> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ECS Worker > Background worker ECS service for running private container workloads without exposed ports. **Type:** `rvn-ecs-worker` · **Latest version:** `0.3.2` ## Dependencies and consumers ```mermaid theme={null} flowchart BT rvn_ecs_worker["ECS Worker"] --> rvn_ecs_cluster["rvn-ecs-cluster"] rvn_ecs_worker -.-> rvn_efs["rvn-efs"] rvn_ecs_cluster --> rvn_aws_network["rvn-aws-network"] rvn_ecs_cluster -.-> rvn_acm_certificate["rvn-acm-certificate"] rvn_efs --> rvn_aws_network class rvn_ecs_worker current class rvn_ecs_cluster,rvn_efs dependency class rvn_aws_network,rvn_acm_certificate upstream classDef current fill:#C4B5FD,stroke:#8B5CF6,color:#3B0764 classDef dependency fill:#FAF8FF,stroke:#DDD6FE,color:#6D28D9 classDef consumer fill:#F3F4F6,stroke:#9CA3AF,color:#4B5563 classDef upstream fill:#F8FAFC,stroke:#CBD5E1,color:#94A3B8 linkStyle 2,3,4 stroke:#CBD5E1,color:#94A3B8 click rvn_ecs_cluster "/module-definitions/catalog/rvn-ecs-cluster" "Open rvn-ecs-cluster docs" click rvn_efs "/module-definitions/catalog/rvn-efs" "Open rvn-efs docs" click rvn_aws_network "/module-definitions/catalog/rvn-aws-network" "Open rvn-aws-network docs" click rvn_acm_certificate "/module-definitions/catalog/rvn-acm-certificate" "Open rvn-acm-certificate docs" ``` *Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.* ## Readme Background worker ECS service for running private container workloads without exposed ports. ### Overview The ECS Worker module creates an ECS service for background jobs, queue consumers, event processors, and other private workloads in an existing Ravion ECS cluster. It uses the same ECS service Terraform module as ECS Web Server, but does not create or attach a load balancer target group and does not expose a primary container port. Terraform source: [flightcontrolhq/modules/compute/ecs\_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-worker@0.3.2/compute/ecs_service) ### Use cases | Scenario | ECS Worker helps by... | | ----------------- | ---------------------------------------------------------------- | | Queue consumers | Running scalable workers for SQS, Kafka, Redis, or custom queues | | Background jobs | Processing async work without public HTTP routing | | Event processors | Running long-lived containers that consume streams or events | | Private workloads | Keeping tasks off external load balancers and public ports | ### Networking Workers do not expose a primary app port and are not registered with an Application Load Balancer. Run in private subnets is enabled by default so tasks stay private while using NAT or equivalent egress for outbound dependencies. Sidecars may still define port mappings for task-local agents, proxies, or helper containers. Those sidecar ports are not exposed through a load balancer by this module. ### Build and deployment Workers support Dockerfile, Railpack, and Pull from image registry deployments. Deployments update the ECS service task definition with the selected image, generated container definition, logs, runtime environment variables, secrets, IAM roles, volumes, sidecars, and selected capacity provider settings. For Railpack builds, you can optionally pin the Railpack version and override install, build, and start commands. For Fargate and Fargate Spot, App ephemeral storage uses the AWS default of 20 GiB unless you increase it to 21-200 GiB. For image registry deployments, use Start command to override the image default CMD when the worker process uses a different command. ### Persistent storage Enable the EFS file system setting, select a Ravion EFS module, and set the EFS mount path. Ravion adds the task volume, mounts it into the worker container, attaches the file system's client security group to the service so NFS traffic is allowed, and mounts through the file system's access point when one is enabled. Sidecars mount the same file system through their Mount points setting with `efs` as the source volume. EFS volumes work with Fargate and EC2 Linux tasks and keep data across task replacement. Transit encryption is enabled by default. Enable EFS IAM authorization to authorize file system access with the task role; the task role must allow elasticfilesystem:ClientMount, plus elasticfilesystem:ClientWrite or elasticfilesystem:ClientRootAccess as needed. ### Autoscaling Autoscaling is enabled by default with CPU and memory target tracking. Use custom metric scaling policies for queue depth, lag, backlog, or other workload-specific metrics that better represent worker demand. When autoscaling is disabled, Desired tasks controls how many worker tasks the ECS service keeps running. ### Configuration | Field | Required | Default | Description | | ------------------------------ | -------- | --------------------------- | ------------------------------------------------------------ | | ECS cluster | Yes | - | Existing rvn-ecs-cluster module instance | | Service name | Yes | \{project}-\{env}-\{module} | Name for the ECS service and related resources | | Run in private subnets | No | true | Run tasks in private subnets without public IPs | | Build source | Yes | dockerfile | Dockerfile, Railpack, or Pull from image registry | | Start command | No | \[] | Command arguments that override an image default CMD | | Capacity provider | Yes | fargate | Primary service capacity provider | | App size | No | 2 vCPU, 4 GB | Fargate task CPU and memory | | App ephemeral storage (GiB) | No | 20 | Fargate task ephemeral storage | | Autoscaling | No | true | Enable CPU and optional memory target tracking | | Desired tasks | Yes\* | 1 | Number of worker tasks when autoscaling is disabled | | Custom metric scaling policies | No | \[] | Queue/backlog-oriented target tracking policies | | Runtime environment variables | No | - | Environment variables passed to the worker container | | Runtime secrets | No | - | Secrets injected from SSM Parameter Store or Secrets Manager | | Sidecars | No | \[] | Additional containers in the worker task | | EFS file system | No | false | Mount an EFS file system into the worker container | | EFS mount path | Yes\* | /mnt/efs | Worker container path for the referenced file system | ### Design decisions * The module intentionally creates an ECS service without load balancer attachment or primary container port mappings. * Sidecar port mappings are allowed for task-local communication, agents, and proxies. * Desired count uses the autoscaling minimum when autoscaling is enabled and the Desired tasks input when autoscaling is disabled. * Advanced Terraform variables exist for exceptional lower-level overrides. Prefer the typed Ravion fields whenever possible. ### Learn more * [Amazon ECS services](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html) * [Amazon ECS capacity providers](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html) * [Amazon ECS service auto scaling](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-auto-scaling.html) ## Inputs reference All inputs for `rvn-ecs-worker` version `0.3.2`. Use the `name` shown for each field as the input key in module config. ### ECS cluster **ECS cluster.** * Immutable after creation ### Worker service **Service name.** Name for the ECS worker service and related resources. * Default: `<>-<>-<>` * Immutable after creation * Pattern: `^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$` — Use 1-255 letters, numbers, underscores, or hyphens, starting with a letter or number. **Run in private subnets.** Recommended. Requires a NAT gateway or equivalent for internet access and keeps worker tasks off public subnets. * Default: `true` ### Build config **Build source.** * Default: `dockerfile` * Allowed values: `dockerfile` (Dockerfile), `railpack` (Railpack), `image_registry` (Pull from image registry) **Git repository.** * Shown when: `{"build_source":["dockerfile","railpack"]}` **Source base path.** Repository-relative source and build root. * Default: `.` * Shown when: `{"build_source":["dockerfile","railpack"]}` **Image repository.** Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`. * Shown when: `{"build_source":"image_registry"}` **Registry credentials secret ARN.** Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR. * Shown when: `{"build_source":"image_registry"}` **Start command.** Optional command arguments that override the image default command. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments. * Default: `[]` * Shown when: `{"build_source":"image_registry"}` ### Docker **Dockerfile path.** Path to the Dockerfile to use for the build, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile"}` **Docker build context path.** Directory to use as the Docker build context, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile"}` ### Railpack **Railpack version.** Optional Railpack version to use for the build. Leave blank to use the Ravion default. * Pattern: `^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$` — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0. * Shown when: `{"build_source":"railpack"}` **Install command.** * Shown when: `{"build_source":"railpack"}` **Build command.** * Shown when: `{"build_source":"railpack"}` **Start command.** * Shown when: `{"build_source":"railpack"}` ### Container resources **Capacity provider.** Choose the primary capacity provider. Most services should use only one provider. * Default: `fargate` * Allowed values: `fargate` (Fargate), `fargate_spot` (Fargate spot), `ec2` (EC2) **Also use Fargate.** Add Fargate to the capacity provider strategy in addition to the primary provider. * Default: `false` * Shown when: `{"capacity_provider":{"not":"fargate"}}` **Also use Fargate spot.