> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ECS Cluster inputs > Reference the ECS Cluster module's Inputs, ECS cluster, Managed domains, Capacity providers, EC2 capacity, EC2 volume and more inputs. **Type:** `rvn-ecs-cluster` / **Latest version:** `2.3.1` See [ECS Cluster module reference](/docs/module-definitions/catalog/rvn-ecs-cluster) for the full module page. **network** `$ref:rvn-aws-network` *required* **VPC network.** * Immutable after creation Set `network` to `null`. Mapped inputs for `network`: set these keys alongside `network`, not inside it, when supplying existing infrastructure instead of a module reference. **section\_aws** `section` **AWS account & region.** **aws\_account\_id** `string` **AWS account.** * Default: `<< ref.input.aws_account_id >>` * Immutable after creation **aws\_region** `string` **Region.** AWS region for this module. If unset in Terraform, the provider region is used. * Default: `<< ref.input.aws_region >>` * Immutable after creation **execution\_environment\_id** `string` **Terraform execution environment.** Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above. * Default: `<< ref.input.execution_environment_id >>` **section\_vpc** `section` **VPC.** **vpc\_id** `string` *required* **VPC ID.** * Default: `<>` * Immutable after creation **private\_subnet\_ids** `string_array` *required* **Private subnet IDs.** Required by Terraform. Used for private workloads and private load balancers. * Default: `<>` * Immutable after creation **public\_subnet\_ids** `string_array` **Public subnet IDs.** Used for public load balancers. Terraform defaults to \[] when no public load balancer is enabled. * Default: `<>` * Immutable after creation ### ECS cluster config **name** `string` *required* **ECS cluster name.** Name prefix for all resources. 1-28 characters; at most 27 with a private load balancer, 24 with a public NLB, and 23 with a private NLB. * Default: `<>-<>` * Immutable after creation * Pattern: `^[a-z0-9]([a-z0-9-]{0,26}[a-z0-9])?$` — The name must be 1-28 characters, contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number. **load\_balancer\_deletion\_protection\_enabled** `boolean` **Load balancer deletion protection.** Prevent accidental deletion of load balancers created by this module. * Default: `true` **container\_insights** `string` **Container insights.** Configures CloudWatch Container Insights for the ECS cluster. Enabled by default to satisfy SOC 2 monitoring requirements. Enhanced observability adds detailed task and container metrics and may increase CloudWatch costs. Service running-task alarms depend on Container Insights being enabled. * Default: `enhanced` * Allowed values: `enhanced` (Enhanced observability), `enabled` (Standard), `disabled` (Disabled) **log\_retention\_days** `number` **Default log retention (days).** Inherited by services unless they set their own retention. Never expire keeps logs indefinitely. * Default: `90` * Allowed values: `0` (Never expire), `1` (1 day), `3` (3 days), `5` (5 days), `7` (7 days), `14` (14 days), `30` (30 days), `60` (60 days), `90` (90 days), `120` (120 days), `150` (150 days), `180` (180 days), `365` (365 days), `400` (400 days), `545` (545 days), `731` (731 days), `1096` (1096 days), `1827` (1827 days), `2192` (2192 days), `2557` (2557 days), `2922` (2922 days), `3288` (3288 days), `3653` (3653 days) * Min: `0` ### Managed domains **use\_ravion\_managed\_domains** `boolean` **Ravion-managed domains.** On: add domains on each service; Ravion manages certificates and listener rules. Off: attach certificates here and configure listener rules on each service. Requires one HTTPS-enabled ALB when on. * Default: `false` **ravion\_cluster\_name** `string` *required* **Cluster domain.** Base for service addresses. * Default: `<< module.given_id >>` * Pattern: `^[a-z0-9]([a-z0-9-]*[a-z0-9])?$` — The subdomain must contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number. * Shown when: `{"use_ravion_managed_domains":true}` ### Capacity providers **fargate\_enabled** `boolean` **Fargate.** Allows ECS services in this cluster to use Fargate for serverless task capacity. * Default: `true` **fargate\_spot\_enabled** `boolean` **Fargate spot.** Allows ECS services in this cluster to use Fargate Spot for lower-cost, interruptible serverless task capacity. * Default: `true` **ec2\_instance\_type** `string` **EC2 instance type.