> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ECS Network Service inputs: IAM roles and policies to terraform settings

> Reference the ECS Network Service module's IAM roles and policies, Networking and deployment, Persistent storage, Compliance, Builder config and more inputs.

**Type:** `rvn-ecs-nlb` / **Latest version:** `2.3.2`

See [ECS Network Service module reference](/docs/module-definitions/catalog/rvn-ecs-nlb) for the full module page.

### IAM roles and policies

**execution\_role\_arn** `string`

**Execution role ARN override.** Optional existing ECS task execution role ARN. Leave blank to let the module create and manage the execution role used for pulling images and writing logs.

**task\_role\_arn** `string`

**Task role ARN override.** Optional existing ECS task role ARN for application AWS permissions. Leave blank to let the module create a task role and attach the policies configured below.

**task\_role\_policies** `string_array`

**Task role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated task role. Only used when task role ARN override is blank.

* Default: `[]`

**task\_role\_inline\_policies** `object`

**Task role inline policies.** Inline IAM policy documents keyed by policy name.

* Default: `{}`

**execution\_role\_policies** `string_array`

**Execution role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated execution role. Only used when execution role ARN override is blank.

* Default: `[]`

### Networking and deployment

**deployment\_minimum\_healthy\_percent** `number`

**Minimum healthy percent.** Minimum percentage of desired tasks that must stay healthy during rolling deployments. Keep 100 for zero-downtime deploys. Lower it only when the cluster does not have enough spare capacity to start replacement tasks first, since lowering it can reduce availability during deploys.

* Default: `100`
* Min: `0`
* Max: `100`

**deployment\_maximum\_percent** `number`

**Maximum percent.** Maximum temporary task count during rolling deployments. Keep 200 for fast replacement capacity. Lower it when cluster capacity, IP availability, or burst cost should limit how many extra tasks ECS can start.

* Default: `200`
* Min: `100`
* Max: `400`

**stop\_timeout** `number`

**Stop timeout (secs).** Seconds ECS waits after sending SIGTERM to the app container before forcing it to stop with SIGKILL. Raise it so in-flight requests or jobs can finish during deploys and scale-in. Fargate allows 2-120 secs.

* Default: `30`
* Min: `2`
* Max: `120`

**security\_group\_ids** `string_array`

**Additional security groups.** Additional security group IDs to attach to ECS tasks.

* Default: `[]`

**allowed\_cidr\_blocks** `string_array`

**Allowed CIDR blocks.** CIDR blocks allowed direct access to the service in addition to load balancer traffic.

* Default: `[]`

**sidecars** `object_array`

**Sidecars.** Optional containers that run in the same ECS task as the app container. Use sidecars for agents, local proxies, lightweight workers, or helper processes that should share task networking and lifecycle with the app.

* Default: `[]`

**item fields**

**name** `string` *required*

**Container name.** Unique name for this sidecar container within the task.

* Pattern: `^[A-Za-z0-9_-]{1,255}$` — Use 1-255 characters: letters, numbers, hyphens, and underscores only.

**image** `string` *required*

**Container image.** Container image URI or registry reference for the sidecar.

**essential** `boolean`

**Essential container.** When enabled, ECS stops the whole task if this sidecar exits. Leave disabled for optional agents or helpers that should not take down the app.

* Default: `false`

**cpu** `string`

**CPU.** Optional CPU reserved for this sidecar, where 1 is one vCPU. Increase the task size if sidecars need dedicated CPU.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a CPU value in vCPU, such as 0.125, 0.25, or 1.

**memory** `string`

**Memory limit.** Optional hard memory limit for this sidecar, where 1 is 1 GB. ECS stops the container if it exceeds this limit.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.125, 0.25, or 1.

**memory\_reservation** `string`

**Memory reservation.** Optional soft memory reservation for this sidecar, where 1 is 1 GB. Useful for agents that can burst above their normal memory use.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.125, 0.25, or 1.

**environment** `object_array`

**Environment variables.** Environment variables passed to this sidecar container.

* Default: `[]`

**item fields**

**name** `string` *required*

**Name.** Environment variable name.

* Pattern: `^[A-Za-z_][A-Za-z0-9_]*$` — Use a valid environment variable name.

**value** `string` *required*

**Value.** Environment variable value.

**secrets** `object_array`

**Secrets.** Secrets injected into this sidecar from SSM Parameter Store or Secrets Manager.

* Default: `[]`

**item fields**

**name** `string` *required*

**Name.** Environment variable name exposed to the sidecar.

* Pattern: `^[A-Za-z_][A-Za-z0-9_]*$` — Use a valid environment variable name.

**value\_from** `string` *required*

**Value from.** SSM parameter or Secrets Manager ARN containing the secret value.

**port\_mappings** `object_array`

**Port mappings.** Optional ports exposed by this sidecar inside the task. Most helper sidecars do not need port mappings.

