rvn-ecs-nlb / Latest version: 2.3.2
See ECS Network Service module reference for the full module page.
IAM roles and policies
string
Execution role ARN override. Optional existing ECS task execution role ARN. Leave blank to let the module create and manage the execution role used for pulling images and writing logs.
string
Task role ARN override. Optional existing ECS task role ARN for application AWS permissions. Leave blank to let the module create a task role and attach the policies configured below.
string_array
Task role policy ARNs. Additional managed IAM policy ARNs to attach to the generated task role. Only used when task role ARN override is blank.
- Default:
[]
object
Task role inline policies. Inline IAM policy documents keyed by policy name.
- Default:
{}
string_array
Execution role policy ARNs. Additional managed IAM policy ARNs to attach to the generated execution role. Only used when execution role ARN override is blank.
- Default:
[]
Networking and deployment
number
Minimum healthy percent. Minimum percentage of desired tasks that must stay healthy during rolling deployments. Keep 100 for zero-downtime deploys. Lower it only when the cluster does not have enough spare capacity to start replacement tasks first, since lowering it can reduce availability during deploys.
- Default:
100 - Min:
0 - Max:
100
number
Maximum percent. Maximum temporary task count during rolling deployments. Keep 200 for fast replacement capacity. Lower it when cluster capacity, IP availability, or burst cost should limit how many extra tasks ECS can start.
- Default:
200 - Min:
100 - Max:
400
number
Stop timeout (secs). Seconds ECS waits after sending SIGTERM to the app container before forcing it to stop with SIGKILL. Raise it so in-flight requests or jobs can finish during deploys and scale-in. Fargate allows 2-120 secs.
- Default:
30 - Min:
2 - Max:
120
string_array
Additional security groups. Additional security group IDs to attach to ECS tasks.
- Default:
[]
string_array
Allowed CIDR blocks. CIDR blocks allowed direct access to the service in addition to load balancer traffic.
- Default:
[]
object_array
Sidecars. Optional containers that run in the same ECS task as the app container. Use sidecars for agents, local proxies, lightweight workers, or helper processes that should share task networking and lifecycle with the app.
- Default:
[]
Persistent storage
boolean
EFS file system. Mount an EFS file system into the app container. The service attaches the file system’s client security group and adds the volume and mount point automatically.
- Default:
false
$ref:rvn-efs
required
EFS file system.
- Shown when:
{"efs_enabled":true}
efs to null.
Mapped inputs for efs: set these keys alongside efs, not inside it, when supplying existing infrastructure instead of a module reference.
string
EFS file system ID.
- Default:
<<ref.stack.output.file_system_id>>
string
EFS access point ID.
- Default:
<<ref.stack.output.access_point_id>>
string
EFS client security group ID.
- Default:
<<ref.stack.output.client_security_group_id>>
string
required
EFS mount path. Path inside the app container where the file system is mounted.
- Default:
/mnt/efs - Pattern:
^/— Use an absolute container path. - Shown when:
{"efs_enabled":true}
boolean
EFS read only. Mount the file system as read-only inside the app container.
- Default:
false - Shown when:
{"efs_enabled":true}
boolean
EFS IAM authorization. Use the task role to authorize file system access. The task role must allow
elasticfilesystem:ClientMount, plus elasticfilesystem:ClientWrite or elasticfilesystem:ClientRootAccess as needed.- Default:
false - Shown when:
{"efs_enabled":true}
Compliance
number
Log retention (days). Leave blank to inherit the cluster setting. Never expire keeps logs indefinitely.
- Allowed values:
0(Never expire),1(1 day),3(3 days),5(5 days),7(7 days),14(14 days),30(30 days),60(60 days),90(90 days),120(120 days),150(150 days),180(180 days),365(365 days),400(400 days),545(545 days),731(731 days),1096(1096 days),1827(1827 days),2192(2192 days),2557(2557 days),2922(2922 days),3288(3288 days),3653(3653 days) - Min:
0
boolean
Create CloudWatch alarms. Keep enabled to detect service degradation. Disable if another system provides equivalent monitoring. CloudWatch charges apply.
- Default:
true
number
CPU alarm threshold (%). Triggers when the period average exceeds this value.
- Default:
80 - Min:
0 - Max:
100 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Memory alarm threshold (%). Triggers when the period average exceeds this value.
- Default:
80 - Min:
0 - Max:
100 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Minimum running tasks. Triggers when the period minimum falls below this value. Requires Container Insights on the cluster.
- Default:
1 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Unhealthy hosts alarm threshold. Evaluated per target group using the period maximum. Set to 0 to detect the first unhealthy target.
- Default:
0 - Min:
0 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Alarm evaluation periods. Consecutive periods that must breach the threshold.
- Default:
2 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Alarm period. Use one minute or longer to match the AWS metric frequency.
- Default:
300 - Allowed values:
60(60 seconds),300(5 minutes),900(15 minutes),3600(1 hour) - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
string_array
Alarm actions. Invoked when entering the alerting state, for example an SNS topic ARN.
- Shown when:
{"cloudwatch_alarms_creation_enabled":true}
string_array
OK actions. Invoked when returning to the healthy state, for example an SNS topic ARN.
- Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Builder config
string
required
Builder capacity type. Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted.
- Default:
sandbox - Allowed values:
sandbox(Sandbox),ec2(EC2),ec2-spot(EC2 spot) - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string
required
Builder instance type. EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds.
- Default:
c7a.4xlarge - Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}
number
required
Builder vCPUs.
- Default:
14 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
number
required
Builder memory (GiB).
- Default:
28 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
number
Builder disk (GiB). Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host.
- Default:
30 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
boolean
Interruptible build. Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations.
- Default:
true - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
string
Builder execution environment. Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment.
- Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string
Builder AMI. Optional AMI ID for build runners. Leave empty to use the default runner image.
- Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}
boolean
Include default build policies. The step’s built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below.
- Default:
true - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string_array
Builder IAM policies. IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build.
- Default:
[] - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
Image registry lifecycle
boolean
Scan images on push. Ask ECR to run its basic vulnerability scan whenever a new image is pushed. Keep this on for early dependency and OS package findings; disable only if another scanner owns image scanning or duplicate findings are noisy. Enabled by default to satisfy SOC 2 vulnerability-scanning requirements.
- Default:
true - Shown when:
{"build_source":["dockerfile","railpack","nixpacks","ecr"]}
boolean
Force delete image repository. Allow the ECR repository to be deleted even when it contains images. Use with care.
- Default:
false - Shown when:
{"build_source":["dockerfile","railpack","nixpacks","ecr"]}
Misc
boolean
Force new deployment. Force ECS to start a new deployment when applying service configuration, even if the task definition did not change.
- Default:
true
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}