> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ECS Worker inputs: ECS cluster to iAM roles and policies

> Reference the ECS Worker module's ECS cluster, Worker service, Build config, Docker, Railpack, Container resources, Autoscaling and more inputs.

**Type:** `rvn-ecs-worker` / **Latest version:** `2.2.2`

See [ECS Worker module reference](/docs/module-definitions/catalog/rvn-ecs-worker) for the full module page.

### ECS cluster

**cluster** `$ref:rvn-ecs-cluster` *required*

**Cluster.**

* Immutable after creation

Set `cluster` to `null`.
Mapped inputs for `cluster`: set these keys alongside `cluster`, not inside it, when supplying existing infrastructure instead of a module reference.

**aws\_account\_id** `string`

**AWS account.**

* Default: `<<ref.input.aws_account_id>>`
* Immutable after creation

**aws\_region** `string`

**Region.**

* Default: `<<ref.input.aws_region>>`
* Immutable after creation

**execution\_environment\_id** `string`

**Terraform execution environment.** Terraform execution environment inherited from the selected ECS cluster.

* Default: `<< ref.input.execution_environment_id >>`

**cluster\_arn** `string` *required*

**Cluster ARN.**

* Default: `<<ref.stack.output.cluster_arn>>`
* Immutable after creation

**cluster\_log\_retention\_days** `number`

**Cluster default log retention (days).** Default CloudWatch Logs retention inherited from the selected ECS cluster. Override it per service in the Compliance section.

* Default: `<<ref.stack.output.log_retention_days>>`

**vpc\_id** `string` *required*

**VPC ID.**

* Default: `<<ref.input.vpc_id>>`
* Immutable after creation

**private\_subnet\_ids** `string_array` *required*

**Private subnet IDs.** Private subnets available from the selected ECS cluster network.

* Default: `<<ref.input.private_subnet_ids>>`
* Immutable after creation

**public\_subnet\_ids** `string_array`

**Public subnet IDs.** Public subnets available from the selected ECS cluster network.

* Default: `<<ref.input.public_subnet_ids>>`
* Immutable after creation

**subnet\_ids** `string_array`

**Private subnet IDs.** Legacy service subnet override. Leave blank to derive subnets from the public/private service setting.

* Default: `<<ref.input.private_subnet_ids>>`
* Immutable after creation

**section\_cluster\_capacity** `section`

**Cluster capacity providers.**

**fargate\_capacity\_provider\_name** `string`

**Fargate capacity provider.**

* Default: `<<ref.stack.output.fargate_capacity_provider_name>>`
* Immutable after creation

**fargate\_spot\_capacity\_provider\_name** `string`

**Fargate spot capacity provider.**

* Default: `<<ref.stack.output.fargate_spot_capacity_provider_name>>`
* Immutable after creation

**ec2\_capacity\_provider\_name** `string`

**EC2 capacity provider.** EC2 capacity provider name from the selected cluster.

* Default: `<<ref.stack.output.ec2_capacity_provider_name>>`
* Immutable after creation

### Worker service

**name** `string` *required*

**Service name.** Name for the ECS worker service and related resources.

* Default: `<<project.given_id>>-<<environment.given_id>>-<<module.given_id>>`
* Immutable after creation
* Pattern: `^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$` — Use 1-255 letters, numbers, underscores, or hyphens, starting with a letter or number.

**private\_subnet\_placement\_enabled** `boolean`

**Run in private subnets.** Recommended. Requires a NAT gateway or equivalent for internet access and keeps worker tasks off public subnets.

* Default: `true`

### Build config

**build\_source** `string` *required*

**Build source.**

* Default: `dockerfile`
* Allowed values: `dockerfile` (Dockerfile), `railpack` (Railpack), `image_registry` (Pull from image registry), `ecr` (Managed ECR repository)

**source\_repo** `gitrepo` *required*

**Git repository.** Repository containing the application source for Dockerfile or Railpack builds.

* Shown when: `{"build_source":["dockerfile","railpack"]}`

**source\_base\_path** `string`

**Source base path.** Repository-relative source and build root.

* Default: `.`
* Shown when: `{"build_source":["dockerfile","railpack"]}`

**image\_repository** `string` *required*

**Image repository.** Image repository without a tag or digest, such as `nginx`, `ghcr.io/org/app`, or `123456789012.dkr.ecr.us-east-1.amazonaws.com/app`.

