Terraform Module for CI/CD with AWS Code Pipeline and Code Build for ECS https://cloudposse.com/

Home Page: https://cloudposse.com/accelerate

License: Apache License 2.0

Makefile 5.98% HCL 79.51% Go 14.51%

terraform terraform-module ecs pipeline codebuild docker aws codepipeline hcl2

terraform-aws-ecs-codepipeline's Issues

Support build_type parameter

Describe the Feature

Specify ARM_CONTAINER for environment.type of aws_codebuild_project resource.
Of course CodeBuild is wrapped with cloudposse/terraform-aws-codebuild, and it accepts this value as build_type variable.

Expected Behavior

build_type parameter is supported that is to be passed to cloudposse/terraform-aws-codebuild module.
https://github.com/cloudposse/terraform-aws-codebuild/blob/master/main.tf#L343

Use Case

I want to run CodeBuild on Graviton2.

Describe Ideal Solution

Add a parameter.

Alternatives Considered

N/A

Additional Context

N/A

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

WARN: Base branch does not exist - skipping

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

chore(deps): update terraform cloudposse/repository-webhooks/github to v0.14.0 (main)

Detected dependencies

terraform

main.tf

cloudposse/codebuild/aws 2.0.2

cloudposse/label/null 0.25.0

cloudposse/label/null 0.25.0

cloudposse/label/null 0.25.0

cloudposse/label/null 0.25.0

cloudposse/label/null 0.25.0

cloudposse/repository-webhooks/github 0.13.0

versions.tf

aws >= 4.9.0

random >= 2.1

hashicorp/terraform >= 1.0.0

Check this box to trigger a request for Renovate to run again on this repository

$CONTAINER_NAME Env Variable does not exist in CodeBuild

Hi there,
In your buildspec example you use $CONTAINER_NAME but I haven't found anywhere in the code where I could pass the container_name to my CodeBuild environment variable.

Unless I hardcode the container name directly on my build_spec the example is not working as is.

thank you

update required_providers in all module

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Can you update the required_providers in all of your modules to at least be >=? The ~> version specification is making it very hard to manage dependencies when using your modules.

Expected Behavior

To not get Error: Failed to query available provider packages errors

Use Case

When trying to use Cloudposse modules and somewhat recent versions of official providers, like hashicorp/aws and hashicorp/github, there are a lot of dependency version conflicts.

Describe Ideal Solution

We should always be able to use later versions of providers with Cloudposse modules and not be pinned to old major versions. Also this current paradigm seems difficult to maintain.

Alternatives Considered

Maybe one option is to have tags for each module where dependencies are pinned to specific versions. Though that would also be very high maintenance.

Additional Context

Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider
hashicorp/github: no available releases match the given constraints >= 3.1.*,
>= 3.1.*, >= 3.1.*, ~> 2.8.0


Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider
hashicorp/random: no available releases match the given constraints >= 3.0.*,
~> 2.*, ~> 2.1, ~> 2.1, ~> 2.1


Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider
hashicorp/local: no available releases match the given constraints >= 2.0.*,
~> 1.3, ~> 1.2, ~> 1.2, ~> 1.2, >= 1.2.*, ~> 1.2, >= 1.2.*, ~> 1.*, ~> 1.3, ~>
1.2, ~> 1.2, >= 2.0.*, ~> 1.2, >= 2.0.*, ~> 1.3, ~> 1.2, ~> 1.2, ~> 1.2, ~>
1.3, ~> 1.2, ~> 1.2, ~> 1.3, ~> 1.2, ~> 1.2, ~> 1.2, ~> 1.3, ~> 1.2, >= 1.2.*,
~> 1.2


Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider hashicorp/aws:
no available releases match the given constraints >= 2.42.*, ~> 2.0, ~> 2.0,
~> 2.0, >= 3.0.*, >= 2.0.*, >= 2.0.*, >= 2.67.*, < 4.0.*, ~> 2.0, ~> 2.0, ~>
2.0, >= 2.42.*, ~> 2.0, >= 2.42.*, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.42, >= 2.34.*,
< 4.0.*, ~> 2.42, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.42, ~> 2.0, >= 2.0.*, >= 2.0.*,
~> 2.0, ~> 2.0


Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider hashicorp/null:
no available releases match the given constraints >= 3.0.*, ~> 2.0, ~> 2.0, ~>
2.0, >= 2.0.*, ~> 2.0, >= 2.0.*, ~> 2.*, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~>
2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0, ~> 2.0,
>= 2.0.*, ~> 2.0

dynamic auth block bug from cloudposse/codebuild/aws/1.0.0

Describe the Bug

ecs-codepipeline has a hardcoded dependency for the code build module. this is calling version 1.0.0 instead of latest 2.0.1 in which the dynamic block has been removed in commit id: 0586277 (release v.2.0.0) line 414.
cloudposse/terraform-aws-codebuild@0586277

 dynamic "auth" {
  for_each = var.private_repository ? [""] : []
  content {
    type     = "OAUTH"
    resource = join("", aws_codebuild_source_credential.authorization.*.id)
  }
}

This dynamic block is resulting in the following error:

Error: Unsupported block type
│
│ on .terraform\modules\ecs-codepipeline.codebuild\main.tf line 414, in resource "aws_codebuild_project" "default":
│ 414: dynamic "auth" {
│
│ Blocks of type "auth" are not expected here.

Expected Behavior

terraform to perform a successful plan without error.

Steps to Reproduce

Call the latest version ecs-codepipeline from terraform registry. version = 0.33.0

https://registry.terraform.io/modules/cloudposse/ecs-codepipeline/aws/0.33.0

Screenshots

Environment

cloudposse/ecs-codepipeline/aws = v0.33.0
cloudposse/codebuild/aws = v1.0.0

Additional Context

apologies in advance if this is not the correct format to report a issue with a terraform module. I am new to github and coding in general.

Why this module uses "data" and not "resource" for IAM policy document?

I'm a newbie in Terraform world and I'd like to ask, why this module assumes a user has appropriate IAM policy document? IMHO it should create one.

Relevant code:

data "aws_iam_policy_document" "assume" {
  statement {
    sid = ""

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["codepipeline.amazonaws.com"]
    }

    effect = "Allow"
  }
}

Resources created when enabled set to false

Found a bug? Maybe our Slack Community can help.

Describe the Bug

When enabled is false the module still creates resources (CodeBuild).

Expected Behavior

No resources should be created in module is disabled.

Allow the module to configure secondary artifact sources in codebuild

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Update the module to use the latest terraform-aws-codebuild module, and pass through configuration settings for secondary artifacts

Expected Behavior

The update will allow the settings on the child module to be configured

Use Case

The intent is to wire these settings all the way through to the terraform-aws-ecs-web-app module, which will then allow a single buildspec file to deploy static assets to an S3 CDN.

Describe Ideal Solution

N/A

Alternatives Considered

N/A

Additional Context

N/A

IAM policy is too loose

The IAM policy for the role allows * too too many aws services without resource restrictions. Allowing a var supplied policy here could be a good first step. (https://github.com/cloudposse/terraform-aws-ecs-codepipeline/blame/master/main.tf#L66-L87).

Add support for github webhooks

Instead of using polling, it would be nice to see support for github webhooks

Support GitHub (Version 2)/CodeStar Source

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Code Pipeline source provider GitHub Version 2 is the current preferred GitHub connection, using GitHub Apps rather than OAuth.

Expected Behavior

Support GitHub Version 2 source.

destroying the stack fails because S3 bucket is not empty

I suggest adding force_destroy to the s3 bucket or have it controllable via variable

Allow ecs inputs to be optional

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

From cloudposse/terraform-aws-cicd#98

The ecs inputs do not create any specific ecs resources. If the ecs inputs were optional, this module could drop the ecs portion in its name, its code could be reused by other modules that require a codepipeline resource.

ecs_cluster_name
service_name

support arm64

When using the latest release (0.28.5), terraform init fails with the following message on arm64

╷
│ Error: Incompatible provider version
│ 
│ Provider registry.terraform.io/hashicorp/template v2.2.0 does not have a package available for your current platform, darwin_arm64.
│ 
│ Provider releases are separate from Terraform CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
╵

hashicorp/template appears to only be used in examples and actually doesn't use template_file (copy pasta maybe?). They can just be removed with a similar commit to this sonatype@0811b62.

