ECS Submodule container-definition with port_mapping

[alexiskat]

Description

I am using the ecs service submodule to create the service. I am also using the container-definition submodule to generate the definition for the service. I am trying to assign the container definition to the service which works up to a point

the following is the service sub-module config:

module "ecs_tr_service" {
  source  = "terraform-aws-modules/ecs/aws//modules/service"
  version = "5.2.2"

  name        = "terrareg-serv"
  cluster_arn = var.ecs_cluster_arn

  cpu    = 512
  memory = 1024

  launch_type  = "FARGATE"
  network_mode = "awsvpc"

  desired_count            = 1
  enable_autoscaling       = true
  autoscaling_min_capacity = 1
  autoscaling_max_capacity = 1

  # Container definition(s)
  container_definitions = {
    terrareg = module.ecs_container_tr_def.container_definition
  }

  load_balancer = {
    service = {
      target_group_arn = aws_lb_target_group.this.arn
      container_name   = "terrareg"
      container_port   = var.tr_container_port
    }
  }

  subnet_ids = var.vpc_pri_sub_ids
  security_group_rules = {
    alb_ingress_5000 = {
      type                     = "ingress"
      from_port                = var.tr_container_port
      to_port                  = var.tr_container_port
      protocol                 = "tcp"
      description              = "Service port"
      source_security_group_id = var.alb_https_sg_id
    }
    egress_all = {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

  tags = var.tags
}

The following is the container-definition using the submodule

module "ecs_container_tr_def" {
  source  = "terraform-aws-modules/ecs/aws//modules/container-definition"
  version = "5.2.2"

  name      = "terrareg"
  cpu       = 256
  memory    = 512
  essential = true
  image     = "1234567890.dkr.ecr.eu-west-2.amazonaws.com/terrareg:latest"
  port_mappings = [
    {
      containerPort = 5000
      hostPort      = 5000
      protocol      = "tcp"
    }
  ]
  # Requires access to write to root filesystem
  readonly_root_filesystem = false
  tags = var.tags
}

When I do a terraform run I notice that portMappings is empty even though above port 5000 etc have been defined

#terraform run 
.........
# module.ecs_tr_service.aws_ecs_task_definition.this[0] will be created
  + resource "aws_ecs_task_definition" "this" {
      + arn                      = (known after apply)
      + arn_without_revision     = (known after apply)
      + container_definitions    = jsonencode(
            [
              + {
                  + cpu                    = 256
                  + environment            = []
                  + essential              = true
                  + image                  = "12345678.dkr.ecr.eu-west-2.amazonaws.com/terrareg:latest"
                  + interactive            = false
                  + logConfiguration       = {
                      + logDriver = "awslogs"
                      + options   = {
                          + awslogs-group         = "/aws/ecs/terrareg-serv/terrareg"
                          + awslogs-region        = "eu-west-2"
                          + awslogs-stream-prefix = "ecs"
                        }
                    }
                  + memory                 = 512
                  + mountPoints            = []
                  + name                   = "terrareg"
                  + portMappings           = []            <---- this should NOT be an empty list
                  + privileged             = false
                  + pseudoTerminal         = false
                  + readonlyRootFilesystem = true

When I do apply the following error which I believe is because portMappings is empty

module.ecs_tr_service.aws_ecs_service.this[0]: Creating...
╷
│ Error: creating ECS Service (terrareg-serv): InvalidParameterException: The container terrareg did not have a container port 5000 defined.
│ 
│   with module.ecs_tr_service.aws_ecs_service.this[0],
│   on .terraform/modules/ecs_tr_service/modules/service/main.tf line 30, in resource "aws_ecs_service" "this":
│   30: resource "aws_ecs_service" "this" {

The output of the variable module.ecs_container_tr_def.container_definition looks correct:

terragrunt console                                                                                            
> module.ecs_container_tr_def.container_definition
{
  "cpu" = 256
  "environment" = tolist([])
  "essential" = true
  "image" = "123456789.dkr.ecr.eu-west-2.amazonaws.com/test:latest"
  "interactive" = false
  "logConfiguration" = {
    "logDriver" = "awslogs"
    "options" = {
      "awslogs-group" = "/aws/ecs//test"
      "awslogs-region" = "eu-west-2"
      "awslogs-stream-prefix" = "ecs"
    }
  }
  "memory" = 512
  "mountPoints" = tolist([])
  "name" = "terrareg"
  "portMappings" = tolist([
    {
      "containerPort" = 5000
      "hostPort" = 5000
      "protocol" = "tcp"
    },
  ])
  "privileged" = false
  "pseudoTerminal" = false
  "readonlyRootFilesystem" = false
  "startTimeout" = 30
  "stopTimeout" = 120
  "volumesFrom" = tolist([])
} 

Versions

• Terraform version:
  Terraform v1.5.3
  on darwin_amd64

[bryantbiggs]

why define the container definition separate from the service? Here is a working example

terraform-aws-ecs/examples/fargate/main.tf

Lines 84 to 91 in 2604124

	port_mappings = [
	{
	name = local.container_name
	containerPort = local.container_port
	hostPort = local.container_port
	protocol = "tcp"
	}
	]

[alexiskat]

Thanks for the link. That is what I am doing as a workaround for the moment but would prefer to use the submodule if that's possible.

