r/ecs_service: Add NetworkConfiguration

aws/resource_aws_ecs_service.go

@@ -53,6 +53,7 @@ func resourceAwsEcsService() *schema.Resource {
 				Type:     schema.TypeString,
 				ForceNew: true,
 				Optional: true,
+				Computed: true,
 			},
 
 			"deployment_maximum_percent": {
@@ -101,7 +102,25 @@ func resourceAwsEcsService() *schema.Resource {
 				},
 				Set: resourceAwsEcsLoadBalancerHash,
 			},
-
+			"network_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"security_groups": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"subnets": {
+							Type:     schema.TypeList,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
 			"placement_strategy": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -194,6 +213,8 @@ func resourceAwsEcsServiceCreate(d *schema.ResourceData, meta interface{}) error
 		input.Role = aws.String(v.(string))
 	}
 
+	input.NetworkConfiguration = expandEcsNetworkConfigration(d.Get("network_configuration").([]interface{}))
+
 	strategies := d.Get("placement_strategy").(*schema.Set).List()
 	if len(strategies) > 0 {
 		var ps []*ecs.PlacementStrategy
@@ -353,9 +374,36 @@ func resourceAwsEcsServiceRead(d *schema.ResourceData, meta interface{}) error {
 		log.Printf("[ERR] Error setting placement_constraints for (%s): %s", d.Id(), err)
 	}
 
+	if err := d.Set("network_configuration", flattenEcsNetworkConfigration(service.NetworkConfiguration)); err != nil {
+		log.Printf("[ERR] Error setting network_configuration for (%s): %s", d.Id(), err)
+	}
+
 	return nil
 }
 
+func flattenEcsNetworkConfigration(nc *ecs.NetworkConfiguration) []interface{} {
+	if nc == nil {
+		return nil
+	}
+	result := make(map[string]interface{})
+	result["security_groups"] = flattenStringList(nc.AwsvpcConfiguration.SecurityGroups)
+	result["subnets"] = flattenStringList(nc.AwsvpcConfiguration.Subnets)
+	return []interface{}{result}
+}
+
+func expandEcsNetworkConfigration(nc []interface{}) *ecs.NetworkConfiguration {
+	if len(nc) == 0 {
+		return nil
+	}
+	awsVpcConfig := &ecs.AwsVpcConfiguration{}
+	raw := nc[0].(map[string]interface{})
+	if val, ok := raw["security_groups"]; ok {
+		awsVpcConfig.SecurityGroups = expandStringList(val.([]interface{}))
+	}
+	awsVpcConfig.Subnets = expandStringList(raw["subnets"].([]interface{}))
+	return &ecs.NetworkConfiguration{AwsvpcConfiguration: awsVpcConfig}
+}
+
 func flattenServicePlacementConstraints(pcs []*ecs.PlacementConstraint) []map[string]interface{} {
 	if len(pcs) == 0 {
 		return nil
@@ -418,6 +466,10 @@ func resourceAwsEcsServiceUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
+	if d.HasChange("network_configration") {
+		input.NetworkConfiguration = expandEcsNetworkConfigration(d.Get("network_configuration").([]interface{}))
+	}
+
 	// Retry due to IAM & ECS eventual consistency
 	err := resource.Retry(2*time.Minute, func() *resource.RetryError {
 		out, err := conn.UpdateService(&input)

aws/resource_aws_ecs_service_test.go

@@ -341,6 +341,22 @@ func TestAccAWSEcsServiceWithPlacementConstraints_emptyExpression(t *testing.T)
 	})
 }
 
+func TestAccAWSEcsServiceWithNetworkConfiguration(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSEcsServiceWithNetworkConfigration(acctest.RandString(5)),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.main"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSEcsServiceDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ecsconn
 