** Enables the EC2 capacity provider when set. Leave blank to use only Fargate/Fargate Spot. ### EC2 capacity **ec2\_min\_instances** `number` **Minimum EC2 instances.** Minimum number of EC2 host instances in the Auto Scaling Group (not ECS tasks). To speed up deployments and autoscaling, keep enough spare instance capacity for all ECS services on this cluster; as a starting point, size for about 2x the total desired tasks across those services. * Min: `0` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_max\_instances** `number` **Maximum EC2 instances.** Maximum number of EC2 host instances in the Auto Scaling Group (not ECS tasks). Must be large enough to hold 2x the total maximum tasks across all ECS services on this cluster, otherwise deployments can fail. * Min: `1` * Shown when: `{"ec2_instance_type":{"not":""}}` ### EC2 volume **ec2\_root\_volume\_size** `number` **Root volume size (GB).** Root EBS volume size for EC2 capacity instances. * Min: `8` * Max: `16384` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_security\_group\_ids** `string_array` **Additional security groups.** Additional security groups attached to EC2 capacity instances. * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_spot\_enabled** `boolean` **Spot instances.** Use Spot instances in the EC2 Auto Scaling Group. * Default: `false` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_spot\_instance\_types** `string_array` **Spot instance types.** Additional instance types for Spot capacity. * Shown when: `{"ec2_instance_type":{"not":""},"ec2_spot_enabled":true}` **ec2\_ami\_id** `string` **Custom AMI ID.** Custom AMI for EC2 capacity. Leave blank to use the latest ECS-optimized AMI. * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_key\_name** `string` **SSH key pair name.** Key pair for SSH access to EC2 capacity instances. * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_root\_volume\_type** `string` **Root volume type.** Root EBS volume type. * Allowed values: `gp3`, `gp2`, `io1`, `io2` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_user\_data** `text` **Additional user data.** Additional user data script appended after ECS config. * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_managed\_termination\_protection\_enabled** `boolean` **Managed termination protection.** Managed termination protection for EC2 capacity. * Default: `true` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_managed\_scaling\_enabled** `boolean` **Managed scaling.** Lets ECS automatically scale the EC2 Auto Scaling Group to match task demand. Disable to manage the instance count yourself. * Default: `true` * Shown when: `{"ec2_instance_type":{"not":""}}` **ec2\_managed\_scaling\_target\_capacity** `number` **Managed scaling target capacity (%).** Defaults to 100% which means ECS autoscales EC2 instances to have zero extra capacity (cheapest). Reduce to something like 80-90% if you want to pay for spare capacity for faster autoscaling. * Min: `1` * Max: `100` * Shown when: `{"ec2_instance_type":{"not":""},"ec2_managed_scaling_enabled":true}` ### Public application load balancer **public\_alb\_enabled** `boolean` **Public load balancer.** * Default: `true` **public\_alb\_https\_enabled** `boolean` **HTTPS.** Enable HTTPS listener on the public ALB. * Default: `true` * Shown when: `{"public_alb_enabled":true}` **public\_alb\_certificate** `$ref:rvn-acm-certificate` *required* **Certificate.** Primary ACM certificate module for public ALB HTTPS. * Shown when: `{"public_alb_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}` Set `public_alb_certificate` to `null`. Mapped inputs for `public_alb_certificate`: set these keys alongside `public_alb_certificate`, not inside it, when supplying existing infrastructure instead of a module reference. **public\_alb\_certificate\_arns** `string_array` *required* **Certificate ARNs.** ACM certificate ARNs resolved from the selected module. The first ARN is the default certificate. * Default: `["<>"]` **public\_alb\_additional\_certificate\_arns** `string_array` **Additional certificate ARNs.** Additional ACM certificate ARNs attached to the public ALB HTTPS listener for SNI. * Default: `[]` * Shown when: `{"public_alb_enabled":true,"public_alb_https_enabled":true,"use_ravion_managed_domains":false}` **public\_alb\_ssl\_policy** `string` **SSL policy.** SSL policy for public ALB HTTPS. * Shown when: `{"public_alb_enabled":true,"public_alb_https_enabled":true}` **public\_alb\_idle\_timeout** `number` **Idle timeout (seconds).