Also, this doesn't fully facilitate arm64 support, the module cloudposse/repository-webhooks/github also uses the hashicorp/github provider that needs to migrate as well. Full arm64 support also depends on this issue cloudposse/terraform-github-repository-webhooks#34

Add Example Usage

what

Add example invocation

why

We need this so we can soon enable automated continuous integration testing of module

Please add example buildspec.yml

As in the topic, please add example build file that might be used here.

Several "unsupported" errors on running example

Describe the Bug

Thanks for providing this great open source library!

I am trying to run the examples/complete example from the repo and encounter several errors regarding "unsupported block type" etc.. Terraform init seems to work fine, but terraform plan throws several errors (pasted below).

Expected Behavior

I would expect terraform plan to complete successfully.

Steps to Reproduce

Install terraform from apt-get on ubuntu. Then run the following

git clone [email protected]:cloudposse/terraform-aws-ecs-codepipeline.git
cd terraform-aws-ecs-codepipeline/examples/complete
terraform init
terraform plan

Screenshots

init log:

$ terraform init

Initializing the backend...
Initializing modules...
Downloading registry.terraform.io/cloudposse/ecs-container-definition/aws 0.46.1 for container_definition...
- container_definition in .terraform/modules/container_definition
Downloading registry.terraform.io/cloudposse/ecs-alb-service-task/aws 0.42.3 for ecs_alb_service_task...
- ecs_alb_service_task in .terraform/modules/ecs_alb_service_task
Downloading registry.terraform.io/cloudposse/label/null 0.22.1 for ecs_alb_service_task.exec_label...
- ecs_alb_service_task.exec_label in .terraform/modules/ecs_alb_service_task.exec_label
Downloading registry.terraform.io/cloudposse/label/null 0.22.1 for ecs_alb_service_task.service_label...
- ecs_alb_service_task.service_label in .terraform/modules/ecs_alb_service_task.service_label
Downloading registry.terraform.io/cloudposse/label/null 0.22.1 for ecs_alb_service_task.task_label...
- ecs_alb_service_task.task_label in .terraform/modules/ecs_alb_service_task.task_label
Downloading registry.terraform.io/cloudposse/label/null 0.22.0 for ecs_alb_service_task.this...
- ecs_alb_service_task.this in .terraform/modules/ecs_alb_service_task.this
- ecs_codepipeline in ../..
Downloading registry.terraform.io/cloudposse/codebuild/aws 1.0.0 for ecs_codepipeline.codebuild...
- ecs_codepipeline.codebuild in .terraform/modules/ecs_codepipeline.codebuild
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codebuild.this...
- ecs_codepipeline.codebuild.this in .terraform/modules/ecs_codepipeline.codebuild.this
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codebuild_label...
- ecs_codepipeline.codebuild_label in .terraform/modules/ecs_codepipeline.codebuild_label
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codepipeline_assume_role_label...
- ecs_codepipeline.codepipeline_assume_role_label in .terraform/modules/ecs_codepipeline.codepipeline_assume_role_label
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codepipeline_label...
- ecs_codepipeline.codepipeline_label in .terraform/modules/ecs_codepipeline.codepipeline_label
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codepipeline_s3_policy_label...
- ecs_codepipeline.codepipeline_s3_policy_label in .terraform/modules/ecs_codepipeline.codepipeline_s3_policy_label
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.codestar_label...
- ecs_codepipeline.codestar_label in .terraform/modules/ecs_codepipeline.codestar_label
Downloading registry.terraform.io/cloudposse/repository-webhooks/github 0.13.0 for ecs_codepipeline.github_webhooks...
- ecs_codepipeline.github_webhooks in .terraform/modules/ecs_codepipeline.github_webhooks
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.github_webhooks.this...
- ecs_codepipeline.github_webhooks.this in .terraform/modules/ecs_codepipeline.github_webhooks.this
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for ecs_codepipeline.this...
- ecs_codepipeline.this in .terraform/modules/ecs_codepipeline.this
Downloading registry.terraform.io/cloudposse/dynamic-subnets/aws 0.39.3 for subnets...
- subnets in .terraform/modules/subnets
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.nat_instance_label...
- subnets.nat_instance_label in .terraform/modules/subnets.nat_instance_label
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.nat_label...
- subnets.nat_label in .terraform/modules/subnets.nat_label
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.private_label...
- subnets.private_label in .terraform/modules/subnets.private_label
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.public_label...
- subnets.public_label in .terraform/modules/subnets.public_label
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.this...
- subnets.this in .terraform/modules/subnets.this
Downloading registry.terraform.io/cloudposse/utils/aws 0.8.0 for subnets.utils...
- subnets.utils in .terraform/modules/subnets.utils
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for subnets.utils.this...
- subnets.utils.this in .terraform/modules/subnets.utils.this
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for this...
- this in .terraform/modules/this
Downloading registry.terraform.io/cloudposse/vpc/aws 0.18.1 for vpc...
- vpc in .terraform/modules/vpc
Downloading registry.terraform.io/cloudposse/label/null 0.22.0 for vpc.label...
- vpc.label in .terraform/modules/vpc.label
Downloading registry.terraform.io/cloudposse/label/null 0.22.0 for vpc.this...
- vpc.this in .terraform/modules/vpc.this

