feat!: Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively #217

bryantbiggs · 2024-08-05T19:02:57Z

Description

List of backwards incompatible changes

Terraform v1.5.7 is now minimum supported version
AWS provider v6.0.0 is now minimum supported version
The attributes used to construct the container definition(s) have been changed from HCL's norm of snake_case to camelCase to match the AWS API. There currently isn't a resource nor data source for the container definition, so one is constructed entirely from HCL in the container-definition sub-module. This definition is then rendered as JSON when presented to the task definition (or task set) APIs. Previously, the variable names used were snake_case and then internally converted to camelCase. However, this does not allow for using the container-definition sub-module on its own due to the mismatch between casing. Its probably going to trip a few folks up, but hopefully we'll remove this for a data source in the future.
security_group_rules has been split into security_group_ingress_rules and security_group_egress_rules to better match the AWS API and allow for more flexibility in defining security group rules.
Default permissive permissions for SSM parameter ARNs and Secrets Manager secret ARNs have been removed throughout. While this made it easier for users since it "just worked", it was not secure and could lead to unexpected access to resources. Users should now explicitly define the permissions they need in their IAM policies.
The "hack" put in place to track the task definition version when updating outside of the module has been removed. Instead, users should rely on the track_latest variable to ensure that the latest task definition is used when updating the service. Any issues with tracking the task definition version should be reported to the ECS service team as it is a limitation of the AWS ECS service/API and not the module itself.
The inline policy for the Tasks role of the service sub-module has been replaced with a standalone IAM policy. In some organizations, inline policies are not allowed.
The default for the container-definition user has been changed from 0 to null.

Additional changes

Added

Support for region parameter to specify the AWS region for the resources created if different from the provider region.
Support for ECS infrastructure IAM role creation in the service sub-module. This role is used to manage ECS infrastructure resources https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html

Modified

Variable definitions now contain detailed object types in place of the previously used any type.

Variable and output changes

Removed variables:
- default_capacity_provider_use_fargate
- fargate_capacity_providers
- cluster sub-module
  - fargate_capacity_providers; part of default_capacity_provider_strategy now
  - default_capacity_provider_use_fargate
- container-definition sub-module
  - None
- service sub-module
  - inference_accelerator
Renamed variables:
- cluster_settings -> cluster_setting
- cluster sub-module
  - cluster_configuration - configuration
  - cluster_settings - setting
  - cluster_service_connect_defaults - service_connect_defaults
- container-definition sub-module
  - dependencies - dependsOn
  - disable_networking - disableNetworking
  - dns_search_domains - dnsSearchDomains
  - dns_servers - dnsServers
  - docker_labels - dockerLabels
  - docker_security_options - dockerSecurityOptions
  - environment_files - environmentFiles
  - extra_hosts - extraHosts
  - firelens_configuration - firelensConfiguration
  - health_check - healthCheck
  - linux_parameters - linuxParameters
  - log_configuration - logConfiguration
  - memory_reservation - memoryReservation
  - mount_points - mountPoints
  - port_mappings - portMappings
  - psuedo_terminal - pseudoTerminal
  - readonly_root_filesystem - readonlyRootFilesystem
  - repository_credentials - repositoryCredentials
  - start_timeout - startTimeout
  - system_controls - systemControls
  - volumes_from - volumesFrom
  - working_directory - workingDirectory
- service sub-module
  - None
Added variables:
- cloudwatch_log_group_class
- default_capacity_provider_strategy
- cluster sub-module
  - cloudwatch_log_group_class
  - default_capacity_provider_strategy - replaces fargate_capacity_providers and default_capacity_provider_use_fargate functionality
- container-definition sub-module
  - log_group_class
  - restartPolicy - defaults to enabled = true
  - versionConsistency - defaults to "disabled" Issues with "software version consistency" feature aws/containers-roadmap#2394
- service sub-module
  - availability_zone_rebalancing
  - volume_configuration
  - vpc_lattice_configurations
  - enable_fault_injection
  - track_latest
  - create_infrastructure_iam_role
  - infrastructure_iam_role_arn
  - infrastructure_iam_role_name
  - infrastructure_iam_role_use_name_prefix
  - infrastructure_iam_role_path
  - infrastructure_iam_role_description
  - infrastructure_iam_role_permissions_boundary
  - infrastructure_iam_role_tags
Removed outputs:
- cluster sub-module
  - None
- container-definition sub-module
  - None
- service sub-module
  - task_definition_family_revision
Renamed outputs:
- cluster sub-module
  - None
- container-definition sub-module
  - None
- service sub-module
  - None
Added outputs:
- cluster sub-module
  - None
- container-definition sub-module
  - None
- service sub-module
  - infrastructure_iam_role_arn
  - infrastructure_iam_role_name

