Create Infrastructure ECS cluster

data.tf

@@ -5,3 +5,24 @@ data "aws_route53_zone" "root" {
 
   name = local.route53_root_hosted_zone_domain_name
 }
+
+data "aws_ami" "ecs_cluster_ami" {
+  count = local.enable_infrastructure_ecs_cluster ? 1 : 0
+
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name = "name"
+    values = [
+      "amzn2-ami-ecs-hvm-${local.infrastructure_ecs_cluster_ami_version}"
+    ]
+  }
+
+  filter {
+    name = "architecture"
+    values = [
+      "x86_64"
+    ]
+  }
+}

ec2-userdata/ecs-instance.tpl

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Mount docker storage volume
+sudo mkfs -t xfs ${docker_storage_volume_device_name}
+sudo mkdir -p /var/lib/docker
+sudo mount -o prjquota ${docker_storage_volume_device_name} /var/lib/docker
+
+# Configure ECS with Docker
+echo ECS_CLUSTER="${ecs_cluster_name}" >> /etc/ecs/ecs.config
+echo ECS_ENGINE_AUTH_TYPE=dockercfg >> /etc/ecs/ecs.config
+echo 'ECS_ENGINE_AUTH_DATA={"https://index.docker.io/v1/": { "auth": "${dockerhub_token}", "email": "${dockerhub_email}"}}' >> /etc/ecs/ecs.config
+# Set low task cleanup - reduces chance of docker thin pool running out of free space
+echo "ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=15m" >> /etc/ecs/ecs.config
+
+# Configure Docker options
+sed -i s/OPTIONS/#OPTIONS/ /etc/sysconfig/docker
+echo 'OPTIONS="--default-ulimit nofile=1024:4096 --storage-opt overlay2.size=${docker_storage_size}G"' >> /etc/sysconfig/docker
+sudo service docker restart
+
+# Install useful packages
+sudo yum update -y
+
+if ! command -v aws &> /dev/null
+then
+  sudo yum install -y aws-cli
+fi
+
+sudo yum install -y \
+  jq \
+  rsync

ecs-cluster-infrastructure-draining-lambda.tf

@@ -0,0 +1,140 @@
+resource "aws_cloudwatch_log_group" "ecs_cluster_infrastructure_draining_lambda_log_group" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name              = "/aws/lambda/${local.project_name}-ecs-cluster-infrastructure-draining"
+  kms_key_id        = local.infrastructure_kms_encryption ? aws_kms_key.infrastructure[0].arn : null
+  retention_in_days = local.infrastructure_ecs_cluster_draining_lambda_log_retention
+}
+
+resource "aws_iam_role" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-draining-lambda"
+  assume_role_policy = templatefile(
+    "${path.root}/policies/assume-roles/service-principle-standard.json.tpl",
+    { services = jsonencode(["lambda.amazonaws.com"]) }
+  )
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-draining-lambda"
+  policy = templatefile(
+    "${path.root}/policies/lambda-default.json.tpl",
+    {
+      region        = local.aws_region
+      account_id    = local.aws_account_id
+      function_name = "${local.project_name}-ecs-cluster-infrastructure-draining"
+    }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-ecs-container-instance-state-update"
+  policy = templatefile(
+    "${path.root}/policies/ecs-container-instance-state-update.json.tpl", {}
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_ecs_container_instance_state_update_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_sns_publish_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-sns-publish"
+  policy = templatefile(
+    "${path.root}/policies/sns-publish.json.tpl",
+    { sns_topic_arn = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_sns_publish_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_sns_publish_lambda[0].arn
+}
+
+resource "aws_iam_policy" "ecs_cluster_infrastructure_draining_kms_encrypt" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled && local.infrastructure_kms_encryption ? 1 : 0
+
+  name = "${local.project_name}-ecs-cluster-infrastructure-kms-encrypt"
+  policy = templatefile(
+    "${path.root}/policies/kms-encrypt.json.tpl",
+    { kms_key_arn = aws_kms_key.infrastructure[0].arn }
+  )
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_cluster_infrastructure_draining_kms_encrypt" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled && local.infrastructure_kms_encryption ? 1 : 0
+
+  role       = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].name
+  policy_arn = aws_iam_policy.ecs_cluster_infrastructure_draining_kms_encrypt[0].arn
+}
+
+data "archive_file" "ecs_cluster_infrastructure_draining_lambda" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  type        = "zip"
+  source_dir  = "lambdas/ecs-ec2-draining"
+  output_path = "lambdas/.zip-cache/ecs-ec2-draining.zip"
+}
+
+resource "aws_lambda_function" "ecs_cluster_infrastructure_draining" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  filename         = data.archive_file.ecs_cluster_infrastructure_draining_lambda[0].output_path
+  function_name    = "${local.project_name}-ecs-cluster-infrastructure-draining"
+  description      = "${local.project_name} ECS Cluster Infrastructure Draining"
+  handler          = "function.lambda_handler"
+  runtime          = "python3.11"
+  role             = aws_iam_role.ecs_cluster_infrastructure_draining_lambda[0].arn
+  source_code_hash = data.archive_file.ecs_cluster_infrastructure_draining_lambda[0].output_base64sha256
+  memory_size      = 128
+  package_type     = "Zip"
+  timeout          = 900
+
+  environment {
+    variables = {
+      ecsClusterName = local.infrastructure_ecs_cluster_name
+      awsRegion      = local.aws_region
+    }
+  }
+
+  tracing_config {
+    mode = "Active"
+  }
+}
+
+resource "aws_lambda_permission" "ecs_cluster_infrastructure_draining_allow_sns_execution" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  statement_id  = "AllowExecutionFromSNS"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.ecs_cluster_infrastructure_draining[0].function_name
+  principal     = "sns.amazonaws.com"
+  source_arn    = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn
+}
+
+resource "aws_sns_topic_subscription" "ecs_cluster_infrastructure_draining_autoscaling_lifecycle_termination" {
+  count = local.infrastructure_ecs_cluster_draining_lambda_enabled ? 1 : 0
+
+  topic_arn = aws_sns_topic.infrastructure_ecs_cluster_autoscaling_lifecycle_termination[0].arn
+  protocol  = "lambda"
+  endpoint  = aws_lambda_function.ecs_cluster_infrastructure_draining[0].arn
+}