@@ -1074,3 +1090,77 @@ resource "aws_ecs_service" "with_alb" {
 }
 `, rName, rName, rName, rName, rName, rName, rName)
 }
+
+func testAccAWSEcsServiceWithNetworkConfigration(rName string) string {
+	return fmt.Sprintf(`
+data "aws_availability_zones" "available" {}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.10.0.0/16"
+}
+
+resource "aws_subnet" "main" {
+  count = 2
+  cidr_block = "${cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)}"
+  availability_zone = "${data.aws_availability_zones.available.names[count.index]}"
+  vpc_id = "${aws_vpc.main.id}"
+}
+
+resource "aws_security_group" "allow_all_a" {
+  name        = "allow_all_a"
+  description = "Allow all inbound traffic"
+  vpc_id      = "${aws_vpc.main.id}"
+
+	ingress {
+    protocol = "6"
+    from_port = 80
+    to_port = 8000
+    cidr_blocks = ["${aws_vpc.main.cidr_block}"]
+  }
+}
+
+resource "aws_security_group" "allow_all_b" {
+  name        = "allow_all_b"
+  description = "Allow all inbound traffic"
+  vpc_id      = "${aws_vpc.main.id}"
+
+	ingress {
+    protocol = "6"
+    from_port = 80
+    to_port = 8000
+    cidr_blocks = ["${aws_vpc.main.cidr_block}"]
+  }
+}
+
+resource "aws_ecs_cluster" "main" {
+	name = "tf-ecs-cluster-%s"
+}
+
+resource "aws_ecs_task_definition" "mongo" {
+  family = "mongodb"
+	network_mode = "awsvpc"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "mongo:latest",
+    "memory": 128,
+    "name": "mongodb"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "main" {
+  name = "tf-ecs-service-%s"
+  cluster = "${aws_ecs_cluster.main.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 1
+	network_configuration {
+		security_groups = ["${aws_security_group.allow_all_a.id}", "${aws_security_group.allow_all_b.id}"]
+		subnets = ["${aws_subnet.main.*.id}"]
+	}
+}
+`, rName, rName)
+}

aws/resource_aws_ecs_task_definition.go

@@ -118,6 +118,7 @@ func validateAwsEcsTaskDefinitionNetworkMode(v interface{}, k string) (ws []stri
 	validTypes := map[string]struct{}{
 		"bridge": {},
 		"host":   {},
+		"awsvpc": {},
 		"none":   {},
 	}
 

website/docs/r/ecs_service.html.markdown

@@ -60,6 +60,7 @@ into consideration during task placement. The maximum number of
 * `load_balancer` - (Optional) A load balancer block. Load balancers documented below.
 * `placement_constraints` - (Optional) rules that are taken into consideration during task placement. Maximum number of
 `placement_constraints` is `10`. Defined below.
+* `network_configuration` - (Optional) The network configuration for the service. This parameter is required for task definitions that use the awsvpc network mode to receive their own Elastic Network Interface, and it is not supported for other network modes.
 
 -> **Note:** As a result of an AWS limitation, a single `load_balancer` can be attached to the ECS service at most. See [related docs](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-load-balancing.html#load-balancing-concepts).
 
@@ -93,7 +94,12 @@ For more information, see [Cluster Query Language in the Amazon EC2 Container
 Service Developer
 Guide](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
 
+## network_configuration
 
+`network_configuration` support the following:
+* `subnets` - (Required) The subnets associated with the task or service.
+* `security_groups` - (Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+For more information, see [Task Networking](http://docs.aws.amazon.com/AmazonECS/latest/developerguidetask-networking.html)
 
 ## Attributes Reference
 

website/docs/r/ecs_task_definition.html.markdown

@@ -77,7 +77,7 @@ definition document. For a detailed description of what parameters are available
 (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) section from the
 official [Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide).
 * `task_role_arn` - (Optional) The ARN of IAM role that allows your Amazon ECS container task to make calls to other AWS services.
-* `network_mode` - (Optional) The Docker networking mode to use for the containers in the task. The valid values are `none`, `bridge`, and `host`.
+* `network_mode` - (Optional) The Docker networking mode to use for the containers in the task. The valid values are `none`, `bridge`, `awsvpc`, and `host`.
 * `volume` - (Optional) A set of [volume blocks](#volume-block-arguments) that containers in your task may use.
 * `placement_constraints` - (Optional) A set of [placement constraints](#placement-constraints-arguments) rules that are taken into consideration during task placement. Maximum number of `placement_constraints` is `10`.