Fargate Example

ECS cluster with Fargate capacity providers, blue/green deployment, and FireLens logging

This example uses the standalone cluster and service sub-modules to create a Fargate-based ECS deployment with blue/green deployment strategy and FireLens log forwarding.

What is created

• ECS cluster (via modules/cluster) with Fargate and Fargate Spot capacity providers
• ECS service (via modules/service) with:
  • FluentBit sidecar for log forwarding to Kinesis Firehose
  • Blue/green deployment with 2-minute bake time
  • ECS Exec enabled for debugging
  • ALB integration with two target groups
  • Service Connect
• Application Load Balancer
• VPC with 3 AZs

Code

Cluster

module "ecs_cluster" {
  source = "terraform-aws-modules/ecs/aws//modules/cluster"

  name = local.name

  cluster_capacity_providers = ["FARGATE", "FARGATE_SPOT"]
  default_capacity_provider_strategy = {
    FARGATE = {
      weight = 50
      base   = 20
    }
    FARGATE_SPOT = {
      weight = 50
    }
  }

  tags = local.tags
}

Service

module "ecs_service" {
  source = "terraform-aws-modules/ecs/aws//modules/service"

  name        = local.name
  cluster_arn = module.ecs_cluster.arn

  cpu    = 1024
  memory = 4096

  enable_execute_command = true

  # Blue/green deployment
  deployment_configuration = {
    strategy             = "BLUE_GREEN"
    bake_time_in_minutes = 2
  }

  container_definitions = {
    fluent-bit = {
      cpu       = 512
      memory    = 1024
      essential = true
      image     = nonsensitive(data.aws_ssm_parameter.fluentbit.value)
      firelensConfiguration = {
        type = "fluentbit"
      }
      memoryReservation = 50
    }

    (local.container_name) = {
      cpu       = 512
      memory    = 1024
      essential = true
      image     = "public.ecr.aws/aws-containers/ecsdemo-frontend:776fd50"

      portMappings = [{
        name          = local.container_name
        containerPort = local.container_port
        protocol      = "tcp"
      }]

      readonlyRootFilesystem = false

      dependsOn = [{ containerName = "fluent-bit", condition = "START" }]

      enable_cloudwatch_logging = false
      logConfiguration = {
        logDriver = "awsfirelens"
        options = {
          Name                    = "firehose"
          region                  = "eu-west-1"
          delivery_stream         = "my-stream"
          log-driver-buffer-limit = "2097152"
        }
      }
      memoryReservation = 100
    }
  }

  service_connect_configuration = {
    namespace = aws_service_discovery_http_namespace.this.arn
    service = [{
      client_alias = {
        port     = local.container_port
        dns_name = local.container_name
      }
      port_name      = local.container_name
      discovery_name = local.container_name
    }]
  }

  load_balancer = {
    service = {
      target_group_arn = module.alb.target_groups["ex-ecs"].arn
      container_name   = local.container_name
      container_port   = local.container_port
    }
  }

  subnet_ids = module.vpc.private_subnets
  vpc_id     = module.vpc.vpc_id

  security_group_ingress_rules = {
    alb_3000 = {
      from_port                    = local.container_port
      description                  = "Service port"
      referenced_security_group_id = module.alb.security_group_id
    }
  }
  security_group_egress_rules = {
    all = { cidr_ipv4 = "0.0.0.0/0", ip_protocol = "-1" }
  }

  tags = local.tags
}

Key highlights

• Separate sub-modules: The cluster and service are managed independently. This allows teams to manage the cluster and services in separate Terraform workspaces.
• Blue/green deployment: strategy = "BLUE_GREEN" with a 2-minute bake period before traffic shifts.
• ECS Exec: enable_execute_command = true allows interactive shell access to running containers.
• FireLens to Firehose: Logs are forwarded from FluentBit to a Kinesis Firehose delivery stream.

Complete Example

Full example with EC2 ASG, predictive autoscaling, and advanced ALB configuration.

Fargate Guide

Learn more about Fargate capacity provider configuration.