cn-terraform/terraform-aws-ecs-fargate-scheduled-task

AWS ECS Fargate Schedule Task Terraform Module

AWS ECS Fargate Scheduled Task Terraform Module

This Terraform module deploys an AWS ECS Fargate scheduled task service.

Usage

Check versions for this module on:

• Github Releases: https://github.com/cn-terraform/terraform-aws-ecs-fargate-scheduled-task/releases
• Terraform Module Registry: https://registry.terraform.io/modules/cn-terraform/ecs-fargate-scheduled-task/aws

Other modules that you may need to use this module

The Networking module:

• Github Releases: https://github.com/cn-terraform/terraform-aws-networking/releases
• Terraform Module Registry: https://registry.terraform.io/modules/cn-terraform/networking/aws

The ECS Cluster module:

• Github Releases: https://github.com/cn-terraform/terraform-aws-ecs-cluster/releases
• Terraform Module Registry: https://registry.terraform.io/modules/cn-terraform/ecs-cluster/aws

The ECS Task Definition module:

• Github Releases: https://github.com/cn-terraform/terraform-aws-ecs-fargate-task-definition/releases
• Terraform Module Registry: https://registry.terraform.io/modules/cn-terraform/ecs-fargate-task-definition/aws

Install pre commit hooks.

Pleas run this command right after cloning the repository.

    pre-commit install

For that you may need to install the following tools:

• Pre-commit
• Terraform Docs

In order to run all checks at any point run the following command:

    pre-commit run --all-files

Requirements

Name	Version
terraform	>= 0.13
aws	>= 4
local	>= 2

Providers

Name	Version
aws	5.41.0

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_rule.event_rule	resource
aws_cloudwatch_event_target.ecs_scheduled_task	resource
aws_iam_role.scheduled_task_cw_event_role	resource
aws_iam_role_policy.scheduled_task_cw_event_role_cloudwatch_policy	resource
aws_iam_policy_document.scheduled_task_cw_event_role_assume_role_policy	data source
aws_iam_policy_document.scheduled_task_cw_event_role_cloudwatch_policy	data source

Inputs

Name	Description	Type	Default	Required
ecs_cluster_arn	The ECS Cluster where the scheduled task will run.	string	n/a	yes
ecs_execution_task_role_arn	(Required) The task definition execution role. The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered.	string	n/a	yes
ecs_task_role_arn	(Optional) The task definition role. The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered.	string	null	no
event_rule_description	(Optional) The description of the rule.	string	null	no
event_rule_event_bus_name	(Optional) The event bus to associate with this rule. If you omit this, the default event bus is used.	string	null	no
event_rule_event_pattern	(Optional) The event pattern described a JSON object. At least one of schedule_expression or event_pattern is required.	string	null	no
event_rule_name	The name of the rule.	string	n/a	yes
event_rule_role_arn	(Optional) The Amazon Resource Name (ARN) associated with the role that is used for target invocation.	string	null	no
event_rule_schedule_expression	(Optional) The scheduling expression. For example, cron(0 20 * * ? *) or rate(5 minutes). At least one of event_rule_schedule_expression or event_rule_event_pattern is required. Can only be used on the default event bus.	string	null	no
event_rule_state	(Optional) State of the rule. Valid values are DISABLED, ENABLED, and ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS. When state is ENABLED, the rule is enabled for all events except those delivered by CloudTrail. To also enable the rule for events delivered by CloudTrail, set state to ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS. Defaults to ENABLED.	string	"ENABLED"	no
event_target_ecs_target_assign_public_ip	(Optional) Assign a public IP address to the ENI. Default false.	bool	false	no
event_target_ecs_target_group	(Optional) Specifies an ECS task group for the task. The maximum length is 255 characters.	string	null	no
event_target_ecs_target_platform_version	(Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as 1.1.0. For more information about valid platform versions, see AWS Fargate Platform Versions. Default to LATEST.	string	"LATEST"	no
event_target_ecs_target_propagate_tags	(Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. Valid values: TASK_DEFINITION or leave empty to avoid propagation.	string	""	no
event_target_ecs_target_security_groups	(Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.	list(any)	null	no
event_target_ecs_target_subnets	The subnets associated with the task or service.	list(any)	n/a	yes
event_target_ecs_target_task_count	(Optional) The number of tasks to create based on the TaskDefinition. The default is 1.	number	1	no
event_target_ecs_target_task_definition_arn	(Required) The ARN of the task definition to use if the event target is an Amazon ECS cluster.	string	n/a	yes
event_target_input	(Optional) Valid JSON text passed to the target. Conflicts with event_target_input_path.	string	null	no
event_target_input_path	(Optional) The value of the JSONPath that is used for extracting part of the matched event when passing it to the target. Conflicts with event_target_input.	string	null	no
event_target_target_id	(Optional) The unique target assignment ID. If missing, will generate a random, unique id.	string	null	no
name_prefix	Name prefix for resources on AWS.	string	n/a	yes
permissions_boundary	(Optional) The ARN of the policy that is used to set the permissions boundary for the role.	string	null	no