Motivation and Context

Resolves container-definition module not usable on its own #147
Resolves port_mappings are always empty #151
Resolves Replace hack with track_latest attribute #164
Resolves The recommended workaround for ignoring task definition changes causes the service's container_definitions to be overwritten on every Terraform apply, even ones that don't touch the service. #165
Resolves Service module defaulting user to root #221
Resolves customized_metric_specification metrics is missing #225
Resolves Can we support RestartPolicy #230
Resolves Add support for managed_storage_configuration block #233
Resolves Add containerPortRange definition support for tasks #234
Resolves Add support for managed_draining for capacity provider #235
Resolves Dynamically add container(s) to container_definitions #240
Resolves Add support for created cloudwatch logs with user defined log group class #241
Resolves Explicit task_exec_secret_arns #244
Resolves Encryption for Fargate Ephemoral Storage #258
Resolves Support of EBS volumes #254
Resolves Enable Fault Injection in ECS task #259
Resolves can't provide secrets to service #260
Resolves Feature Request: Availability Zone Rebalancing Input #262
Resolves Add support for IAM task role policy path in ECS service module #265
Resolves Feature Request: Attach EBS volumes on fargate #281
Resolves service_registries dynamic block incorrectly wraps map in list, breaking input processing #287
Resolves service_connect_configuration should allow multiple services #286
Resolves service_registries dynamic block incorrectly wraps map in list, breaking input processing #285
Resolves Feature: service connect multiple service #289
Resolves module fails with aws provider v6.0 #291
Resolves service_connect_configuration does not support multiple port mappings #292
Resolves Unsupported block type #297
Resolves terraform-aws-ecs Warning: Deprecated attribute #298
Resolves terraform-aws-ecs Error: Unsupported block type. Line: dynamic "inference_accelerator" #299
Closes feat: Added managed storage KMS configuration #274
Closes feat: Add version consistency support in container definition #280
Closes fix: Limit aws provider version to < 6 #294

Breaking Changes

Yes, see docs/UPGRADE-6.0.md

How Has This Been Tested?

I have updated at least one of the examples/* to demonstrate and validate my change(s)
I have tested and validated these changes using one or more of the provided examples/* projects

I have executed pre-commit run -a on my pull request

kkrastev-cloudoffice · 2025-03-13T15:35:27Z

any ETA on this?

BramRoets · 2025-03-28T14:09:07Z

@bryantbiggs Could you please provide an update on this PR? It adds multiple important features which are standard to AWS ECS.

It's been open for a very long time. Is this still being maintained or should we move away from this project?

bryantbiggs · 2025-03-28T14:26:50Z

yes, part of it is finding time since these large, breaking changes do take a considerable amount of time to test and document, and part of it is balancing the number of times we take a breaking change (major version bump). with v6 of the provider coming, I'm half inclined to wait and set the minimum provider version to 6.0 hashicorp/terraform-provider-aws#41101 to have a stable path forward for quite some time after

nZac · 2025-03-28T15:02:20Z

@bryantbiggs if I can be of use in testing I'd be glad to help run this through the paces. Do you have a pattern or practice you use and documentation you would need to validate that testing is sufficient?

webyneter · 2025-04-03T17:31:40Z

FYI, had to set these to work around validation errors, in a scenario when none of these were meant to be set :

tasks_iam_role_statements = []
security_group_ingress_rules = {}
security_group_egress_rules = {}

webyneter · 2025-04-03T17:32:28Z

Also, FYI, var.track_latest description is off: It says, the default is false whereas the actual default = true.