** Idle timeout for the public ALB. * Min: `1` * Max: `4000` * Shown when: `{"public_alb_enabled":true}` **public\_alb\_web\_acl\_arn** `string` **WAF web ACL ARN.** WAFv2 Web ACL ARN for the public ALB. * Shown when: `{"public_alb_enabled":true}` **public\_alb\_access\_logs\_enabled** `boolean` **Access logs.** Enable public ALB access logging. * Default: `false` * Shown when: `{"public_alb_enabled":true}` **public\_alb\_access\_logs\_bucket\_arn** `string` **Access logs bucket ARN.** Existing S3 bucket ARN for public ALB access logs. * Shown when: `{"public_alb_access_logs_enabled":true,"public_alb_enabled":true}` ### Private application load balancer **private\_alb\_enabled** `boolean` **Private load balancer.** * Default: `false` **private\_alb\_https\_enabled** `boolean` **HTTPS.** Enable HTTPS listener on the private ALB. * Default: `false` * Shown when: `{"private_alb_enabled":true}` **private\_alb\_certificate** `$ref:rvn-acm-certificate` *required* **Certificate.** Primary ACM certificate module for private ALB HTTPS. * Shown when: `{"private_alb_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}` Set `private_alb_certificate` to `null`. Mapped inputs for `private_alb_certificate`: set these keys alongside `private_alb_certificate`, not inside it, when supplying existing infrastructure instead of a module reference. **private\_alb\_certificate\_arns** `string_array` *required* **Certificate ARNs.** ACM certificate ARNs resolved from the selected module. The first ARN is the default certificate. * Default: `["<>"]` **private\_alb\_additional\_certificate\_arns** `string_array` **Additional certificate ARNs.** Additional ACM certificate ARNs attached to the private ALB HTTPS listener for SNI. * Default: `[]` * Shown when: `{"private_alb_enabled":true,"private_alb_https_enabled":true,"use_ravion_managed_domains":false}` **private\_alb\_ssl\_policy** `string` **SSL policy.** SSL policy for private ALB HTTPS. * Shown when: `{"private_alb_enabled":true,"private_alb_https_enabled":true}` **private\_alb\_ingress\_cidr\_blocks** `string_array` **Ingress CIDRs.** Allowed IPv4 CIDRs for private ALB access. Terraform defaults to RFC1918 private ranges. * Shown when: `{"private_alb_enabled":true}` **private\_alb\_ingress\_ipv6\_cidr\_blocks** `string_array` **Ingress IPv6 CIDRs.** Allowed IPv6 CIDRs for private ALB access. Defaults to no IPv6 ingress. * Shown when: `{"private_alb_enabled":true}` **private\_alb\_ingress\_security\_group\_ids** `string_array` **Ingress security groups.** Security groups whose members can access the private ALB. Useful for sources without static CIDRs, such as CloudFront VPC origins. * Shown when: `{"private_alb_enabled":true}` **private\_alb\_idle\_timeout** `number` **Idle timeout (seconds).** Idle timeout for the private ALB. * Min: `1` * Max: `4000` * Shown when: `{"private_alb_enabled":true}` **private\_alb\_access\_logs\_enabled** `boolean` **Access logs.** Enable private ALB access logging. * Default: `false` * Shown when: `{"private_alb_enabled":true}` **private\_alb\_access\_logs\_bucket\_arn** `string` **Access logs bucket ARN.** Existing S3 bucket ARN for private ALB access logs. * Shown when: `{"private_alb_access_logs_enabled":true,"private_alb_enabled":true}` ### Network load balancers **public\_nlb\_enabled** `boolean` **Public NLB.** Create an internet-facing Network Load Balancer. * Default: `false` **public\_nlb\_additional\_security\_group\_ids** `string_array` **Additional security groups.** Additional security groups for the public NLB. * Shown when: `{"public_nlb_enabled":true}` **public\_nlb\_cross\_zone\_load\_balancing\_enabled** `boolean` **Cross-zone load balancing.** Enable cross-zone load balancing for the public NLB. * Default: `false` * Shown when: `{"public_nlb_enabled":true}` **public\_nlb\_elastic\_ips\_enabled** `boolean` **Use elastic IPs.** Assign static Elastic IPs to the public NLB. * Default: `false` * Shown when: `{"public_nlb_enabled":true}` **public\_nlb\_elastic\_ip\_allocation\_ids** `string_array` **Elastic IP allocation IDs.** Elastic IP allocation IDs for the public NLB, one per subnet. * Shown when: `{"public_nlb_elastic_ips_enabled":true,"public_nlb_enabled":true}` **public\_nlb\_access\_logs\_enabled** `boolean` **Access logs.** Enable public NLB access logging. * Default: `false` * Shown when: `{"public_nlb_enabled":true}` **public\_nlb\_access\_logs\_bucket\_arn** `string` **Access logs bucket ARN.