Fargate deployment

.github/workflows/ecrpush.yaml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+  workflow_dispatch:
+
 
 jobs:
   build:

api/Dockerfile

@@ -7,4 +7,5 @@ RUN mvn clean package
 FROM openjdk:17-jdk-slim
 WORKDIR /app
 COPY --from=MAVEN_BUILD /build/target/observation-tracker-RELEASE.jar /app/
+EXPOSE 8080
 ENTRYPOINT ["java", "-jar","/app/observation-tracker-RELEASE.jar"]

api/pom.xml

@@ -52,6 +52,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-amqp</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>

api/src/main/resources/config/application.properties

@@ -1,3 +1,4 @@
 spring.application.name=observation-tracker
 spring.profiles.active=prod
 
+management.endpoint.health.show-details=always

infrastructure/ecr_alb.tf

@@ -0,0 +1,49 @@
+resource "aws_lb_target_group" "observation_tracker_lb_target" {
+  name        = "observation-tracker-api"
+  port        = 8080
+  protocol    = "HTTP"
+  target_type = "ip"
+  vpc_id      = aws_vpc.vpc.id
+
+  health_check {
+    enabled = true
+    path    = "/actuator/health/db"
+    matcher = "200"
+  }
+
+  depends_on = [aws_alb.observation_tracker_api_alb]
+}
+
+resource "aws_alb" "observation_tracker_api_alb" {
+  name               = "observation-tracker-api-alb"
+  internal           = false
+  load_balancer_type = "application"
+
+  subnets = [
+    aws_subnet.public_a.id,
+    aws_subnet.public_b.id,
+  ]
+
+  security_groups = [
+    aws_security_group.http.id,
+    aws_security_group.https.id,
+    aws_security_group.egress_all.id,
+  ]
+
+  depends_on = [aws_internet_gateway.internet_gateway]
+}
+
+resource "aws_alb_listener" "observation_tracker_api_http" {
+  load_balancer_arn = aws_alb.observation_tracker_api_alb.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.observation_tracker_lb_target.arn
+  }
+}
+
+output "alb_url" {
+  value = "http://${aws_alb.observation_tracker_api_alb.dns_name}"
+}

infrastructure/ecs.tf

@@ -0,0 +1,69 @@
+resource "aws_ecs_cluster" "observation_tracker_cluster" {
+  name = "observation_tracker_api_cluster"
+}
+
+# Provisioned only in private subnets, accessible through the LB
+resource "aws_ecs_service" "observation_tracker_api" {
+  name            = "observation_tracker_api_service"
+  cluster         = aws_ecs_cluster.observation_tracker_cluster.arn
+  task_definition = aws_ecs_task_definition.observation_tracker_api_task.arn
+  launch_type     = "FARGATE"
+  desired_count   = 1
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.observation_tracker_lb_target.arn
+    container_name   = "observation_tracker_api"
+    container_port   = "8080"
+  }
+
+  network_configuration {
+    assign_public_ip = false
+
+    security_groups = [
+      aws_security_group.egress_all.id,
+      aws_security_group.ingress_api.id,
+    ]
+
+    subnets = [
+      aws_subnet.private_b.id,
+      aws_subnet.private_a.id,
+    ]
+  }
+}
+
+# Uses ECR image pushed through Actions
+resource "aws_ecs_task_definition" "observation_tracker_api_task" {
+  family             = "observation_tracker_api_task"
+  execution_role_arn = aws_iam_role.ecs_execution_role.arn
+  task_role_arn      = aws_iam_role.ecs_task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name : "observation_tracker_api",
+      image : "${aws_ecrpublic_repository.observation-tracker-docker-repo.repository_uri}:latest",
+      portMappings : [
+        {
+          "containerPort" : 8080
+        }
+      ],
+      logConfiguration : {
+        "logDriver" : "awslogs",
+        "options" : {
+          "awslogs-region" : "us-east-1",
+          "awslogs-group" : "/ecs/observation_tracker_api",
+          "awslogs-stream-prefix" : "ecs"
+        }
+      }
+    }
+  ] )
+
+  cpu                      = 2048
+  memory                   = 4096
+  requires_compatibilities = ["FARGATE"]
+
+  network_mode = "awsvpc"
+}
+
+resource "aws_cloudwatch_log_group" "observation_tracker_api" {
+  name = "/ecs/observation_tracker_api"
+}