** Add lower-cost interruptible Fargate spot capacity in addition to the primary provider. * Default: `false` * Shown when: `{"capacity_provider":{"not":"fargate_spot"}}` **Also use EC2.** Add EC2 capacity from the selected cluster in addition to the primary provider. * Default: `false` * Shown when: `{"capacity_provider":{"not":"ec2"}}` **App size.** CPU and memory for Fargate tasks. Prices are estimated from AWS Fargate pricing for the selected region, architecture, and capacity provider. * Default: `{"memory_gb":4,"vcpu":2}` * Shown when: `{"capacity_provider":["fargate","fargate_spot"]}` **App ephemeral storage (GiB).** Optional ephemeral storage size for each Fargate app task, from 21 to 200 GiB. Leave blank to use the AWS default of 20 GiB. * Min: `21` * Max: `200` * Shown when: `{"capacity_provider":["fargate","fargate_spot"]}` **App vCPU.** vCPU reserved for each app task on EC2 capacity. Leave at least 0.25 vCPU unreserved on each EC2 instance for the ECS agent and system processes. * Default: `1.5` * Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a vCPU value, such as 0.5, 1, or 2. * Shown when: `{"capacity_provider":"ec2"}` **App memory in GB.** Memory reserved for each app task on EC2 capacity. Leave at least 0.5 GB unreserved on each EC2 instance for the ECS agent and system processes. * Default: `3.5` * Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.5, 1, or 4. * Shown when: `{"capacity_provider":"ec2"}` **CPU architecture.** Use x86\_64 for broad compatibility; use ARM64 for lower cost when your image and dependencies support it. * Default: `X86_64` * Allowed values: `X86_64` (x86\_64 - widest compatibility), `ARM64` (ARM64 - lower cost) **ECS exec.** Enable ECS Exec for interactive debugging in running containers. Leave off by default for tighter access control; turn on when operators need shell/debug access through AWS Systems Manager. * Default: `false` ### Autoscaling **Autoscaling.** * Default: `true` **Minimum tasks.** Recommend at least 2 for production. * Default: `1` * Min: `0` * Shown when: `{"auto_scaling_enabled":true}` **Maximum tasks.** * Default: `3` * Min: `1` * Shown when: `{"auto_scaling_enabled":true}` **Desired tasks.** Number of tasks to keep running when autoscaling is disabled. * Default: `1` * Min: `1` * Shown when: `{"auto_scaling_enabled":false}` **CPU target (%).** * Default: `70` * Min: `1` * Max: `100` * Shown when: `{"auto_scaling_enabled":true}` **Memory target (%).** Target average memory utilization for memory-based autoscaling. Leave blank to disable memory autoscaling. * Default: `80` * Min: `1` * Max: `100` * Shown when: `{"auto_scaling_enabled":true}` **Scale-in cooldown (secs).** Time after a scale-in activity before another scale-in can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed. * Default: `300` * Min: `0` * Shown when: `{"auto_scaling_enabled":true}` **Scale-out cooldown (secs).** Time after a scale-out activity before another scale-out can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed. * Default: `300` * Min: `0` * Shown when: `{"auto_scaling_enabled":true}` **Scale in.** Allow autoscaling to reduce task count automatically. * Default: `true` * Shown when: `{"auto_scaling_enabled":true}` **Scheduled scaling actions.** Optional Application Auto Scaling scheduled actions for the ECS service desired count. Each action sets a recurring, one-time, or rate-based schedule and may update the minimum capacity, maximum capacity, or both. * Default: `[]` * Shown when: `{"auto_scaling_enabled":true}` **Action name.** Unique scheduled action name for this ECS service scalable target. AWS allows 1-256 characters and rejects leading/trailing spaces, control characters, colon, slash, and pipe. * Pattern: `^(?! )(?!.* $)(?!.*[\x00-\x1F\x7F-\x9F:/|]).{1,256}$` — Use 1-256 characters with no leading/trailing spaces and no control characters, colon, slash, or pipe. **Schedule expression.** Application Auto Scaling schedule expression: at(yyyy-mm-ddThh:mm:ss), rate(value unit), or cron(fields). Cron normally uses six fields: minutes, hours, day-of-month, month, day-of-week, year. * Pattern: `^(at$.+$|rate$[1-9][0-9]* (minute|minutes|hour|hours|day|days)$|cron$.+$)$` — Use at(...), rate(value minute|minutes|hour|hours|day|days), or cron(...). **Minimum capacity.** Optional desired-count floor to apply when this action runs. Set minimum capacity, maximum capacity, or both. * Min: `0` **Maximum capacity.** Optional desired-count ceiling to apply when this action runs. Set maximum capacity, minimum capacity, or both. * Min: `0` **Time zone.** IANA/Joda-Time canonical time zone used for at() and cron() expressions. Defaults to UTC. Does not affect start\_time or end\_time. * Default: `UTC` * Pattern: `^[A-Za-z_+-]+(?:/[A-Za-z0-9_+.-]+)*$` — Use a canonical IANA/Joda-Time time zone such as UTC, America/New\_York, Etc/GMT+9, or Pacific/Tahiti. **Start time.