I would also like to find out if I am doing something wrong or if this is a bug.

[hferreira23]

@alexiskat I'm having the same behavior on my side as well so it seems to be a bug.

@bryantbiggs If one is defining multiple containers for a service might be easier to use the submodules to split the container definitions by multiple TF files for example.

[bryantbiggs]

If one is defining multiple containers for a service might be easier to use the submodules to split the container definitions by multiple TF files for example.

This module already has a number of sub-modules, so I'm not sure what else you would further separate. Also, the module is already designed to handle n-number of containers per service If one is defining multiple containers for a service might be easier to use the submodules to split the container definitions by multiple TF files for example.

[hferreira23]

@bryantbiggs That's precisely what the issue is!

When using the container definition submodule separate from the service one the port_mapping list always end ups being empty no matter what values you define on the container definition

[bryantbiggs]

That's precisely what the issue is!

I don't see how thats possible if the service module is passing those values directly to the container definition module

terraform-aws-ecs/modules/service/main.tf

Line 556 in 2604124

port_mappings = try(each.value.port_mappings, var.container_definition_defaults.port_mappings, [])

perhaps there is something else going awry in your configuration

[hferreira23]

Lets look at the output provided by @alexiskat

terragrunt console                                                                                            
> module.ecs_container_tr_def.container_definition
{
  "cpu" = 256
  "environment" = tolist([])
  "essential" = true
  "image" = "123456789.dkr.ecr.eu-west-2.amazonaws.com/test:latest"
  "interactive" = false
  "logConfiguration" = {
    "logDriver" = "awslogs"
    "options" = {
      "awslogs-group" = "/aws/ecs//test"
      "awslogs-region" = "eu-west-2"
      "awslogs-stream-prefix" = "ecs"
    }
  }
  "memory" = 512
  "mountPoints" = tolist([])
  "name" = "terrareg"
  "portMappings" = tolist([
    {
      "containerPort" = 5000
      "hostPort" = 5000
      "protocol" = "tcp"
    },
  ])
  "privileged" = false
  "pseudoTerminal" = false
  "readonlyRootFilesystem" = false
  "startTimeout" = 30
  "stopTimeout" = 120
  "volumesFrom" = tolist([])
} 

If we want to use the container_definition submodule separate from the service one we need to reference the output of the container_definition within the service module which looks like this:

module "ecs_tr_service" {
  source  = "terraform-aws-modules/ecs/aws//modules/service"
  version = "5.2.2"

(... module parameters ...)
  
  # Container definition(s)
  container_definitions = {
    terrareg = module.ecs_container_tr_def.container_definition
  }

(... more module parameters ...)
 
}

Replacing the var call by its actual content we get:

module "ecs_tr_service" {
  source  = "terraform-aws-modules/ecs/aws//modules/service"
  version = "5.2.2"

(... module parameters ...)
  
  # Container definition(s)
  container_definitions = {
    terrareg = {
      "cpu" = 256
      "environment" = tolist([])
      "essential" = true
      "image" = "123456789.dkr.ecr.eu-west-2.amazonaws.com/test:latest"
      "interactive" = false
      "logConfiguration" = {
        "logDriver" = "awslogs"
        "options" = {
          "awslogs-group" = "/aws/ecs//test"
          "awslogs-region" = "eu-west-2"
          "awslogs-stream-prefix" = "ecs"
        }
      }
      "memory" = 512
      "mountPoints" = tolist([])
      "name" = "terrareg"
      "portMappings" = tolist([
        {
          "containerPort" = 5000
          "hostPort" = 5000
          "protocol" = "tcp"
        },
      ])
      "privileged" = false
      "pseudoTerminal" = false
      "readonlyRootFilesystem" = false
      "startTimeout" = 30
      "stopTimeout" = 120
      "volumesFrom" = tolist([])
    } 
  }

(... more module parameters ...)
 
}

The port mapping parameter is passed as portMappings when the service module is expecting port_mappings. So port_mappings defaults to an empty list

Same probably is also true for Mount Points, Pseudo Terminals and other 2 word parameters. (camelCase versus snake_case). 1 word parameters work fine because the name matches.

[bryantbiggs]

please provide a proper reproduction in Terraform so we can help triage and troubleshoot. Closing this one for now since its not reproducible

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.