In addition to that, there's no way to set var.track_latest from the root module, there's neither a track_latest parameter on the module.service, nor the corresponding root module variable.

nikita-toffee-ai · 2025-04-03T17:58:21Z

The enabled field in the var.service_connect_configuration is now enabled = true by default, so even if I might not need service discovery, it now requires me to specify the namespace regardless.

webyneter · 2025-04-03T19:01:10Z

tag_specifications = optional(list(object({
        propagate_tags = optional(string, "TASK_DEFINITION")
        resource_type  = string
        tags           = optional(map(string))
      })))

I think, we should make resource_type = optional(string, "volume"), besides, "volume" is the only value that's currently allowed.

…0 and v1.5.7 respectively

bryantbiggs · 2025-06-27T17:57:37Z

note to self: default_capacity_provider_strategy was properly borked the way it was previously configured 😅

bryantbiggs · 2025-07-02T23:44:45Z

variables.tf

@@ -188,6 +258,741 @@ variable "task_exec_iam_statements" {

 variable "services" {
  description = "Map of service definitions to create"
-  type        = any
-  default     = {}
+  type = map(object({


…ting

antonbabenko

Looks great!

antonbabenko · 2025-07-06T18:40:24Z

.pre-commit-config.yaml

@@ -17,7 +17,7 @@ repos:
          - '--args=--only=terraform_documented_variables'
          - '--args=--only=terraform_typed_variables'
          - '--args=--only=terraform_module_pinned_source'
-          - '--args=--only=terraform_naming_convention'
+          # - '--args=--only=terraform_naming_convention' # Disabled due to container definition variables requiring camelCase


Can tflint recognize inline comments to mark just unsupported places? Other tools like tfsec and checkov can, so maybe tflint can also?

oh that was much easier than I thought it would be 😅 - fixed in 6d0ff2b

willfish · 2025-07-07T10:55:05Z

I'm integrating this in our repo, here, and all seems to work as before trade-tariff/trade-tariff-platform-aws-terraform#416

## [6.0.0](v5.12.1...v6.0.0) (2025-07-07) ### ⚠ BREAKING CHANGES * Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively (#217) ### Features * Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively ([#217](#217)) ([29b257a](29b257a)), closes [#158](#158)