** Optional UTC boundary for when a recurring scheduled action starts. Terraform expects RFC 3339 format and this value is not affected by timezone. * Pattern: `^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$` — Use UTC RFC 3339 format, for example 2026-01-02T15:04:05Z. **End time.** Optional UTC boundary for when a recurring scheduled action stops. Terraform expects RFC 3339 format and this value is not affected by timezone. * Pattern: `^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$` — Use UTC RFC 3339 format, for example 2026-01-02T23:04:05Z. **Custom metric scaling policies.** Additional target tracking scaling policies using custom CloudWatch metrics. Each policy must use a metric that changes proportionally with ECS service capacity. * Default: `[]` * Shown when: `{"auto_scaling_enabled":true}` **Policy name.** Application Auto Scaling policy name. Terraform/AWS require 1-255 characters and this name must be unique for the scalable target. * Pattern: `^.{1,255}$` — Use 1-255 characters. **Target value.** Target value for the custom metric. Choose a value appropriate for the CloudWatch metric, such as desired average queue depth per task. **Custom metric.** CloudWatch customized metric specification supported by this Terraform module: metric\_name, namespace, statistic, and optional dimensions map. Statistic must be Average, Minimum, Maximum, SampleCount, or Sum. * Default: `{"dimensions":{}}` **Scale-in cooldown seconds.** Seconds after a scale-in activity completes before another scale-in activity can start. * Default: `300` * Min: `0` **Scale-out cooldown seconds.** Seconds to wait for a previous scale-out activity to take effect. * Default: `300` * Min: `0` **Scale in.** Allow this target tracking policy to remove running tasks automatically. * Default: `true` ### Environment variables **Build environment variables.** Environment variables available during builds. Values can be plain strings or references loaded from Parameter Store or Secrets Manager. **Inject environment variables in Dockerfile.** Pass build environment variables into Dockerfile builds as build arguments. * Default: `false` * Shown when: `{"build_source":"dockerfile"}` **Runtime environment variables.** Runtime environment variables passed to the worker container. **Runtime secrets.** Secrets injected into the ECS task at runtime as an array of \{name, value\_from} objects. value\_from can be an SSM parameter or Secrets Manager ARN. ### Pre and post deploy **Run pre-deploy command.** Run a one-off ECS task before updating the ECS service. * Default: `false` **Pre-deploy command.** Command arguments to run before updating the ECS service. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments. * Default: `[]` * Shown when: `{"pre_deploy_enabled":true}` **Pre-deploy environment variables.** Additional environment variables for the pre-deploy task. Runtime environment variables and secrets are already inherited from the app container. * Default: `[]` * Shown when: `{"pre_deploy_enabled":true}` **Pre-deploy CPU units.** Optional CPU units for the pre-deploy task. Leave blank to use the app task CPU setting. * Min: `1` * Shown when: `{"pre_deploy_enabled":true}` **Pre-deploy memory (MiB).** Optional memory in MiB for the pre-deploy task. Leave blank to use the app task memory setting. * Min: `1` * Shown when: `{"pre_deploy_enabled":true}` **Pre-deploy ephemeral storage (GiB).** Optional ephemeral storage size for the pre-deploy task. Leave blank to use the task definition default. * Min: `21` * Max: `200` * Shown when: `{"pre_deploy_enabled":true}` **Pre-deploy timeout (secs).** Maximum time to wait for the pre-deploy task to finish. * Default: `1800` * Min: `1` * Shown when: `{"pre_deploy_enabled":true}` **Run post-deploy command.** Run a one-off ECS task after the ECS service deployment succeeds. * Default: `false` **Post-deploy command.** Command arguments to run after the ECS service deployment succeeds. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments. * Default: `[]` * Shown when: `{"post_deploy_enabled":true}` **Post-deploy environment variables.** Additional environment variables for the post-deploy task. Runtime environment variables and secrets are already inherited from the app container. * Default: `[]` * Shown when: `{"post_deploy_enabled":true}` **Post-deploy CPU units.** Optional CPU units for the post-deploy task. Leave blank to use the app task CPU setting. * Min: `1` * Shown when: `{"post_deploy_enabled":true}` **Post-deploy memory (MiB).** Optional memory in MiB for the post-deploy task. Leave blank to use the app task memory setting. * Min: `1` * Shown when: `{"post_deploy_enabled":true}` **Post-deploy ephemeral storage (GiB).