* Shown when: `{"build_source":"image_registry"}`

**image\_registry\_credentials\_secret\_arn** `string`

**Registry credentials secret ARN.** Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.

* Shown when: `{"build_source":"image_registry"}`

**image\_start\_command** `string_array`

**Start command.** Optional command arguments that override the image default command. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.

* Default: `[]`
* Shown when: `{"build_source":["image_registry","ecr"]}`

### Docker

**dockerfile** `string`

**Dockerfile path.** Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.

* Shown when: `{"build_source":"dockerfile"}`

**dockerfile\_context** `string`

**Docker build context path.** Directory to use as the Docker build context, relative to the repository root or configured source base path.

* Shown when: `{"build_source":"dockerfile"}`

### Railpack

**railpack\_version** `string`

**Railpack version.** Optional Railpack version to use for the build. Leave blank to use the Ravion default.

* Pattern: `^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$` — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0.
* Shown when: `{"build_source":"railpack"}`

**railpack\_install\_cmd** `string`

**Install command.** Optional dependency installation command. Leave blank to use Railpack detection.

* Shown when: `{"build_source":"railpack"}`

**railpack\_build\_cmd** `string`

**Build command.** Optional application build command. Leave blank to use Railpack detection.

* Shown when: `{"build_source":"railpack"}`

**railpack\_start\_cmd** `string`

**Start command.**

* Shown when: `{"build_source":"railpack"}`

### Container resources

**capacity\_provider** `string` *required*

**Capacity provider.** Choose the primary capacity provider. Most services should use only one provider.

* Default: `fargate`
* Allowed values: `fargate` (Fargate), `fargate_spot` (Fargate spot), `ec2` (EC2)

**additional\_fargate\_capacity\_enabled** `boolean`

**Also use Fargate.** Add Fargate to the capacity provider strategy in addition to the primary provider.

* Default: `false`
* Shown when: `{"capacity_provider":{"not":"fargate"}}`

**additional\_fargate\_spot\_capacity\_enabled** `boolean`

**Also use Fargate spot.** Add lower-cost interruptible Fargate spot capacity in addition to the primary provider.

* Default: `false`
* Shown when: `{"capacity_provider":{"not":"fargate_spot"}}`

**additional\_ec2\_capacity\_enabled** `boolean`

**Also use EC2.** Add EC2 capacity from the selected cluster in addition to the primary provider.

* Default: `false`
* Shown when: `{"capacity_provider":{"not":"ec2"}}`

**fargate\_size** `compound` *required*

**App size.** CPU and memory for Fargate tasks. Prices are estimated from AWS Fargate pricing for the selected region, architecture, and capacity provider.

* Default: `{"memory_gb":4,"vcpu":2}`
* Shown when: `{"capacity_provider":["fargate","fargate_spot"]}`

**task\_ephemeral\_storage\_size\_gib** `number`

**App ephemeral storage (GiB).** Optional ephemeral storage size for each Fargate app task, from 21 to 200 GiB. Leave blank to use the AWS default of 20 GiB.

* Min: `21`
* Max: `200`
* Shown when: `{"capacity_provider":["fargate","fargate_spot"]}`

**task\_cpu** `string` *required*

**App vCPU.** vCPU reserved for each app task on EC2 capacity. Leave at least 0.25 vCPU unreserved on each EC2 instance for the ECS agent and system processes.

* Default: `1.5`
* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a vCPU value, such as 0.5, 1, or 2.
* Shown when: `{"capacity_provider":"ec2"}`

**task\_memory** `string` *required*

**App memory in GB.** Memory reserved for each app task on EC2 capacity. Leave at least 0.5 GB unreserved on each EC2 instance for the ECS agent and system processes.

* Default: `3.5`
* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.5, 1, or 4.
* Shown when: `{"capacity_provider":"ec2"}`

**cpu\_architecture** `string`

**CPU architecture.** Use x86\_64 for broad compatibility; use ARM64 for lower cost when your image and dependencies support it.

* Default: `X86_64`
* Allowed values: `X86_64` (x86\_64 - widest compatibility), `ARM64` (ARM64 - lower cost)

**execute\_command\_enabled** `boolean`

**ECS exec.** Enable ECS Exec for interactive debugging in running containers. Leave off by default for tighter access control; turn on when operators need shell/debug access through AWS Systems Manager.

