terraform-aws-strongdm

Terraform module for deploying strongDM gateways/relays on AWS ECS Fargate

---

Usage

data "aws_region" "current" {}

resource "aws_ecs_cluster" "strongdm" {
  name               = "strongdm"
  capacity_providers = ["FARGATE", "FARGATE_SPOT"]

  default_capacity_provider_strategy {
    capacity_provider = "FARGATE_SPOT"
    weight            = 1
  }
}

module "ecs_strongdm" {
  source             = "github.com/highwingio/terraform-aws-strongdm:v1.0.0"
  region             = data.aws_region.current.name
  vpc_id             = data.vpc.my_vpc.vpc_id
  ecs_cluster_arn    = aws_ecs_cluster.strongdm.arn
  sdm_admin_token_parameter_arn    = "arn::aws::ssm:<SDM_ADMIN_TOKEN>"
  private_subnet_ids = <PRIVATE_SUBNETS>
  public_subnet_ids  = <PUBLIC_SUBNETS>
  security_group_ids = <SECURITY_GROUPS>
}

Requirements

No requirements.

Providers

Name	Version
aws	4.51.0
sdm	3.5.4

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_log_group.task	resource
aws_ecs_service.service	resource
aws_ecs_task_definition.task	resource
aws_iam_role.service	resource
aws_iam_role.task	resource
aws_iam_role_policy.service	resource
aws_iam_role_policy_attachment.service	resource
aws_iam_role_policy_attachment.task_extra	resource
aws_lb.nlb	resource
aws_lb_listener.frontend	resource
aws_lb_target_group.gateway	resource
aws_security_group.nlb_listener_traffic	resource
aws_ssm_parameter.gateway_token	resource
sdm_node.gateway	resource
aws_iam_policy_document.assume_role_service	data source
aws_iam_policy_document.assume_role_task	data source
aws_iam_policy_document.service_policy	data source
aws_iam_policy_document.task_policy	data source
aws_region.region	data source

Inputs

Name	Description	Type	Default	Required
ecs_cluster_arn	ARN of ECS cluster in which the service will be deployed	string	n/a	yes
ecs_deployment_maximum_percent	Upper limit in percentage of tasks that can be running during a deployment (default 200)	string	"200"	no
ecs_deployment_minimum_healthy_percent	Lower limit in percentage of tasks that must remain healthy during a deployment (default 100)	string	"100"	no
ecs_desired_count	Desired number of containers in the task (default 1)	number	1	no
ecs_health_check_grace_period	Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 1800. (default 0)	string	"0"	no
ecs_log_retention	Number of days of ECS task logs to retain (default 365)	number	365	no
extra_task_policy_arns	List of ARNs of IAM policies to be attached to the ECS task role (in addition to the default policy, so cannot be more than 9 ARNs)	list(any)	[]	no
gateway_listen_port	Port for SDM gateway to listen on	number	5000	no
log_group_name	Name for CloudWatch Log Group that will receive collector logs (must be unique, default is created from service_identifier and task_identifier)	string	""	no
private_subnet_ids	List of private subnet IDs in which to place the ECS tasks	list(string)	n/a	yes
public_subnet_ids	List of public subnet IDs in which to place the load balancer	list(string)	n/a	yes
region	AWS region in which ECS cluster is located (default is 'us-east-1')	string	"us-east-1"	no
sdm_relay_token_parameter_arn	ARN of an SSM parameter holding an SDM relay token	string	n/a	yes
security_group_ids	Additional security groups for the SDM gateway (e.g. to access data sources)	list(string)	[]	no
service_identifier	Unique identifier for this service (used in log prefix, service name etc.)	string	"sdm"	no
task_identifier	Unique identifier for this task (used in log prefix, service name etc.)	string	"gateway"	no
vpc_id	ID of VPC in which ECS cluster is located	string	n/a	yes

Outputs

No outputs.

Authors

Based off of https://github.com/asicsdigital/terraform-aws-strongdm

Changelog

1.0.0 - Initial release.

License

This software is released under the MIT License (see LICENSE).