{"id":19580439,"url":"https://github.com/dod-iac/terraform-aws-ecs-task-execution-role","last_synced_at":"2025-04-23T00:41:06.584Z","repository":{"id":113972006,"uuid":"383628308","full_name":"dod-iac/terraform-aws-ecs-task-execution-role","owner":"dod-iac","description":"An IAM role for use as a ECS task execution role","archived":false,"fork":false,"pushed_at":"2023-11-27T19:48:12.000Z","size":41,"stargazers_count":2,"open_issues_count":2,"forks_count":3,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-29T20:32:53.562Z","etag":null,"topics":["aws","ecs","iam","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/dod-iac/ecs-task-execution-role/aws","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dod-iac.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-07-07T00:13:51.000Z","updated_at":"2024-02-20T12:32:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"bc6bd841-582d-4738-92f8-07ca1548dff5","html_url":"https://github.com/dod-iac/terraform-aws-ecs-task-execution-role","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dod-iac%2Fterraform-aws-ecs-task-execution-role","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dod-iac%2Fterraform-aws-ecs-task-execution-role/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dod-iac%2Fterraform-aws-ecs-task-execution-role/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dod-iac%2Fterraform-aws-ecs-task-execution-role/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dod-iac","download_url":"https://codeload.github.com/dod-iac/terraform-aws-ecs-task-execution-role/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250348897,"owners_count":21415907,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","ecs","iam","terraform","terraform-module"],"created_at":"2024-11-11T07:25:55.192Z","updated_at":"2025-04-23T00:41:06.567Z","avatar_url":"https://github.com/dod-iac.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Usage\n\nCreates an IAM role for use as an ECS task execution role.\n\n```hcl\nmodule \"ecs_task_execution_role\" {\n  source = \"dod-iac/ecs-task-execution-role/aws\"\n\n  allow_create_log_groups    = true\n  cloudwatch_log_group_names = [\"*\"]\n  name = format(\"app-%s-task-execution-role-%s\", var.application, var.environment)\n\n  tags  = {\n    Application = var.application\n    Environment = var.environment\n    Automation  = \"Terraform\"\n  }\n}\n```\nCreates an IAM role for use as an ECS task execution role that writes to a specific list of encrypted CloudWatch log groups.\n\n```hcl\nmodule \"cloudwatch_kms_key\" {\n  source = \"dod-iac/cloudwatch-kms-key/aws\"\n\n  name = format(\"alias/app-%s-cloudwatch-logs-%s\", var.application, var.environment)\n\n  tags  = {\n    Application = var.application\n    Environment = var.environment\n    Automation  = \"Terraform\"\n  }\n}\n\nresource \"aws_cloudwatch_log_group\" \"main\" {\n  name              = format(\"/aws/ecs/app-%s-%s\", var.application, var.environment)\n  retention_in_days = 1 # expire logs after 1 day\n  kms_key_id        = module.cloudwatch_kms_key.aws_kms_key_arn\n\n  tags  = {\n    Application = var.application\n    Environment = var.environment\n    Automation  = \"Terraform\"\n  }\n}\n\nmodule \"ecs_task_execution_role\" {\n  source = \"dod-iac/ecs-task-execution-role/aws\"\n\n  cloudwatch_log_group_names = [module.cloudwatch_log_group.name]\n  name = format(\"app-%s-task-execution-role-%s\", var.application, var.environment)\n\n  tags  = {\n    Application = var.application\n    Environment = var.environment\n    Automation  = \"Terraform\"\n  }\n}\n```\n\n## Testing\n\nRun all terratest tests using the `terratest` script.  If using `aws-vault`, you could use `aws-vault exec $AWS_PROFILE -- terratest`.  The `AWS_DEFAULT_REGION` environment variable is required by the tests.  Use `TT_SKIP_DESTROY=1` to not destroy the infrastructure created during the tests.  Use `TT_VERBOSE=1` to log all tests as they are run.  The go test command can be executed directly, too.\n\n## Terraform Version\n\nTerraform 0.13. Pin module version to ~\u003e 1.0.0 . Submit pull-requests to main branch.\n\nTerraform 0.11 and 0.12 are not supported.\n\n## License\n\nThis project constitutes a work of the United States Government and is not subject to domestic copyright protection under 17 USC § 105.  However, because the project utilizes code licensed from contributors and other third parties, it therefore is licensed under the MIT License.  See LICENSE file for more information.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.13 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 3.0, \u003c 5.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 3.0, \u003c 5.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_allow_create_log_groups\"\u003e\u003c/a\u003e [allow\\_create\\_log\\_groups](#input\\_allow\\_create\\_log\\_groups) | Allow role to create CloudWatch log groups. | `bool` | `false` | no |\n| \u003ca name=\"input_allow_ecr\"\u003e\u003c/a\u003e [allow\\_ecr](#input\\_allow\\_ecr) | Allow instance to pull a container image from an ECR repository. | `bool` | `false` | no |\n| \u003ca name=\"input_assume_role_policy\"\u003e\u003c/a\u003e [assume\\_role\\_policy](#input\\_assume\\_role\\_policy) | The assume role policy for the AWS IAM role.  If blank, allows ECS tasks in the account to assume the role. | `string` | `\"\"` | no |\n| \u003ca name=\"input_cloudwatch_log_group_names\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_names](#input\\_cloudwatch\\_log\\_group\\_names) | List of names of CloudWatch log groups that this task execution role can write to.  Use [\"*\"] to allow all log groups. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | The name of the AWS IAM role. | `string` | n/a | yes |\n| \u003ca name=\"input_policy_description\"\u003e\u003c/a\u003e [policy\\_description](#input\\_policy\\_description) | The description of the AWS IAM policy attached to the IAM task execution role. Defaults to \"The policy for [NAME]\". | `string` | `\"\"` | no |\n| \u003ca name=\"input_policy_document\"\u003e\u003c/a\u003e [policy\\_document](#input\\_policy\\_document) | The contents of the AWS IAM policy attached to the IAM task execution role.  If not defined, then uses a generated policy. | `string` | `\"\"` | no |\n| \u003ca name=\"input_policy_name\"\u003e\u003c/a\u003e [policy\\_name](#input\\_policy\\_name) | The name of the AWS IAM policy attached to the IAM task execution role.  Defaults to \"[NAME]-policy\". | `string` | `\"\"` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags applied to the AWS IAM role. | `map(string)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_arn\"\u003e\u003c/a\u003e [arn](#output\\_arn) | The Amazon Resource Name (ARN) of the AWS IAM Role. |\n| \u003ca name=\"output_name\"\u003e\u003c/a\u003e [name](#output\\_name) | The name of the AWS IAM Role. |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdod-iac%2Fterraform-aws-ecs-task-execution-role","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdod-iac%2Fterraform-aws-ecs-task-execution-role","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdod-iac%2Fterraform-aws-ecs-task-execution-role/lists"}