Add AWS ECS Fargate reference deployment; remove EKS/old ECS#32
Open
jrozner wants to merge 3 commits into
Open
Add AWS ECS Fargate reference deployment; remove EKS/old ECS#32jrozner wants to merge 3 commits into
jrozner wants to merge 3 commits into
Conversation
Adds modules/aws + examples/aws, an opinionated serverless ASHIRT deployment mirroring the GCP modules solution: - ashirt-server, frontend, and ocr-worker on ECS Fargate - public HTTPS ALB (ACM + Route53) for the frontend, internal ALB for the API; ocr-worker polls the API outbound-only - Aurora MySQL Serverless v2, DSN in Secrets Manager - S3 evidence bucket, single-NAT VPC across AZs - one-shot ECS init task for DB migrations, re-run on tag change - Amazon-managed encryption throughout (SSE-S3, aws/rds, aws/secretsmanager); no customer-managed KMS keys Removes the standalone ecs/ deployment and the eks/ Helm chart; k8s support is no longer maintained.
Runs terraform fmt -check at the repo root and init -backend=false +
validate across modules/{aws,gcp} and examples/{aws,gcp} on PRs and
pushes to main. This is the credential-free equivalent of a plan check;
a live plan is omitted since it requires cloud credentials and an
existing Route53 zone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new AWS reference deployment (
modules/aws+examples/aws) that mirrors the existing GCP modules solution, using ECS Fargate as the compute layer. Removes the standaloneecs/deployment and theeks/Helm chart — k8s is no longer maintained.Architecture
aws ecs run-task, waited on; re-runs whenevertagchanges, before ashirt-server is redeployedaz_countAZs, IGW, single NAT gatewayEncryption
Amazon-managed keys only — no customer-managed KMS keys are created:
storage_encrypted = truewithaws/rdsaws/secretsmanagerNotes for reviewers
ashirt/ashirt-server,ashirt/frontend,ashirt/ocr-worker,ashirt/init,STORE_*). Worth a smoke test against real image tags.BACKEND=awsfor the ocr-worker is assumed to map to Amazon Textract; the ocr-worker task role is grantedtextract:DetectDocumentText/AnalyzeDocument. Adjustocr_worker_env+ IAM if the image expects something else.iap_enabled=false) with anallow_frontend_cidrsallowlist; there is no IAP-equivalent auth layer.modules/awsandexamples/awspassterraform validateandterraform fmt.