** Optional ephemeral storage size for the post-deploy task. Leave blank to use the task definition default. * Min: `21` * Max: `200` * Shown when: `{"post_deploy_enabled":true}` **Post-deploy timeout (secs).** Maximum time to wait for the post-deploy task to finish. * Default: `1800` * Min: `1` * Shown when: `{"post_deploy_enabled":true}` ### Logging **FireLens log routing.** Routes the app container logs through a Fluent Bit sidecar. CloudWatch output stays enabled by default so Ravion runtime logs continue to work. * Default: `false` **FireLens image.** Container image for the Fluent Bit log router sidecar. * Default: `public.ecr.aws/aws-observability/aws-for-fluent-bit:stable` * Shown when: `{"firelens_enabled":true}` **Additional Fluent Bit config.** Optional Fluent Bit config appended after the generated \[SERVICE] block. Add \[OUTPUT] blocks here for destinations such as Datadog, Splunk, Firehose, OpenSearch, or S3. * Shown when: `{"firelens_enabled":true}` **Keep CloudWatch output enabled.** Recommended. Sends FireLens-routed app logs to the service CloudWatch log group so Ravion runtime logs continue to work. Disable only if all app logs should go exclusively to external destinations. * Default: `true` * Shown when: `{"firelens_enabled":true}` **Add ECS log metadata.** Adds ECS cluster, task, and container metadata to FireLens log records. * Default: `true` * Shown when: `{"firelens_enabled":true}` **FireLens environment variables.** Environment variables passed to the log router sidecar. Use these for non-secret destination options. * Default: `[]` * Shown when: `{"firelens_enabled":true}` **FireLens secrets.** Secrets injected into the log router sidecar as an array of \{name, value\_from} objects. Use these for API keys or tokens stored in SSM Parameter Store or Secrets Manager. * Default: `[]` * Shown when: `{"firelens_enabled":true}` ### IAM roles and policies **Execution role ARN override.** Optional existing ECS task execution role ARN. Leave blank to let the module create and manage the execution role used for pulling images and writing logs. **Task role ARN override.** Optional existing ECS task role ARN for application AWS permissions. Leave blank to let the module create a task role and attach the policies configured below. **Task role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated task role. Only used when task role ARN override is blank. * Default: `[]` **Task role inline policies.** Inline IAM policy documents keyed by policy name. * Default: `{}` **Execution role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated execution role. Only used when execution role ARN override is blank. * Default: `[]` ### Networking and deployment **Minimum healthy percent.** Minimum percentage of desired tasks that must stay healthy during rolling deployments. Keep 100 for zero-downtime deploys. Lower it only when the cluster does not have enough spare capacity to start replacement tasks first, since lowering it can reduce availability during deploys. * Default: `100` * Min: `0` * Max: `200` **Maximum percent.** Maximum temporary task count during rolling deployments. Keep 200 for fast replacement capacity. Lower it when cluster capacity, IP availability, or burst cost should limit how many extra tasks ECS can start. * Default: `200` * Min: `100` * Max: `400` **Additional security groups.** Additional security group IDs to attach to ECS tasks. * Default: `[]` **Allowed CIDR blocks.** CIDR blocks allowed direct access to the service in addition to load balancer traffic. * Default: `[]` **Sidecars.** Optional containers that run in the same ECS task as the app container. Use sidecars for agents, local proxies, lightweight workers, or helper processes that should share task networking and lifecycle with the app. * Default: `[]` **Container name.** Unique name for this sidecar container within the task. * Pattern: `^[A-Za-z0-9_-]{1,255}$` — Use 1-255 characters: letters, numbers, hyphens, and underscores only. **Container image.** Container image URI or registry reference for the sidecar. **Essential container.** When enabled, ECS stops the whole task if this sidecar exits. Leave disabled for optional agents or helpers that should not take down the app. * Default: `false` **CPU units.** Optional CPU units reserved for this sidecar. Increase the task size if sidecars need dedicated CPU. * Min: `0` **Memory limit in MiB.** Optional hard memory limit for this sidecar. ECS stops the container if it exceeds this limit. * Min: `0` **Memory reservation in MiB.** Optional soft memory reservation for this sidecar. Useful for agents that can burst above their normal memory use. * Min: `0` **Environment variables.** Environment variables passed to this sidecar container. * Default: `[]` **Name.** Environment variable name. * Pattern: `^[A-Za-z_][A-Za-z0-9_]*$` — Use a valid environment variable name. **Value.