* Default: `[]`

**item fields**

**container\_port** `number` *required*

**Container port.** Port exposed by the sidecar container.

* Min: `1`
* Max: `65535`

**host\_port** `number`

**Host port.** Optional host port for EC2 networking modes. Leave empty for awsvpc tasks unless you need a fixed host port.

* Min: `1`
* Max: `65535`

**protocol** `string`

**Protocol.** Network protocol for this port mapping.

* Default: `tcp`
* Allowed values: `tcp` (TCP), `udp` (UDP)

**app\_protocol** `string`

**Application protocol.** Optional application protocol used by service connect integrations.

* Allowed values: `http` (HTTP), `http2` (HTTP/2), `grpc` (gRPC)

**mount\_points** `object_array`

**Mount points.** Optional task volume mounts for this sidecar. Use the volume name `efs` to mount the EFS file system when the EFS file system setting is enabled.

* Default: `[]`

**item fields**

**source\_volume** `string` *required*

**Source volume.** Task volume name to mount into the sidecar. Use `efs` for the EFS file system volume.

**container\_path** `string` *required*

**Container path.** Path inside the sidecar container where the volume is mounted.

* Pattern: `^/` — Use an absolute container path.

**read\_only** `boolean`

**Read only.** Mount the volume as read-only inside the sidecar.

* Default: `false`

**depends\_on** `object_array`

**Container dependencies.** Optional startup dependencies for this sidecar. Use this when the sidecar should wait for another container to start or become healthy.

* Default: `[]`

**item fields**

**container\_name** `string` *required*

**Container name.** Container this sidecar depends on.

**condition** `string` *required*

**Condition.** Startup condition to wait for before starting this sidecar.

* Default: `START`
* Allowed values: `START` (Start), `HEALTHY` (Healthy), `COMPLETE` (Complete), `SUCCESS` (Success)

**command** `string_array`

**Command.** Optional command arguments that override the image default command.

* Default: `[]`

**entry\_point** `string_array`

**Entry point.** Optional entry point arguments that override the image default entry point.

* Default: `[]`

**working\_directory** `string`

**Working directory.** Optional working directory inside the sidecar container.

### Persistent storage

**efs\_enabled** `boolean`

**EFS file system.** Mount an EFS file system into the app container. The service attaches the file system's client security group and adds the volume and mount point automatically.

* Default: `false`

**efs** `$ref:rvn-efs` *required*

**EFS file system.**

* Shown when: `{"efs_enabled":true}`

Set `efs` to `null`.
Mapped inputs for `efs`: set these keys alongside `efs`, not inside it, when supplying existing infrastructure instead of a module reference.

**efs\_file\_system\_id** `string`

**EFS file system ID.**

* Default: `<<ref.stack.output.file_system_id>>`

**efs\_access\_point\_id** `string`

**EFS access point ID.**

* Default: `<<ref.stack.output.access_point_id>>`

**efs\_client\_security\_group\_id** `string`

**EFS client security group ID.**

* Default: `<<ref.stack.output.client_security_group_id>>`

**efs\_mount\_path** `string` *required*

**EFS mount path.** Path inside the app container where the file system is mounted.

* Default: `/mnt/efs`
* Pattern: `^/` — Use an absolute container path.
* Shown when: `{"efs_enabled":true}`

**efs\_read\_only** `boolean`

**EFS read only.** Mount the file system as read-only inside the app container.

* Default: `false`
* Shown when: `{"efs_enabled":true}`

**efs\_iam\_authorization** `boolean`

**EFS IAM authorization.** Use the task role to authorize file system access. The task role must allow `elasticfilesystem:ClientMount`, plus `elasticfilesystem:ClientWrite` or `elasticfilesystem:ClientRootAccess` as needed.

* Default: `false`
* Shown when: `{"efs_enabled":true}`

### Compliance

**log\_retention\_days** `number`

**Log retention (days).** Leave blank to inherit the cluster setting. Never expire keeps logs indefinitely.

* Allowed values: `0` (Never expire), `1` (1 day), `3` (3 days), `5` (5 days), `7` (7 days), `14` (14 days), `30` (30 days), `60` (60 days), `90` (90 days), `120` (120 days), `150` (150 days), `180` (180 days), `365` (365 days), `400` (400 days), `545` (545 days), `731` (731 days), `1096` (1096 days), `1827` (1827 days), `2192` (2192 days), `2557` (2557 days), `2922` (2922 days), `3288` (3288 days), `3653` (3653 days)
* Min: `0`

**cloudwatch\_alarms\_creation\_enabled** `boolean`

**Create CloudWatch alarms.** Keep enabled to detect service degradation. Disable if another system provides equivalent monitoring. CloudWatch charges apply.