antonbabenko · 2025-07-07T12:25:19Z

This PR is included in version 6.0.0 🎉

…0` and `1.5.7` respectively (terraform-aws-modules#217) * feat: Support `managed_draining` argument at `aws_ecs_capacity_provider` (terraform-aws-modules#158) * feat: Support manged_draining argument for aws_ecs_capacity_provider * bump required AWS provider version to 5.34 * align AWS provider version across the project * feat: Update MSTV to 1.3 to support state migrations, align provider version on minor version --------- Co-authored-by: Bryant Biggs <[email protected]> * feat: Add support for multiple `service`s inside `service_connect_configuration` (terraform-aws-modules#123) feat: Add support for multiple service inside service_connect_configuration Co-authored-by: Bryant Biggs <[email protected]> * feat: Add support for custom metric queries in customized_metric_spec (terraform-aws-modules#196) * feat: add support for custom metric queries in customized metric spec * fix: Update and run pre-commit checks to format --------- Co-authored-by: Bryant Biggs <[email protected]> * feat: Add support for service connect timeout settings (terraform-aws-modules#212) * feat: add service connect timeout support * chore: Update required min versions * chore: Fix merge conflicts --------- Co-authored-by: Bryant Biggs <[email protected]> * feat: Add support for EBS volumes (terraform-aws-modules#205) * feat: Adding support for EBS volumes * feat: Adding support for EBS volumes * feat: Add support for EBS volumes * feat: Add support for EBS volumes * chore: Update min required AWS provider version --------- Co-authored-by: Bryant Biggs <[email protected]> * feat: Add support for service connect tls settings (terraform-aws-modules#216) * add dynamic tls block for service connect service * set aws_pca_authority_arn to required * also apply fix to ecs service without ignore_task_def * formatting --------- Co-authored-by: Kevin Ouellet <[email protected]> * fix: Propagate support for EBS volumes to the root module (terraform-aws-modules#223) * Add missing support for EBS volumes. The PR terraform-aws-modules#205 failed to update the main module triggered when using the Terraform Registry as the module source. * Set default to true * Correct infra iam role logic. * fix: Correct logic for local `needs_infrastructure_iam_role` check (terraform-aws-modules#224) * Fix need infrastructure role check. * try adjusting logic. * explicit dep * forgot this default * update example. * feat: Add support for restartPolicy (terraform-aws-modules#231) * feat: Add support for restartPolicy (terraform-aws-modules#230) * fix precommit error * fix: Correct defaults and remove redundant validation --------- Co-authored-by: Bryant Biggs <[email protected]> * refactor: Initial pass at variable type definitions for service module' * refactor: Initial pass at variable type definitions for container definition module * chore: Update variable name to tag_specifications (terraform-aws-modules#251) Update variable name In main.tf it is used a plural tag_specifications name for the attribute * feat: Add support for availability zone rebalancing (terraform-aws-modules#262) (terraform-aws-modules#269) * feat: Add support for availability zone rebalancing (terraform-aws-modules#262) * revert default value of availability zone rebalancing * chore: Raise MSV of AWS provider * feat: Use policy for tasks role instead of inline policy * feat: Add FIS param and remove inference accelerator from `service` module * feat: Update cluster variable definitions; drop `cluster_` prefix * feat: Bump version requirements for AWS provider and Terraform to v6.0 and v1.5.7 respectively * feat: Update cluster configurations * feat: Update container definition configurations * feat: Update service configurations * feat: The worlds longest variable definition * fix: Corrections * chore: Update upgrade guide, add container definition example for testing * fix: Correct tflint ignore statemtns for camelCasing --------- Co-authored-by: Ivan Sukhomlyn <[email protected]> Co-authored-by: H.Saki <[email protected]> Co-authored-by: matt <[email protected]> Co-authored-by: Sal Sodano <[email protected]> Co-authored-by: Rodrigo Torres <[email protected]> Co-authored-by: Kevin Ouellet <[email protected]> Co-authored-by: Kevin Ouellet <[email protected]> Co-authored-by: Thomas Montague <[email protected]> Co-authored-by: Paul SANTUS <[email protected]> Co-authored-by: Luis Valdés <[email protected]> Co-authored-by: Keisuke.Matsuda <[email protected]>

## [6.0.0](terraform-aws-modules/terraform-aws-ecs@v5.12.1...v6.0.0) (2025-07-07) ### ⚠ BREAKING CHANGES * Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively (terraform-aws-modules#217) ### Features * Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively ([terraform-aws-modules#217](terraform-aws-modules#217)) ([29b257a](terraform-aws-modules@29b257a)), closes [terraform-aws-modules#158](terraform-aws-modules#158)

bryantbiggs mentioned this pull request Sep 3, 2024

fix: Propagate support for EBS volumes to the root module #223

Merged

3 tasks

bryantbiggs mentioned this pull request Sep 13, 2024

[add]: multiple service connect services #229

Closed

3 tasks

github-actions bot added the stale label Oct 17, 2024

terraform-aws-modules deleted a comment from github-actions bot Oct 17, 2024

bryantbiggs removed the stale label Oct 17, 2024

github-actions bot added the stale label Nov 17, 2024

terraform-aws-modules deleted a comment from github-actions bot Nov 17, 2024

bryantbiggs added wip and removed stale labels Nov 17, 2024

bryantbiggs force-pushed the wip/v6 branch 3 times, most recently from 62f347d to 654809c Compare November 23, 2024 16:53

bryantbiggs added wip and removed wip labels Nov 29, 2024

bryantbiggs mentioned this pull request Dec 16, 2024

feat: Add configure_at_launch option for volume block #246

Closed

3 tasks

bryantbiggs mentioned this pull request Jan 31, 2025

Support of EBS volumes #254

Closed

This was referenced Mar 13, 2025

feat: Add support for availability zone rebalancing (#262) #263

Closed

feat: Add vpc_lattice_configuration for service #250

Closed

bryantbiggs force-pushed the wip/v6 branch from 48c7150 to b107c47 Compare April 1, 2025 21:15