** Existing S3 bucket ARN for public NLB access logs. * Shown when: `{"public_nlb_access_logs_enabled":true,"public_nlb_enabled":true}` **private\_nlb\_enabled** `boolean` **Private NLB.** Create an internal Network Load Balancer. * Default: `false` **private\_nlb\_additional\_security\_group\_ids** `string_array` **Additional security groups.** Additional security groups for the private NLB. * Shown when: `{"private_nlb_enabled":true}` **private\_nlb\_cross\_zone\_load\_balancing\_enabled** `boolean` **Cross-zone load balancing.** Enable cross-zone load balancing for the private NLB. * Default: `false` * Shown when: `{"private_nlb_enabled":true}` **private\_nlb\_elastic\_ips\_enabled** `boolean` **Use elastic IPs.** Assign static Elastic IPs to the private NLB. * Default: `false` * Shown when: `{"private_nlb_enabled":true}` **private\_nlb\_elastic\_ip\_allocation\_ids** `string_array` **Elastic IP allocation IDs.** Elastic IP allocation IDs for the private NLB, one per subnet. * Shown when: `{"private_nlb_elastic_ips_enabled":true,"private_nlb_enabled":true}` **private\_nlb\_access\_logs\_enabled** `boolean` **Access logs.** Enable private NLB access logging. * Default: `false` * Shown when: `{"private_nlb_enabled":true}` **private\_nlb\_access\_logs\_bucket\_arn** `string` **Access logs bucket ARN.** Existing S3 bucket ARN for private NLB access logs. * Shown when: `{"private_nlb_access_logs_enabled":true,"private_nlb_enabled":true}` ### Compliance **cloudwatch\_alarms\_creation\_enabled** `boolean` **Create load balancer CloudWatch alarms.** Keep enabled to detect failed or slow requests on both ALBs. Disable if monitored elsewhere. CloudWatch charges apply; NLBs are excluded. * Default: `true` **cloudwatch\_alarm\_elb\_5xx\_threshold** `number` **Load balancer 5xx alarm threshold.** Triggers above this total per period, excluding responses generated by targets. * Default: `10` * Min: `0` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_target\_5xx\_threshold** `number` **Target 5xx alarm threshold.** Triggers above this total per period across all attached target groups. * Default: `10` * Min: `0` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_target\_response\_time\_threshold** `number` **Target response time alarm threshold (seconds).** Triggers when the period average exceeds this value. Must be greater than 0. * Default: `1` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_evaluation\_periods** `number` **Alarm evaluation periods.** Consecutive periods that must breach the threshold. * Default: `2` * Min: `1` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_period** `number` **Alarm period.** Use one minute or longer to match the AWS metric frequency. * Default: `300` * Allowed values: `60` (60 seconds), `300` (5 minutes), `900` (15 minutes), `3600` (1 hour) * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_actions** `string_array` **Alarm actions.** Invoked when entering the alerting state, for example an SNS topic ARN. * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_ok\_actions** `string_array` **OK actions.** Invoked when returning to the healthy state, for example an SNS topic ARN. * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` ### Misc **tags** `keyvalue` **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId` ### Terraform settings **opentofu\_version** `string` **OpenTofu version override.** Override the environment's default version for this module **ravion\_state\_backend\_workspace** `string` **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids. * Immutable after creation **terraform\_plan\_default\_policies\_enabled** `boolean` **Include default plan policies.** Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below. * Default: `true` **terraform\_plan\_iam\_policy\_arns** `string_array` **Terraform plan IAM policies.** IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **terraform\_apply\_default\_policies\_enabled** `boolean` **Include default apply policies.** Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below. * Default: `true` **terraform\_apply\_iam\_policy\_arns** `string_array` **Terraform apply IAM policies.** IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **advanced\_terraform\_variables** `object` **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above. * Default: `{}` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.