Use the ecs service role (#52)

* Use the ecs service role Fixes #51 * Update main.tf Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> * Update main.tf Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> * Use iam_role if not in awsvpc mode * Only create service role if network_mode is not awsvpc * Add network_mode check to iam policy and role policy * Remove test for service role arn Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
cloudposse · May 31, 2020 · 19b680d · scaledevops · Jun 1, 2020 · 19b680d
1 parent 79c3205
commit 19b680d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 8 deletions.
diff --git a/main.tf b/main.tf
@@ -117,15 +117,15 @@ data "aws_iam_policy_document" "ecs_service" {
 }
 
 resource "aws_iam_role" "ecs_service" {
-  count                = var.enabled ? 1 : 0
+  count                = var.enabled && var.network_mode != "awsvpc" ? 1 : 0
   name                 = module.service_label.id
   assume_role_policy   = join("", data.aws_iam_policy_document.ecs_service.*.json)
   permissions_boundary = var.permissions_boundary == "" ? null : var.permissions_boundary
   tags                 = module.service_label.tags
 }
 
 data "aws_iam_policy_document" "ecs_service_policy" {
-  count = var.enabled ? 1 : 0
+  count = var.enabled && var.network_mode != "awsvpc" ? 1 : 0
 
   statement {
     effect    = "Allow"
@@ -142,7 +142,7 @@ data "aws_iam_policy_document" "ecs_service_policy" {
 }
 
 resource "aws_iam_role_policy" "ecs_service" {
-  count  = var.enabled ? 1 : 0
+  count  = var.enabled && var.network_mode != "awsvpc" ? 1 : 0
   name   = module.service_label.id
   policy = join("", data.aws_iam_policy_document.ecs_service_policy.*.json)
   role   = join("", aws_iam_role.ecs_service.*.id)
@@ -259,6 +259,7 @@ resource "aws_ecs_service" "ignore_changes_task_definition" {
   platform_version                   = var.launch_type == "FARGATE" ? var.platform_version : null
   scheduling_strategy                = var.launch_type == "FARGATE" ? "REPLICA" : var.scheduling_strategy
   enable_ecs_managed_tags            = var.enable_ecs_managed_tags
+  iam_role                           = var.network_mode != "awsvpc" ? join("", aws_iam_role.ecs_service.*.arn) : null
 
   dynamic "capacity_provider_strategy" {
     for_each = var.capacity_provider_strategies
@@ -340,6 +341,7 @@ resource "aws_ecs_service" "default" {
   platform_version                   = var.launch_type == "FARGATE" ? var.platform_version : null
   scheduling_strategy                = var.launch_type == "FARGATE" ? "REPLICA" : var.scheduling_strategy
   enable_ecs_managed_tags            = var.enable_ecs_managed_tags
+  iam_role                           = var.network_mode != "awsvpc" ? join("", aws_iam_role.ecs_service.*.arn) : null
 
   dynamic "capacity_provider_strategy" {
     for_each = var.capacity_provider_strategies

diff --git a/test/src/examples_complete_test.go b/test/src/examples_complete_test.go
@@ -74,11 +74,6 @@ func TestExamplesComplete(t *testing.T) {
 	// Verify we're getting back the outputs we expect
 	assert.Equal(t, "eg-test-ecs-alb-service-task", serviceName)
 
-	// Run `terraform output` to get the value of an output variable
-	serviceRoleArn := terraform.Output(t, terraformOptions, "service_role_arn")
-	// Verify we're getting back the outputs we expect
-	assert.Equal(t, "arn:aws:iam::126450723953:role/eg-test-ecs-alb-service-task-service", serviceRoleArn)
-
 	// Run `terraform output` to get the value of an output variable
 	taskDefinitionFamily := terraform.Output(t, terraformOptions, "task_definition_family")
 	// Verify we're getting back the outputs we expect