Initializing provider plugins...
- Finding hashicorp/random versions matching ">= 2.1.0"...
- Finding hashicorp/aws versions matching ">= 2.0.0"...
- Finding hashicorp/local versions matching ">= 1.2.0, >= 1.3.0"...
- Finding hashicorp/null versions matching ">= 2.0.0"...
- Finding hashicorp/template versions matching ">= 2.0.0"...
- Finding integrations/github versions matching ">= 4.2.0"...
- Installing hashicorp/null v3.2.1...
- Installed hashicorp/null v3.2.1 (signed by HashiCorp)
- Installing hashicorp/template v2.2.0...
- Installed hashicorp/template v2.2.0 (signed by HashiCorp)
- Installing integrations/github v5.31.0...
- Installed integrations/github v5.31.0 (signed by a HashiCorp partner, key ID 38027F80D7FD5FB2)
- Installing hashicorp/random v3.5.1...
- Installed hashicorp/random v3.5.1 (signed by HashiCorp)
- Installing hashicorp/aws v5.8.0...
- Installed hashicorp/aws v5.8.0 (signed by HashiCorp)
- Installing hashicorp/local v2.4.0...
- Installed hashicorp/local v2.4.0 (signed by HashiCorp)

Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

plan log

$ terraform plan -var-file=fixtures.us-east-2.tfvars
╷
│ Warning: Argument is deprecated
│ 
│   with module.ecs_codepipeline.aws_s3_bucket.default,
│   on ../../main.tf line 16, in resource "aws_s3_bucket" "default":
│   16:   acl           = "private"
│ 
│ Use the aws_s3_bucket_acl resource instead
│ 
│ (and 3 more similar warnings elsewhere)
╵
╷
│ Error: Unsupported block type
│ 
│   on .terraform/modules/ecs_codepipeline.codebuild/main.tf line 414, in resource "aws_codebuild_project" "default":
│  414:     dynamic "auth" {
│ 
│ Blocks of type "auth" are not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on .terraform/modules/vpc/main.tf line 22, in resource "aws_vpc" "default":
│   22:   enable_classiclink               = var.enable_classiclink
│ 
│ An argument named "enable_classiclink" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on .terraform/modules/vpc/main.tf line 23, in resource "aws_vpc" "default":
│   23:   enable_classiclink_dns_support   = var.enable_classiclink_dns_support
│ 
│ An argument named "enable_classiclink_dns_support" is not expected here.

Environment

OS: Ubuntu 22.04
Terraform: v1.5.3
Module: Latest main branch

Additional Context

No response

Error running 0.11.0

When I run:

module "ecs_web_app" {
  source                       = "git::https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.10.0"
  name                         = "web"
  namespace                    = "upright"
  stage                        = "prod"
  vpc_id                       = "${module.vpc.vpc_id}"
  listener_arns                = ["${module.alb.listener_arns}"]
  listener_arns_count          = "1"
  aws_logs_region              = "us-east-1"
  ecs_cluster_arn              = "${aws_ecs_cluster.default.arn}"
  ecs_cluster_name             = "${aws_ecs_cluster.default.name}"
  ecs_private_subnet_ids       = ["${values(module.private_subnets.az_subnet_ids)}"]
  alb_ingress_healthcheck_path = "/healthz"
  alb_ingress_paths            = ["/*"]
  codepipeline_enabled         = "false"

  github_oauth_token           = "XXX"
  repo_name = "seedfi"
  repo_owner = "rclmenezes"
}

I get:

Error: Error running plan: 1 error(s) occurred:

* module.ecs_web_app.module.ecs_codepipeline.aws_codepipeline_webhook.webhook: 1 error(s) occurred:

* module.ecs_web_app.module.ecs_codepipeline.aws_codepipeline_webhook.webhook: Resource 'aws_codepipeline.source_build_deploy' not found for variable 'aws_codepipeline.source_build_deploy.name'

Works fine on 0.10.0

Use encryption at rest on bucket as default.