* Default: `false`

### Autoscaling

**auto\_scaling\_enabled** `boolean`

**Autoscaling.**

* Default: `true`

**min\_tasks** `number`

**Minimum tasks.** Recommend at least 2 for production.

* Default: `1`
* Min: `0`
* Shown when: `{"auto_scaling_enabled":true}`

**max\_tasks** `number`

**Maximum tasks.**

* Default: `3`
* Min: `1`
* Shown when: `{"auto_scaling_enabled":true}`

**desired\_tasks** `number`

**Desired tasks.** Number of tasks to keep running when autoscaling is disabled.

* Default: `1`
* Min: `1`
* Shown when: `{"auto_scaling_enabled":false}`

**cpu\_target\_value** `number`

**CPU target (%).**

* Default: `70`
* Min: `1`
* Max: `100`
* Shown when: `{"auto_scaling_enabled":true}`

**memory\_target\_value** `number`

**Memory target (%).** Target average memory utilization for memory-based autoscaling. Leave blank to disable memory autoscaling.

* Default: `80`
* Min: `1`
* Max: `100`
* Shown when: `{"auto_scaling_enabled":true}`

**scale\_in\_cooldown** `number`

**Scale-in cooldown (secs).** Time after a scale-in activity before another scale-in can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

* Default: `300`
* Min: `0`
* Shown when: `{"auto_scaling_enabled":true}`

**scale\_out\_cooldown** `number`

**Scale-out cooldown (secs).** Time after a scale-out activity before another scale-out can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

* Default: `300`
* Min: `0`
* Shown when: `{"auto_scaling_enabled":true}`

**scale\_in\_enabled** `boolean`

**Scale in.** Allow autoscaling to reduce task count automatically.

* Default: `true`
* Shown when: `{"auto_scaling_enabled":true}`

**scheduled\_scaling** `object_array`

**Scheduled scaling actions.** Optional Application Auto Scaling scheduled actions for the ECS service desired tasks. Each action sets a recurring, one-time, or rate-based schedule and may update the minimum tasks, maximum tasks, or both.

* Default: `[]`
* Shown when: `{"auto_scaling_enabled":true}`

**item fields**

**name** `string` *required*

**Action name.** Unique scheduled action name for this ECS service scalable target. AWS allows 1-256 characters and rejects leading/trailing spaces, control characters, colon, slash, and pipe.

* Pattern: `^(?! )(?!.* $)(?!.*[\x00-\x1F\x7F-\x9F:/|]).{1,256}$` — Use 1-256 characters with no leading/trailing spaces and no control characters, colon, slash, or pipe.

**schedule** `string` *required*

**Schedule expression.** Application Auto Scaling schedule expression: at(yyyy-mm-ddThh:mm:ss), rate(value unit), or cron(fields). Cron normally uses six fields: minutes, hours, day-of-month, month, day-of-week, year.

* Pattern: `^(at\(.+\)|rate\([1-9][0-9]* (minute|minutes|hour|hours|day|days)\)|cron\(.+\))$` — Use at(...), rate(value minute|minutes|hour|hours|day|days), or cron(...).

**min\_tasks** `number`

**Minimum tasks.** Optional desired-task floor to apply when this action runs. Set minimum tasks, maximum tasks, or both.

* Min: `0`

**max\_tasks** `number`

**Maximum tasks.** Optional desired-task ceiling to apply when this action runs. Set maximum tasks, minimum tasks, or both.

* Min: `0`

**timezone** `string`

**Time zone.** IANA/Joda-Time canonical time zone used for at() and cron() expressions. Defaults to UTC. Does not affect start\_time or end\_time.

* Default: `UTC`
* Pattern: `^[A-Za-z_+-]+(?:/[A-Za-z0-9_+.-]+)*$` — Use a canonical IANA/Joda-Time time zone such as UTC, America/New\_York, Etc/GMT+9, or Pacific/Tahiti.

**start\_time** `string`

**Start time.** Optional UTC boundary for when a recurring scheduled action starts. Terraform expects RFC 3339 format and this value is not affected by timezone.

* Pattern: `^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$` — Use UTC RFC 3339 format, for example 2026-01-02T15:04:05Z.

**end\_time** `string`

**End time.** Optional UTC boundary for when a recurring scheduled action stops. Terraform expects RFC 3339 format and this value is not affected by timezone.

* Pattern: `^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$` — Use UTC RFC 3339 format, for example 2026-01-02T23:04:05Z.

**custom\_metric\_scaling\_policies** `object_array`

**Custom metric scaling policies.** Additional target tracking scaling policies using custom CloudWatch metrics. Each policy must use a metric that changes proportionally with ECS service capacity.

* Default: `[]`
* Shown when: `{"auto_scaling_enabled":true}`

**item fields**

**policy\_name** `string` *required*

**Policy name.** Application Auto Scaling policy name. Terraform/AWS require 1-255 characters and this name must be unique for the scalable target. The names cpu, memory, and request\_count are used by the built-in policies.