** Environment variable value. **Secrets.** Secrets injected into this sidecar from SSM Parameter Store or Secrets Manager. * Default: `[]` **Name.** Environment variable name exposed to the sidecar. * Pattern: `^[A-Za-z_][A-Za-z0-9_]*$` — Use a valid environment variable name. **Value from.** SSM parameter or Secrets Manager ARN containing the secret value. **Port mappings.** Optional ports exposed by this sidecar inside the task. Most helper sidecars do not need port mappings. * Default: `[]` **Container port.** Port exposed by the sidecar container. * Min: `1` * Max: `65535` **Host port.** Optional host port for EC2 networking modes. Leave empty for awsvpc tasks unless you need a fixed host port. * Min: `1` * Max: `65535` **Protocol.** Network protocol for this port mapping. * Default: `tcp` * Allowed values: `tcp` (TCP), `udp` (UDP) **Application protocol.** Optional application protocol used by service connect integrations. * Allowed values: `http` (HTTP), `http2` (HTTP/2), `grpc` (gRPC) **Mount points.** Optional task volume mounts for this sidecar. Use the volume name `efs` to mount the EFS file system when the EFS file system setting is enabled. * Default: `[]` **Source volume.** Task volume name to mount into the sidecar. Use `efs` for the EFS file system volume. **Container path.** Path inside the sidecar container where the volume is mounted. * Pattern: `^/` — Use an absolute container path. **Read only.** Mount the volume as read-only inside the sidecar. * Default: `false` **Container dependencies.** Optional startup dependencies for this sidecar. Use this when the sidecar should wait for another container to start or become healthy. * Default: `[]` **Container name.** Container this sidecar depends on. **Condition.** Startup condition to wait for before starting this sidecar. * Default: `START` * Allowed values: `START` (Start), `HEALTHY` (Healthy), `COMPLETE` (Complete), `SUCCESS` (Success) **Command.** Optional command arguments that override the image default command. * Default: `[]` **Entry point.** Optional entry point arguments that override the image default entry point. * Default: `[]` **Working directory.** Optional working directory inside the sidecar container. ### Persistent storage **EFS file system.** Mount an EFS file system into the app container. The service attaches the file system's client security group and adds the volume and mount point automatically. * Default: `false` **EFS file system.** * Shown when: `{"efs_enabled":true}` **EFS mount path.** Path inside the app container where the file system is mounted. * Default: `/mnt/efs` * Pattern: `^/` — Use an absolute container path. * Shown when: `{"efs_enabled":true}` **EFS read only.** Mount the file system as read-only inside the app container. * Default: `false` * Shown when: `{"efs_enabled":true}` **EFS IAM authorization.** Use the task role to authorize file system access. The task role must allow `elasticfilesystem:ClientMount`, plus `elasticfilesystem:ClientWrite` or `elasticfilesystem:ClientRootAccess` as needed. * Default: `false` * Shown when: `{"efs_enabled":true}` ### Builder config **Builder instance type.** Use EC2 for quick start or EC2 spot for cheaper, but potentially delayed builds. * Default: `ec2` * Allowed values: `ec2` (EC2), `ec2-spot` (EC2 spot) * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **Builder instance size.** EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds. * Default: `c7a.4xlarge` * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **Builder execution environment.** Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment. * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **Builder AMI.** Optional AMI ID for build runners. Leave empty to use the default runner image. * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` ### Image registry lifecycle **Scan images on push.** Ask ECR to run its basic vulnerability scan whenever a new image is pushed. Keep this on for early dependency and OS package findings; disable only if another scanner owns image scanning or duplicate findings are noisy. * Default: `true` * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **Force delete image repository.** Allow the ECR repository to be deleted even when it contains images. Use with care. * Default: `false` * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` ### Misc **Force new deployment.** Force ECS to start a new deployment when applying service configuration, even if the task definition did not change. * Default: `true` **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId` ### Terraform settings **OpenTofu version override.** Override the environment's default version for this module **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids. * Immutable after creation **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above. * Default: `{}`