* Default: `true`

**cloudwatch\_alarm\_cpu\_threshold** `number`

**CPU alarm threshold (%).** Triggers when the period average exceeds this value.

* Default: `80`
* Min: `0`
* Max: `100`
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_memory\_threshold** `number`

**Memory alarm threshold (%).** Triggers when the period average exceeds this value.

* Default: `80`
* Min: `0`
* Max: `100`
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_running\_tasks\_minimum** `number`

**Minimum running tasks.** Triggers when the period minimum falls below this value. Requires Container Insights on the cluster.

* Default: `1`
* Min: `1`
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_unhealthy\_hosts\_threshold** `number`

**Unhealthy hosts alarm threshold.** Evaluated per target group using the period maximum. Set to 0 to detect the first unhealthy target.

* Default: `0`
* Min: `0`
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_evaluation\_periods** `number`

**Alarm evaluation periods.** Consecutive periods that must breach the threshold.

* Default: `2`
* Min: `1`
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_period** `number`

**Alarm period.** Use one minute or longer to match the AWS metric frequency.

* Default: `300`
* Allowed values: `60` (60 seconds), `300` (5 minutes), `900` (15 minutes), `3600` (1 hour)
* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_alarm\_actions** `string_array`

**Alarm actions.** Invoked when entering the alerting state, for example an SNS topic ARN.

* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

**cloudwatch\_ok\_actions** `string_array`

**OK actions.** Invoked when returning to the healthy state, for example an SNS topic ARN.

* Shown when: `{"cloudwatch_alarms_creation_enabled":true}`

### Builder config

**build\_capacity\_type** `string` *required*

**Builder capacity type.** Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted.

* Default: `sandbox`
* Allowed values: `sandbox` (Sandbox), `ec2` (EC2), `ec2-spot` (EC2 spot)
* Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}`

**build\_instance\_type** `string` *required*

**Builder instance type.** EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds.

* Default: `c7a.4xlarge`
* Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}`

**build\_cpu** `number` *required*

**Builder vCPUs.**

* Default: `14`
* Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}`

**build\_memory** `number` *required*

**Builder memory (GiB).**

* Default: `28`
* Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}`

**build\_disk** `number`

**Builder disk (GiB).** Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host.

* Default: `30`
* Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}`

**build\_interruptible\_enabled** `boolean`

**Interruptible build.** Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations.

* Default: `true`
* Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}`

**build\_execution\_environment\_id** `string`

**Builder execution environment.** Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment.

* Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}`

**build\_ami\_id** `string`

**Builder AMI.** Optional AMI ID for build runners. Leave empty to use the default runner image.

* Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}`

**build\_default\_policies\_enabled** `boolean`

**Include default build policies.** The step's built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below.

* Default: `true`
* Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}`

**build\_iam\_policy\_arns** `string_array`

**Builder IAM policies.** IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build.

* Default: `[]`
* Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}`

### Image registry lifecycle

**ecr\_scan\_on\_push\_enabled** `boolean`

**Scan images on push.** Ask ECR to run its basic vulnerability scan whenever a new image is pushed. Keep this on for early dependency and OS package findings; disable only if another scanner owns image scanning or duplicate findings are noisy. Enabled by default to satisfy SOC 2 vulnerability-scanning requirements.

* Default: `true`
* Shown when: `{"build_source":["dockerfile","railpack","nixpacks","ecr"]}`

**ecr\_force\_deletion\_enabled** `boolean`

**Force delete image repository.** Allow the ECR repository to be deleted even when it contains images. Use with care.

* Default: `false`
* Shown when: `{"build_source":["dockerfile","railpack","nixpacks","ecr"]}`

### Misc

**new\_deployment\_forcing\_enabled** `boolean`

**Force new deployment.** Force ECS to start a new deployment when applying service configuration, even if the task definition did not change.

* Default: `true`

**tags** `keyvalue`

**Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId`

### Terraform settings

**opentofu\_version** `string`

**OpenTofu version override.** Override the environment's default version for this module

**ravion\_state\_backend\_workspace** `string`

**Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

* Immutable after creation

**terraform\_plan\_default\_policies\_enabled** `boolean`

**Include default plan policies.** Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.

* Default: `true`

**terraform\_plan\_iam\_policy\_arns** `string_array`

**Terraform plan IAM policies.** IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\<AWS account number> bucket in this account.

* Default: `[]`

**terraform\_apply\_default\_policies\_enabled** `boolean`

**Include default apply policies.** Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.

* Default: `true`

**terraform\_apply\_iam\_policy\_arns** `string_array`

**Terraform apply IAM policies.** IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\<AWS account number> bucket in this account.

* Default: `[]`

**advanced\_terraform\_variables** `object`

**Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

* Default: `{}`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.