* Pattern: `^.{1,255}$` — Use 1-255 characters.

**target\_value** `number` *required*

**Target value.** Target value for the custom metric. Choose a value appropriate for the CloudWatch metric, such as desired average queue depth per task.

**custom\_metric** `object` *required*

**Custom metric.** CloudWatch customized metric specification supported by this Terraform module: metric\_name, namespace, statistic, and optional dimensions map. Statistic must be Average, Minimum, Maximum, SampleCount, or Sum.

* Default: `{"dimensions":{}}`

**scale\_in\_cooldown** `number`

**Scale-in cooldown seconds.** Seconds after a scale-in activity completes before another scale-in activity can start.

* Default: `300`
* Min: `0`

**scale\_out\_cooldown** `number`

**Scale-out cooldown seconds.** Seconds to wait for a previous scale-out activity to take effect.

* Default: `300`
* Min: `0`

**scale\_in\_enabled** `boolean`

**Scale in.** Allow this target tracking policy to remove running tasks automatically.

* Default: `true`

### Environment variables

**build\_environment\_variables** `object`

**Build environment variables.** Only available during the build, not at runtime. Use environment variables or secrets for runtime values.

**dockerfile\_environment\_variable\_injection\_enabled** `boolean`

**Inject environment variables in Dockerfile.** Pass build environment variables into Dockerfile builds as build arguments.

* Default: `false`
* Shown when: `{"build_source":"dockerfile"}`

**environment\_variables** `array`

**Runtime environment variables.** Runtime environment variables passed to the worker container.

**secrets** `array`

**Runtime secrets.** Secrets injected into the ECS task at runtime, as an array of objects with `name` and `value_from` keys (snake\_case, not `valueFrom`). value\_from is an SSM Parameter Store or Secrets Manager ARN.

### Pre and post deploy

**pre\_deploy\_enabled** `boolean`

**Run pre-deploy command.** Run a one-off ECS task before updating the ECS service.

* Default: `false`

**pre\_deploy\_command** `string_array` *required*

**Pre-deploy command.** Command arguments to run before updating the ECS service. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.

* Default: `[]`
* Shown when: `{"pre_deploy_enabled":true}`

**pre\_deploy\_environment\_variables** `array`

**Pre-deploy environment variables.** Additional environment variables for the pre-deploy task. Runtime environment variables and secrets are already inherited from the app container.

* Default: `[]`
* Shown when: `{"pre_deploy_enabled":true}`

**pre\_deploy\_cpu** `string`

**Pre-deploy CPU.** Optional CPU for the pre-deploy task, where 1 is one vCPU. Leave blank to use the app task CPU.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a CPU value in vCPU, such as 0.5, 1, or 2.
* Shown when: `{"pre_deploy_enabled":true}`

**pre\_deploy\_memory** `string`

**Pre-deploy memory.** Optional memory for the pre-deploy task, where 1 is 1 GB. Leave blank to use the app task memory.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.5, 1, or 4.
* Shown when: `{"pre_deploy_enabled":true}`

**pre\_deploy\_ephemeral\_storage\_size\_gib** `number`

**Pre-deploy ephemeral storage (GiB).** Optional ephemeral storage size for the pre-deploy task. Leave blank to use the task definition default.

* Min: `21`
* Max: `200`
* Shown when: `{"pre_deploy_enabled":true}`

**pre\_deploy\_timeout** `number`

**Pre-deploy timeout (secs).** Maximum time to wait for the pre-deploy task to finish.

* Default: `1800`
* Min: `1`
* Shown when: `{"pre_deploy_enabled":true}`

**post\_deploy\_enabled** `boolean`

**Run post-deploy command.** Run a one-off ECS task after the ECS service deployment succeeds.

* Default: `false`

**post\_deploy\_command** `string_array` *required*

**Post-deploy command.** Command arguments to run after the ECS service deployment succeeds. For shell behavior, use `/bin/sh`, `-lc`, and your command string as separate arguments.

* Default: `[]`
* Shown when: `{"post_deploy_enabled":true}`

**post\_deploy\_environment\_variables** `array`

**Post-deploy environment variables.** Additional environment variables for the post-deploy task. Runtime environment variables and secrets are already inherited from the app container.

