Amazon ECSのデプロイにecspressoを使うとビルド・デプロイの境界やアプリ･インフラのIaC境界が明確になる ~ fujiwara-ware OSS ~

$ brew install kayac/tap/ecspresso

$ ecspresso init --region ap-northeast-1 --cluster your-cluster --service your-service --config ecspresso.yml

$ ls -1
ecs-service-def.json
ecs-task-def.json
ecspresso.yml

$ cat ecspresso.yml
region: ap-northeast-1
cluster: your-cluster
service: your-service
service_definition: ecs-service-def.json
task_definition: ecs-task-def.json
timeout: "10m0s"

...
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "assignPublicIp": "ENABLED",
      "securityGroups": [
        "sg-123"
      ],
      "subnets": [
        "subnet-123",
        "subnet-456"
      ]
    }
  },
...

$ ecspresso tasks
2024/08/12 03:22:29 [INFO] ecspresso version: v2.4.0
|                ID                |  TASKDEFINITION  | INSTANCE | LASTSTATUS | DESIREDSTATUS |      CREATEDAT       |       GROUP       |  TYPE   |
+----------------------------------+------------------+----------+------------+---------------+----------------------+-------------------+---------+
| a6f7a3a95be64eb2a4e00383dd5b9a11 | demo-lb-httpd:3 |          | PENDING    | RUNNING       | 2024-08-12T03:22:07Z | service:alb-httpd | FARGATE |

plugins:
  - name: tfstate
    config:
      url: s3://YOUR-BUCKET/terraform.tfstate

...
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "assignPublicIp": "ENABLED",
      "securityGroups": [
        "{{ tfstate tfstate `data.aws_security_group.app.id` }}"
      ],
      "subnets": [
        "{{ tfstate `aws_subnet.private_a.id` }}",
        "{{ tfstate `aws_subnet.private_c.id` }}"
      ]
    }
  },
...

$ ecspresso diff
2024/08/12 03:27:41 [INFO] ecspresso version: v2.4.0
--- arn:aws:ecs:ap-northeast-1:123456789012:task-definition/test-httpd:4
+++ ecs-task-def.json
@@ -10,7 +10,7 @@
         "-c"
       ],
       "essential": true,
-      "image": "public.ecr.aws/docker/library/httpd:2.4.61",
+      "image": "public.ecr.aws/docker/library/httpd:2.4.62",
       "name": "httpd-app",
       "portMappings": [
         {

$ ecspresso verify
2024/08/12 03:47:44 [INFO] ecspresso version: v2.4.0
2024/08/12 03:47:44 httpd-alb/your-cluster Starting verify
  TaskDefinition
    ExecutionRole[arn:aws:iam::123456789012:role/ecsTaskExecutionRole]
    --> [OK]
    TaskRole[arn:aws:iam::123456789012:role/ecsTaskRole]
    --> [OK]
    ContainerDefinition[httpd-app]
      Image[123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/not-exist/web-service:2]
      --> [NG] 404 Not Found
    --> [NG] verify Image[123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/not-exist/web-service:2] failed: 404 Not Found
  --> [NG] verify ContainerDefinition[httpd-app] failed: verify Image[123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/not-exist/web-service:2] failed: 404 Not Found
2024/08/12 03:47:45 [ERROR] FAILED. verify TaskDefinition failed: verify ContainerDefinition[httpd-app] failed: verify Image[123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/not-exist/web-service:2] failed: 404 Not Found

$ ecspresso  deploy
2024/08/12 03:40:35 [INFO] ecspresso version: v2.4.0
2024/08/12 03:40:35 httpd-alb/your-cluster Starting deploy 
Service: httpd-alb
Cluster: your-cluster
TaskDefinition: test-httpd:5
Deployments:
   PRIMARY test-httpd:5 desired:1 pending:0 running:1 COMPLETED(ECS deployment ecs-svc/5601475856890297997 completed.)
Events:
2024/08/12 03:40:36 httpd-alb/DevCluster Registering a new task definition...
...
2024/08/12 03:43:43 httpd-alb/your-cluster Service is stable now. Completed!