This was referenced Apr 1, 2025

feat: TLS configuration support #270

Closed

fix: Add missing timeout to service module #272

Closed

bryantbiggs force-pushed the wip/v6 branch from 7b57456 to 8174de6 Compare April 1, 2025 23:46

bryantbiggs added 2 commits June 27, 2025 09:58

Merge branch 'master' into wip/v6

85a21cd

feat: Bump version requirements for AWS provider and Terraform to v6.…

b9fb67b

…0 and v1.5.7 respectively

bryantbiggs mentioned this pull request Jun 27, 2025

fix: include managed_storage_configuration and avoid provider 6 at this time #293

Closed

3 tasks

feat: Update cluster configurations

5a4a70f

bryantbiggs added 3 commits June 27, 2025 14:37

feat: Update container definition configurations

8240072

feat: Update service configurations

0277e00

feat: The worlds longest variable definition

e987f75

bryantbiggs force-pushed the wip/v6 branch 3 times, most recently from cd948c3 to 3cc5e95 Compare July 2, 2025 23:43

bryantbiggs commented Jul 2, 2025

View reviewed changes

bryantbiggs force-pushed the wip/v6 branch from 3cc5e95 to f96926d Compare July 3, 2025 15:59

fix: Corrections

f3c9f66

bryantbiggs force-pushed the wip/v6 branch 2 times, most recently from 9d29599 to ae64da6 Compare July 5, 2025 18:52

bryantbiggs changed the title ~~feat!: Work in progress for v6~~ feat!: Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively Jul 5, 2025

bryantbiggs marked this pull request as ready for review July 5, 2025 18:53

bryantbiggs requested a review from antonbabenko July 5, 2025 18:54

chore: Update upgrade guide, add container definition example for tes…

1c55b83

…ting

bryantbiggs force-pushed the wip/v6 branch from ae64da6 to 1c55b83 Compare July 5, 2025 18:56

antonbabenko approved these changes Jul 6, 2025

View reviewed changes

fix: Correct tflint ignore statemtns for camelCasing

6d0ff2b

bryantbiggs merged commit 29b257a into master Jul 7, 2025
12 checks passed

bryantbiggs deleted the wip/v6 branch July 7, 2025 12:24

Uh oh!

feat!: Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively #217

feat!: Upgrade AWS provider and min required Terraform version to 6.0 and 1.5.7 respectively #217

Uh oh!

Conversation

bryantbiggs commented Aug 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

List of backwards incompatible changes

Additional changes

Added

Modified

Variable and output changes

Motivation and Context

Breaking Changes

How Has This Been Tested?

Uh oh!

kkrastev-cloudoffice commented Mar 13, 2025

Uh oh!

BramRoets commented Mar 28, 2025

Uh oh!

bryantbiggs commented Mar 28, 2025

Uh oh!

nZac commented Mar 28, 2025

Uh oh!

webyneter commented Apr 3, 2025

Uh oh!

webyneter commented Apr 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nikita-toffee-ai commented Apr 3, 2025

Uh oh!

webyneter commented Apr 3, 2025

Uh oh!

bryantbiggs commented Jun 27, 2025

Uh oh!

bryantbiggs Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

antonbabenko left a comment

Choose a reason for hiding this comment

Uh oh!

antonbabenko Jul 6, 2025

Choose a reason for hiding this comment

Uh oh!

bryantbiggs Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

willfish commented Jul 7, 2025

Uh oh!

Uh oh!

antonbabenko commented Jul 7, 2025

Uh oh!

Uh oh!

feat!: Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively #217

feat!: Upgrade AWS provider and min required Terraform version to `6.0` and `1.5.7` respectively #217

bryantbiggs commented Aug 5, 2024 •

edited

Loading

webyneter commented Apr 3, 2025 •

edited

Loading