Create Infrastructure ECS cluster

* This will conditionally launch an ECS cluster within the
  infrastructure VPC. The EC2 instances within the ECS cluster do not
  need to be public (An ALB will be the public endpoint), but they can
  optionally be configured to be publicly available.
* A lifecycle hook has been added, which conditionally triggers a Lambda
  to ensure that all instances have drained their containers before terminating.
* The ECS instance type, ami version and docker storage parameters are
  configurable.

data.tf

@@ -5,3 +5,24 @@ data "aws_route53_zone" "root" {
 
   name = local.route53_root_hosted_zone_domain_name
 }
+
+data "aws_ami" "ecs_cluster_ami" {
+  count = local.enable_infrastructure_ecs_cluster ? 1 : 0
+
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name = "name"
+    values = [
+      "amzn2-ami-ecs-hvm-${local.infrastructure_ecs_cluster_ami_version}"
+    ]
+  }
+
+  filter {
+    name = "architecture"
+    values = [
+      "x86_64"
+    ]
+  }
+}

ec2-userdata/ecs-instance.tpl

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Mount docker storage volume
+sudo mkfs -t xfs ${docker_storage_volume_device_name}
+sudo mkdir -p /var/lib/docker
+sudo mount -o prjquota ${docker_storage_volume_device_name} /var/lib/docker
+
+# Configure ECS with Docker
+echo ECS_CLUSTER="${ecs_cluster_name}" >> /etc/ecs/ecs.config
+echo ECS_ENGINE_AUTH_TYPE=dockercfg >> /etc/ecs/ecs.config
+echo 'ECS_ENGINE_AUTH_DATA={"https://index.docker.io/v1/": { "auth": "${dockerhub_token}", "email": "${dockerhub_email}"}}' >> /etc/ecs/ecs.config
+# Set low task cleanup - reduces chance of docker thin pool running out of free space
+echo "ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=15m" >> /etc/ecs/ecs.config
+
+# Configure Docker options
+sed -i s/OPTIONS/#OPTIONS/ /etc/sysconfig/docker
+echo 'OPTIONS="--default-ulimit nofile=1024:4096 --storage-opt overlay2.size=${docker_storage_size}G"' >> /etc/sysconfig/docker
+sudo service docker restart
+
+# Install useful packages
+sudo yum update -y
+
+if ! command -v aws &> /dev/null
+then
+  sudo yum install -y aws-cli
+fi
+
+sudo yum install -y \
+  jq \
+  rsync

ecs-cluster-infrastructure-draining-lambda.tf

@@ -0,0 +1,140 @@
+resource "aws_cloudwatch_log_group" "ecs_cluster_infrastructure_draining_lambda_log_group" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name              = "/aws/lambda/${local.project_name}-ecs-cluster-infrastructure-draining"
+  kms_key_id        = local.infrastructure_kms_encryption ? aws_kms_key.infrastructure[0].arn : null
+  retention_in_days = local.infrastructure_ecs_cluster_draining_lambda_log_retention
+}
+
+resource "aws_iam_role" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-draining-lambda"
+  assume_role_policy = templatefile(
+    "${path.root}/policies/assume-roles/service-principle-standard.json.tpl",
+    { services = jsonencode(["lambda.amazonaws.com"]) }
+  )
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-draining-lambda"
+  policy = templatefile(
+    "${path.root}/policies/lambda-default.json.tpl",
+    {
+      region        = local.aws_region
+      account_id    = local.aws_account_id
+      function_name = "${local.project_name}-ecs-cluster-infrastructure-draining"
+    }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-ecs-container-instance-state-update"
+  policy = templatefile(
+    "${path.root}/policies/ecs-container-instance-state-update.json.tpl", {}
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_sns_publish_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-sns-publish"
+  policy = templatefile(
+    "${path.root}/policies/sns-publish.json.tpl",
+    { sns_topic_arn = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_sns_publish_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_sns_publish_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_kms_encrypt" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled && local.infrastructure_kms_encryption ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-kms-encrypt"
+  policy = templatefile(
+    "${path.root}/policies/kms-encrypt.json.tpl",
+    { kms_key_arn = aws_kms_key.infrastructure[0].arn }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_kms_encrypt" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled && local.infrastructure_kms_encryption ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_kms_encrypt[0].arn
+}
+
+data "archive_file" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  type        = "zip"
+  source_dir  = "lambdas/ecs-ec2-draining"
+  output_path = "lambdas/.zip-cache/ecs-ec2-draining.zip"
+}
+
+resource "aws_lambda_function" "ecs_cluster_infrastructure_draining" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  filename         = data.archive_file.ecs_cluster_infrastructure_draining_lambda[0].output_path
+  function_name    = "${local.project_name}-ecs-cluster-infrastructure-draining"
+  description      = "${local.project_name} ECS Cluster Infrastructure Draining"
+  handler          = "function.lambda_handler"
+  runtime          = "python3.11"
+  role             = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].arn
+  source_code_hash = data.archive_file.ecs_cluster_infrastructure_draining_lambda[0].output_base64sha256
+  memory_size      = 128
+  package_type     = "Zip"
+  timeout          = 900
+
+  environment {
+    variables = {
+      ecsClusterName = local.infrastructure_ecs_cluster_name
+      awsRegion      = local.aws_region
+    }
+  }
+
+  tracing_config {
+    mode = "Active"
+  }
+}
+
+resource "aws_lambda_permission" "ecs_cluster_infrastructure_draining_allow_sns_execution" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  statement_id  = "AllowExecutionFromSNS"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.ecs_cluster_infrastructure_draining[0].function_name
+  principal     = "sns.amazonaws.com"
+  source_arn    = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn
+}
+
+resource "aws_sns_topic_subscription" "ecs_cluster_infrastructure_draining_autoscaling_lifecycle_termination" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  topic_arn = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn
+  protocol  = "lambda"
+  endpoint  = aws_lambda_function.ecs_cluster_infrastructure_draining[0].arn
+}