infrastructure/ecs_iam.tf

@@ -0,0 +1,78 @@
+data "aws_iam_policy_document" "ecs_task_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+# Create a role for the ECS task to use while executing
+resource "aws_iam_role" "ecs_execution_role" {
+  name               = "ecs_task_execution_role"
+  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume_role.json
+}
+
+resource "aws_iam_policy" "ecs_execution_policy" {
+  name   = "ecs-task-execution-policy"
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "ecr:GetAuthorizationToken",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        "Resource" : "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_execution_role" {
+  role       = aws_iam_role.ecs_execution_role.name
+  policy_arn = aws_iam_policy.ecs_execution_policy.arn
+}
+
+
+# Create a role for the ECS task to interact with other services
+resource "aws_iam_role" "ecs_task_role" {
+  name               = "ecs-task-role"
+  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume_role.json
+}
+
+resource "aws_iam_policy" "ecs_task_policy" {
+  name        = "ecs-task-policy"
+  policy      = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "rds:*",
+          "ecr:*",
+          "s3:*",
+          "lambda:*",
+          "logs:*",
+          "cloudwatch:*",
+          "ssm:GetParameter",
+          "ssm:GetParameters",
+          "ssm:GetParametersByPath"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_policy_attachment" {
+  role       = aws_iam_role.ecs_task_role.name
+  policy_arn = aws_iam_policy.ecs_task_policy.arn
+}

infrastructure/ecs_network.tf

@@ -0,0 +1,162 @@
+resource "aws_vpc" "vpc" {
+  cidr_block = "10.0.0.0/16"
+}
+
+# Public and private subnets in 1a and 1b AZs
+resource "aws_subnet" "public_a" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.1.0/25"
+  availability_zone = "us-east-1a"
+
+  tags = {
+    "Name" = "public | us-east-1a"
+  }
+}
+
+resource "aws_subnet" "private_a" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.2.0/25"
+  availability_zone = "us-east-1a"
+
+  tags = {
+    "Name" = "private | us-east-1a"
+  }
+}
+
+resource "aws_subnet" "public_b" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.1.128/25"
+  availability_zone = "us-east-1b"
+
+  tags = {
+    "Name" = "public | us-east-1b"
+  }
+}
+
+resource "aws_subnet" "private_b" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.2.128/25"
+  availability_zone = "us-east-1b"
+
+  tags = {
+    "Name" = "private | us-east-1b"
+  }
+}
+
+# Public and private route tables for the ELB and ECS cluster
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.vpc.id
+  tags = {
+    "Name" = "public"
+  }
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.vpc.id
+  tags = {
+    "Name" = "private"
+  }
+}
+
+# Adding subnets to their respective route tables
+resource "aws_route_table_association" "public_a_subnet" {
+  subnet_id      = aws_subnet.public_a.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "private_a_subnet" {
+  subnet_id      = aws_subnet.private_a.id
+  route_table_id = aws_route_table.private.id
+}
+
+resource "aws_route_table_association" "public_b_subnet" {
+  subnet_id      = aws_subnet.public_b.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "private_b_subnet" {
+  subnet_id      = aws_subnet.private_b.id
+  route_table_id = aws_route_table.private.id
+}
+
+resource "aws_eip" "nat" {
+  vpc = true
+}
+
+# IGW to let public traffic in
+resource "aws_internet_gateway" "internet_gateway" {
+  vpc_id = aws_vpc.vpc.id
+}
+
+# NGW to let traffic into private subnets
+resource "aws_nat_gateway" "nat_gateway" {
+  subnet_id     = aws_subnet.public_a.id
+  allocation_id = aws_eip.nat.id
+
+  depends_on = [aws_internet_gateway.internet_gateway]
+}
+
+resource "aws_route" "public_internet_gateway" {
+  route_table_id         = aws_route_table.public.id
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = aws_internet_gateway.internet_gateway.id
+}
+
+resource "aws_route" "private_nat_gateway" {
+  route_table_id         = aws_route_table.private.id
+  destination_cidr_block = "0.0.0.0/0"
+  nat_gateway_id         = aws_nat_gateway.nat_gateway.id
+}
+
+resource "aws_security_group" "http" {
+  name        = "http"
+  description = "HTTP traffic"
+  vpc_id      = aws_vpc.vpc.id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "TCP"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "https" {
+  name        = "https"
+  description = "HTTPS traffic"
+  vpc_id      = aws_vpc.vpc.id
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "TCP"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "egress_all" {
+  name        = "egress-all"
+  description = "Allow all outbound traffic"
+  vpc_id      = aws_vpc.vpc.id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "ingress_api" {
+  name        = "ingress-api"
+  description = "Allow ingress to API"
+  vpc_id      = aws_vpc.vpc.id
+
+  ingress {
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "TCP"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+