In order for this to be in some envs consider adding AES-256 encryption by default to your buckets.

Error: cache location is required when cache type is "S3"

module "ecs-codepipeline" {
  source             = "cloudposse/ecs-codepipeline/aws"
  version            = "0.23.1"
  name               = "hello-world"
  namespace          = "eg"
  stage              = "staging"
  github_oauth_token = var.github_oauth_token
  region             = "eu-***-1"
  image_repo_name    = "hello-world"
  //github_webhooks_token = "xxxxxxxxxxxxxx"
  repo_owner       = "someowner"
  repo_name        = "ecs-hello-world"
  branch           = "master"
  service_name     = "hello-world"
  ecs_cluster_name = aws_ecs_cluster.lab-1.name
  privileged_mode  = "true"
}

Error: cache location is required when cache type is "S3"

  on .terraform/modules/ecs-codepipeline.codebuild/main.tf line 206, in resource "aws_codebuild_project" "default":
 206: resource "aws_codebuild_project" "default" {
 *

module treats repo_owner as an org, how to treat as user?

Hello,
I'm trying to build a pipeline that fulls from my github repo. The module thinks my username is an org. I get an error:

GET https://api.github.com/orgs/brietsparks: 404 Not Found []
  on .terraform/modules/ecs_push_pipeline.github_webhooks/main.tf line 7, in provider "github":
   7: provider "github" {

The module block:

module "ecs_push_pipeline" {
  source                = "git::https://github.com/cloudposse/terraform-aws-ecs-codepipeline.git?ref=master"
  name                  = "guestbook-ci"
  region                = var.region
  repo_owner            = "brietsparks"
  repo_name             = "guestbook"
  github_webhooks_token = var.github_webhooks_token
  image_repo_name       = "guestbook"
  branch                = "ci-pract"
  service_name          = "guestbook"
  ecs_cluster_name      = "guestbook"
  privileged_mode       = "true"
}

github_repository_webhook: "name": required field is not set

I'm getting the following error since version 0.7.0, as the github_repository_webhook name parameter was removed:

module.github_webhooks.github_repository_webhook.default: "name": required field is not set

The "name" parameter is indeed no longer listed in the documentation for the github provider (https://www.terraform.io/docs/providers/github/r/repository_webhook.html), however, it seems that it is still required to be set to 'web' (as mentioned in this issue: https://github.com/terraform-providers/terraform-provider-github/issues/197)

This seems to be an bug in the github provider, but until either fixed there or reverted in this module, the github webhooks are broken.

Please remove default from image_repo_name

This needs to be specified when you configure this module. I don't think you would ever have an image_repo_name="UNSET" in a plan

variable "image_repo_name" {
  type        = "string"
  default     = "UNSET"
  description = "ECR repository name to store the Docker image built by this module. Used as CodeBuild ENV variable when building Docker images. [For more info](http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html)"
}

cloudposse / terraform-aws-ecs-codepipeline Goto Github PK

terraform-aws-ecs-codepipeline's Issues

Describe the Feature

Expected Behavior

Use Case

Describe Ideal Solution

Alternatives Considered

Additional Context

Repository problems

Ignored or Blocked

Detected dependencies

Describe the Feature

Expected Behavior

Use Case

Describe Ideal Solution

Alternatives Considered

Additional Context

Describe the Bug

Expected Behavior

Steps to Reproduce

Screenshots

Environment

Additional Context

Describe the Bug

Expected Behavior

Describe the Feature

Expected Behavior

Use Case

Describe Ideal Solution

Alternatives Considered

Additional Context

Describe the Feature

Expected Behavior

Describe the Feature

what

why

Describe the Bug

Expected Behavior

Steps to Reproduce

Screenshots

Environment

Additional Context

Recommend Projects

Recommend Topics

Recommend Org

Jobs