Outputs

Name	Description
aws_cloudwatch_event_rule_event_rule_arn	The Amazon Resource Name (ARN) of the CloudWatch Event Rule.
aws_cloudwatch_event_rule_event_rule_id	The name of the rule.
aws_iam_role_policy_scheduled_task_cw_event_role_cloudwatch_policy_id	The role policy ID, in the form of role_name:role_policy_name.
aws_iam_role_policy_scheduled_task_cw_event_role_cloudwatch_policy_name	The name of the policy.
aws_iam_role_policy_scheduled_task_cw_event_role_cloudwatch_policy_policy	The policy document attached to the role.
aws_iam_role_policy_scheduled_task_cw_event_role_cloudwatch_policy_role	The name of the role associated with the policy.
scheduled_task_cw_event_role_arn	The Amazon Resource Name (ARN) specifying the role.
scheduled_task_cw_event_role_create_date	The creation date of the IAM role.
scheduled_task_cw_event_role_description	The description of the role.
scheduled_task_cw_event_role_id	The name of the role.
scheduled_task_cw_event_role_name	The name of the role.
scheduled_task_cw_event_role_unique_id	The stable and unique string identifying the role.

terraform-aws-ecs-fargate-scheduled-task's Issues

Use same custom Events role in rule and target to optimize resource creation.

Hello, there.

I have a use case where I am using a for_each meta argument to create many tasks. I noticed that, in spite of providing a custom Events role arn, another role with the same permissions is always created on each module call, thus creating unnecessary resources. Given that we only need one such Events role per ecs cluster, the module should default to skip the creation of a custom role when the user already provided one.

I have a working fork where this behavior enabled a considerable reduction in the number of redundant resources. I will contribute a PR and I am willing to contribute to this issue further.

Built-in IAM Role fails when Task Definition includes a task role

As per AWS documentation on the matter:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/CWE_IAM_role.html

If your scheduled tasks require the use of the task execution role, a task role, or a task role override, then you must add iam:PassRole permissions for each task execution role, task role, or task role override to the CloudWatch Events IAM role.

Using the built-in Scheduled Task CW Event Role doesn't work if the task definition includes a task role. This is because the Terraform code doesn't add them to the IAM role as roles to be passed using the action "iam:PassRole".

Workaround

Changing the role_arn value to the default ecsEvents role via WebUI or API works, because of the role being more permissive.

Adding Support for Permissions Boundary

Under the current configuration there is no support to add a permissions boundaries
when creating IAM Resources.

resource "aws_iam_role" "scheduled_task_cw_event_role" {
  count              = var.event_rule_role_arn == null ? 1 : 0
  name               = "${var.name_prefix}-st-cw-role"
  assume_role_policy = data.aws_iam_policy_document.scheduled_task_cw_event_role_assume_role_policy.json
}

Proposed fix :

resource "aws_iam_role" "scheduled_task_cw_event_role" {
  count              = var.event_rule_role_arn == null ? 1 : 0
  name               = "${var.name_prefix}-st-cw-role"
  assume_role_policy = data.aws_iam_policy_document.scheduled_task_cw_event_role_assume_role_policy.json

  permissions_boundary = var.permissions_boundary == null ? null : var.permissions_boundary
  }
  

ecs_target.propagate_tags should be an enum

If variable PropagateTags=TASK_DEFINITION (per https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_EcsParameters.html#eventbridge-Type-EcsParameters-PropagateTags and on https://github.com/cn-terraform/terraform-aws-ecs-fargate-scheduled-task/blob/main/main.tf#L72)

Error appears as STRING is not a boolean value. This value should be STRING, with allowed values "TASK_DEFINITION" or ""

If I set this value to empty string, similar message is given, just from one component more downstream.

I've also raise PR to fix this in #19

╷
│ Error: Invalid value for module argument
│ 
│   on main.tf line 113, in module "ecs_fargate_scheduled_task":
│  113:   event_target_ecs_target_propagate_tags      = "TASK_DEFINITION"
│ 
│ The given value is not suitable for child module variable "event_target_ecs_target_propagate_tags" defined at
│ .terraform/modules/ecs_fargate_scheduled_task/variables.tf:114,1-50: a bool is required.

Unable to hold deployed task definition

Hi Team,

I have used this module to create scheduled task. When i am deploying scheduled task using terraform its working fine. Post this activity we are deploying new code via Jenkins pipeline into scheduled task so accordingly task definition getting updated in scheduled task.

Now at some instance if i am updating something in scheduled task for having some new feature and execute terraform pipeline then this pipeline execution reverting back latest task definition from scheduled task and its bringing back task definition to older one which is stored in state file, this is causing application break.

Similar pipeline i am using for normal ecs service deployment where i haven't seen this type of behaviour.

Can you let me know if i am doing something wrong here?

