional_domains list(object) [] Extra domains that route to the same service. See Extra domain object.
override_alb_listener_rules object {} Override the generated ALB host header rule. See Override ALB listener rules object.

Override alarms object

Used in override_alarms.

Option Type Default Description
errors_4xx_threshold_percent number 50 Percentage of 4xx responses that triggers an alarm. Set high by default to avoid false positives from REST APIs.
errors_5xx_threshold_percent number 10 Percentage of 5xx responses that triggers an alarm.
cpu_utilization_threshold number 95 CPU usage percentage that triggers an alarm.
memory_utilization_threshold number 95 Memory usage percentage that triggers an alarm.
enable_anomaly_monitoring bool false Use anomaly detection instead of static thresholds for request volume.
service_log_errors number 1 Number of error-level log entries within the alarm period that triggers an alarm.
service_log_warnings number 10 Number of warning-level log entries within the alarm period that triggers an alarm.
alb_total_request_minimum number 3000 Minimum requests per period before request-based alarms activate.

Extra domain object

Used in additional_domains.

Option Type Default Description
domain_name string required Domain to route to this service.
zone_name string required Route53 hosted zone the DNS record is created in.
create_dns_record bool true Set to false if the DNS record already exists outside Route53.

Override ALB listener rules object

Used in override_alb_listener_rules.

Option Type Default Description
host_headers list(string) generated from the map key and additional_domains Custom host headers for the ALB listener rule, instead of the generated default.

Resources