Terraform changes to use existing VPC

terraform/ghg-features-api-shared-vpc/.gitignore

@@ -0,0 +1,3 @@
+*.tfstate
+.terraform
+*.zip

terraform/ghg-features-api-shared-vpc/dns.tf

@@ -0,0 +1,34 @@
+data "aws_route53_zone" "zone" {
+  provider = aws.west2
+  name     = var.dns_zone_name
+}
+
+resource "aws_acm_certificate" "cert" {
+  provider          = aws.west2
+  domain_name       = "*.${data.aws_route53_zone.zone.name}"
+  validation_method = "DNS"
+  tags              = var.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_route53_record" "subdomain_record" {
+  provider = aws.west2
+  name     = "${var.dns_subdomain}.${data.aws_route53_zone.zone.name}"
+  zone_id  = data.aws_route53_zone.zone.id
+  type     = "A"
+
+  alias {
+    name                   = aws_alb.alb_ecs.dns_name
+    zone_id                = aws_alb.alb_ecs.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_lb_listener_certificate" "cert" {
+  provider        = aws.west2
+  listener_arn    = aws_alb_listener.alb_listener_ecs.arn
+  certificate_arn = aws_acm_certificate.cert.arn
+}

terraform/ghg-features-api-shared-vpc/ecr.tf

@@ -0,0 +1,10 @@
+module "ecr_registry" {
+  source                   = "github.com/developmentseed/tf-seed/modules/aws_ecr"
+  environment              = var.env
+  registry_name            = var.project_name
+  enable_registry_scanning = true
+  mutable_image_tags       = true
+  enable_deploy_user       = true
+  iam_deploy_username      = aws_iam_user.deploy_user.name
+  tags                     = var.tags
+}

terraform/ghg-features-api-shared-vpc/ecs_api.tf

@@ -0,0 +1,133 @@
+data "aws_subnets" "private" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+
+  tags = {
+    "aws-cdk:subnet-name" = "private"
+  }
+}
+
+module "ecs_cluster" {
+  source      = "../modules/aws_ecs_service"
+  environment = var.env
+  region      = var.region
+  vpc_id      = var.vpc_id
+  subnet_ids  = data.aws_subnets.private.ids
+
+  service_name       = "${var.project_name}-service"
+  service_port       = var.service_port
+  service_protocol   = "tcp"
+  cpu                = 2048
+  memory             = 4096
+  instance_count     = 1
+  log_retention_days = 60
+
+  container_command           = ["/bin/bash", "startup.sh"]
+  container_working_directory = "/tmp/"
+
+  container_secrets = [
+    {
+      name      = "AWS_CONFIG"
+      valueFrom = aws_secretsmanager_secret.config.arn
+    },
+    {
+      name      = "DB_CONFIG"
+      valueFrom = aws_secretsmanager_secret.db_config.arn
+    },
+  ]
+
+  container_environment = [
+    {
+      name  = "ENVIRONMENT"
+      value = var.env
+    },
+    {
+      name  = "IS_ECS"
+      value = "True"
+    },
+    {
+      name  = "OTEL_PROPAGATORS"
+      value = "xray"
+    },
+    {
+      name  = "OTEL_PYTHON_ID_GENERATOR"
+      value = "xray"
+    },
+    {
+      name  = "OTEL_RESOURCE_ATTRIBUTES"
+      value = "service.name=veda-wfs3-${var.env}"
+    },
+    {
+      name  = "OTEL_RESOURCE_ATTRIBUTES"
+      value = "service.name=veda-wfs3-${var.env}"
+    },
+    {
+      name  = "OTEL_TRACES_SAMPLER"
+      value = "traceidratio"
+    },
+    {
+      name  = "OTEL_TRACES_SAMPLER_ARG"
+      value = "0.5"
+    },
+    {
+      name  = "FORWARDED_ALLOW_IPS"
+      value = "*"
+    },
+    {
+      // stupid hack b/c of FastAPI and Starlette bug
+      name  = "FAST_API_SCHEME"
+      value = var.env == "dev" ? "https" : "http" //quick hack for now, TODO: include 'contains' function
+    }
+  ]
+
+  container_ingress_cidrs  = ["0.0.0.0/0"]
+  container_ingress_sg_ids = []
+
+  use_adot_as_sidecar = false
+  use_ecr             = true
+  ecr_repository_name = module.ecr_registry.registry_name
+  ecr_repository_arn  = module.ecr_registry.registry_arn
+  image               = "${module.ecr_registry.repository_url}:latest"
+
+  load_balancer        = true
+  lb_type              = "application"
+  lb_target_group_arn  = aws_alb_target_group.alb_target_group.arn
+  lb_security_group_id = aws_security_group.web_inbound_sg.id
+  lb_container_port    = var.service_port
+
+  tags = var.tags
+}
+
+##############################################################
+# The ECS task execution role represented by the output
+# `module.ecs_cluster.ecs_execution_role_id`
+# requires additional policies depending on what it needs
+# to access in AWS. Hence the attachments below
+##############################################################
+
+##############################################################
+# give acess to AWS secret manager to access
+# `container_secrets` pumped into the task above
+#
+data "aws_iam_policy_document" "api_ecs_execution_attachment" {
+  statement {
+    actions = [
+      "secretsmanager:DescribeSecret",
+      "secretsmanager:GetSecretValue",
+      "kms:Decrypt",
+    ]
+
+    resources = [
+      aws_secretsmanager_secret.config.arn,
+      aws_secretsmanager_secret.db_config.arn
+    ]
+  }
+}
+
+resource "aws_iam_role_policy" "api_ecs_execution_role_policy" {
+  name   = "${var.project_name}-api-access-secret-manager"
+  role   = module.ecs_cluster.ecs_execution_role_id
+  policy = data.aws_iam_policy_document.api_ecs_execution_attachment.json
+}

terraform/ghg-features-api-shared-vpc/github_deploy_user.tf

@@ -0,0 +1,32 @@
+resource "aws_iam_user" "deploy_user" {
+  name = "veda-wfs3-${var.env}-deploy-user"
+  path = "/"
+  tags = var.tags
+}
+
+// NOTE: we need to have extra policies added to our
+// deploy user for Github AWS Actions to work
+resource "aws_iam_user_policy" "deploy" {
+  name   = "${var.registry_name}_deploy_extended"
+  user   = aws_iam_user.deploy_user.name
+  policy = data.aws_iam_policy_document.extended_deploy.json
+}
+
+data "aws_iam_policy_document" "extended_deploy" {
+  statement {
+    actions = [
+      "iam:PassRole",
+      "ecr:InitiateLayerUpload",
+      "ecs:RegisterTaskDefinition",
+      "ecs:DescribeServices",
+      "ecs:UpdateService",
+    ]
+
+    resources = [
+      module.ecr_registry.registry_arn,
+      module.ecs_cluster.service_cluster_arn,
+      module.ecs_cluster.service_arn,
+      module.ecs_cluster.ecs_execution_role_arn,
+    ]
+  }
+}

terraform/ghg-features-api-shared-vpc/init.tf

@@ -0,0 +1,24 @@
+provider "aws" {
+  alias  = "west1"
+  region = "us-west-1"
+}
+
+provider "aws" {
+  alias  = "west2"
+  region = "us-west-2"
+}
+
+terraform {
+  required_version = "1.3.9"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.0"
+    }
+  }
+  backend "s3" {
+    bucket = "ghg-wfs3-tf-state-bucket"
+    key    = "root"
+    region = "us-west-2"
+  }
+}