My code snippet :

module "scheduled-task" {
  source                                      = "cn-terraform/ecs-fargate-scheduled-task/aws"
  version                                     = "~> 1.0.22"
  ecs_cluster_arn                             = var.cluster_arn
  ecs_execution_task_role_arn                 = var.ecs_task_execution_role_arn
  ecs_task_role_arn                           = var..ecs_task_role_arn
  event_rule_description                      = "This event rule will trigger ECS Task "
  event_rule_name                             = var.eventrulename
  event_rule_schedule_expression              = "rate(1 hour)"
  event_target_ecs_target_subnets             = var.vpc.private_subnets
  event_target_ecs_target_security_groups     = var.security_group_id
  event_target_ecs_target_task_definition_arn = var.ecs_task_definition_arn
  event_target_ecs_target_assign_public_ip    = true
  name_prefix                                 = var.nameprefix
  event_target_target_id                      = "1"
}

Thanks.

Introduce `tags` variable and propagate to all resources

Would be nice to tag each resource with tags to help search ect.

event_rule_role_arn input ignored in event targets

Providing event_rule_role_arn input to module is ignored and module.ecs-fargate-scheduled-task.aws_iam_role.scheduled_task_cw_event_role is used in event target.

  # module.ecs-fargate-scheduled-task.aws_cloudwatch_event_target.ecs_scheduled_task will be created
  + resource "aws_cloudwatch_event_target" "ecs_scheduled_task" {
      + arn            = "arn:aws:ecs:ap-southeast-2:445645794583:cluster/hydrofluxdr-prod"
      + event_bus_name = "default"
      + id             = (known after apply)
      + role_arn       = (known after apply)

https://github.com/cn-terraform/terraform-aws-ecs-fargate-scheduled-task/blob/main/main.tf#L64

ECS Fargate schedule on 24/7 runnning tasks

Hi Julian! - I have a couple of fargate tasks that are currently running on a 24/7 basis. We would like to schedule a start/stop time on this fargate tasks. Would this module be helpful to achieve this? I was not able to set the cron correctly.

Regards

Is documentation for losers?

Error: "input": conflicts with input_path

It seems that the aws_cloudwatch_event_target.ecs_scheduled_task provides both input and input_path which according to terraform 0.12 considers that invalid as only one of those options can be specified.

Getting this when trying to run plan.

Error: "input": conflicts with input_path

  on .terraform/modules/.../jnonino-terraform-aws-ecs-fargate-scheduled-task-0fbb11c/main.tf line 48, in resource "aws_cloudwatch_event_target" "ecs_scheduled_task":
  48: resource "aws_cloudwatch_event_target" "ecs_scheduled_task" {

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

github-actions

.github/workflows/pipeline.yml

• actions/checkout v4
• actions/checkout v4

terraform

versions.tf

• aws >= 4
• local >= 2
• hashicorp/terraform >= 0.13

---

• Check this box to trigger a request for Renovate to run again on this repository

How is it possible to create a container override?

I'm not seeing anything in the documentation in regards to setting a command override on the container

I have many ECS scheduled tasks implementing the same task definition but each one of those individual ECS scheduled tasks needs to run a unique command override

Any help would be appreciated as this seems to be the only scheduled task module that works well

trying to create role that already exists

I've created a task with jnonino/ecs-fargate-task-definition/aws and am now trying to use jnonino/ecs-fargate-scheduled-task/aws to schedule a task, but it appears to be trying to create the same role that the td module has already created.

I end up with the following error:
Error: Error creating IAM Role session-based-container-reco-ecs-task-execution-role: EntityAlreadyExists: Role with name session-based-container-reco-ecs-task-execution-role already exists. status code: 409, request id: b2446842-bebb-11e9-ab18-c7397f4134f6

code:

module "scheduled_task" {
  source          = "jnonino/ecs-fargate-scheduled-task/aws"
  version         = "1.0.3"
  name_preffix    = var.container_name
  profile         = var.profile
  region          = var.region
  ecs_cluster_arn = module.ecs-cluster.aws_ecs_cluster_cluster_arn
  event_rule_name = "${var.container_name}-cron"
  event_rule_schedule_expression = "cron(30 10 * * ? *)"
  event_rule_description                      = "run daily at 10:30 am"
  event_target_ecs_target_task_definition_arn = module.td.aws_ecs_task_definition_td_arn
  event_target_ecs_target_subnets             = var.private_subnets_ids
}

aws_cloudwatch_event_rule is_enabled is deprecated use state instead

as titled, https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule#is_enabled

╷
│ Warning: Argument is deprecated
│
│   with [redacted],
│   on [redacted] line 57, in resource "aws_cloudwatch_event_rule" "event_rule":
│   57:   is_enabled          = var.event_rule_is_enabled
│
│ Use "state" instead
╵

code that needs update: https://github.com/cn-terraform/terraform-aws-ecs-fargate-scheduled-task/blob/main/main.tf#L57