* Default: `[]`
* Shown when: `{"post_deploy_enabled":true}`

**post\_deploy\_cpu** `string`

**Post-deploy CPU.** Optional CPU for the post-deploy task, where 1 is one vCPU. Leave blank to use the app task CPU.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a CPU value in vCPU, such as 0.5, 1, or 2.
* Shown when: `{"post_deploy_enabled":true}`

**post\_deploy\_memory** `string`

**Post-deploy memory.** Optional memory for the post-deploy task, where 1 is 1 GB. Leave blank to use the app task memory.

* Pattern: `^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$` — Enter a memory value in GB, such as 0.5, 1, or 4.
* Shown when: `{"post_deploy_enabled":true}`

**post\_deploy\_ephemeral\_storage\_size\_gib** `number`

**Post-deploy ephemeral storage (GiB).** Optional ephemeral storage size for the post-deploy task. Leave blank to use the task definition default.

* Min: `21`
* Max: `200`
* Shown when: `{"post_deploy_enabled":true}`

**post\_deploy\_timeout** `number`

**Post-deploy timeout (secs).** Maximum time to wait for the post-deploy task to finish.

* Default: `1800`
* Min: `1`
* Shown when: `{"post_deploy_enabled":true}`

**deployment\_success\_healthy\_percent** `number`

**Healthy tasks required for success (%).** Percentage of desired tasks that must be running and healthy on the new revision. Must be at least Minimum healthy percent. ECS still requires one healthy task on nonzero services at 0%. Deployment rollback monitoring ends at success; remaining tasks scale in the background.

* Default: `100`
* Min: `<< module.input.deployment_minimum_healthy_percent >>`
* Max: `100`

**deployment\_wait\_for\_drain** `boolean`

**Wait for old tasks to drain.** Choose whether old tasks must finish draining before deployment success. Alarm bake time still applies in both modes.

* Default: `false`

### Logging

**firelens\_enabled** `boolean`

**FireLens log routing.** Routes the app container logs through a Fluent Bit sidecar. CloudWatch output stays enabled by default so Ravion runtime logs continue to work.

* Default: `false`

**firelens\_image** `string` *required*

**FireLens image.** Container image for the Fluent Bit log router sidecar.

* Default: `public.ecr.aws/aws-observability/aws-for-fluent-bit:stable`
* Shown when: `{"firelens_enabled":true}`

**firelens\_config** `text`

**Additional Fluent Bit config.** Optional Fluent Bit config appended after the generated \[SERVICE] block. Add \[OUTPUT] blocks here for destinations such as Datadog, Splunk, Firehose, OpenSearch, or S3.

* Shown when: `{"firelens_enabled":true}`

**firelens\_cloudwatch\_output\_enabled** `boolean`

**Keep CloudWatch output enabled.** Recommended. Sends FireLens-routed app logs to the service CloudWatch log group so Ravion runtime logs continue to work. Disable only if all app logs should go exclusively to external destinations.

* Default: `true`
* Shown when: `{"firelens_enabled":true}`

**firelens\_ecs\_metadata\_enabled** `boolean`

**Add ECS log metadata.** Adds ECS cluster, task, and container metadata to FireLens log records.

* Default: `true`
* Shown when: `{"firelens_enabled":true}`

**firelens\_environment\_variables** `array`

**FireLens environment variables.** Environment variables passed to the log router sidecar. Use these for non-secret destination options.

* Default: `[]`
* Shown when: `{"firelens_enabled":true}`

**firelens\_secrets** `array`

**FireLens secrets.** Secrets injected into the log router sidecar, as an array of objects with `name` and `value_from` keys (snake\_case, not `valueFrom`). Use these for API keys or tokens stored in SSM Parameter Store or Secrets Manager.

* Default: `[]`
* Shown when: `{"firelens_enabled":true}`

### IAM roles and policies

**execution\_role\_arn** `string`

**Execution role ARN override.** Optional existing ECS task execution role ARN. Leave blank to let the module create and manage the execution role used for pulling images and writing logs.

**task\_role\_arn** `string`

**Task role ARN override.** Optional existing ECS task role ARN for application AWS permissions. Leave blank to let the module create a task role and attach the policies configured below.

**task\_role\_policies** `string_array`

**Task role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated task role. Only used when task role ARN override is blank.

* Default: `[]`

**task\_role\_inline\_policies** `object`

**Task role inline policies.** Inline IAM policy documents keyed by policy name.

* Default: `{}`

**execution\_role\_policies** `string_array`

**Execution role policy ARNs.** Additional managed IAM policy ARNs to attach to the generated execution role. Only used when execution role ARN override is blank.

* Default: `[]`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.