Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Enhancement]: Allow assigning KMS keys for ECS Fargate ephemeral storage encryption #37922

Open
markbaird opened this issue Jun 11, 2024 · 1 comment · May be fixed by #37932
Open

[Enhancement]: Allow assigning KMS keys for ECS Fargate ephemeral storage encryption #37922

markbaird opened this issue Jun 11, 2024 · 1 comment · May be fixed by #37932
Labels
enhancement Requests to existing resources that expand the functionality or scope. service/ecs Issues and PRs that pertain to the ecs service.

Comments

@markbaird
Copy link

Description

This feature was released by AWS yesterday, June 10th, 2024. They provide an AWS CLI example command for enabling the new feature:

aws ecs create-cluster \
  --cluster clusterName \
  --configuration '{"managedStorageConfiguration":{"fargateEphemeralStorageKmsKeyId":"arn:aws:kms:us-west-2:012345678901:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"}}'

Currently only execute_command_configuration is allowed in an ECS cluster configuration in Terraform:

resource "aws_ecs_cluster" "my_cluster" {
  name = "my_cluster"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.my_kms_key.id
    }
  }
}

The new configuration needs to be added as a supported option in the ecs_cluster.configuration block, for example:

resource "aws_ecs_cluster" "my_cluster" {
  name = "my_cluster"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.my_kms_key.id
    }

   managedStorageConfiguration {
      fargateEphemeralStorageKmsKeyId = aws_kms_key.my_kms_key.id
   }
  }
}

Affected Resource(s) and/or Data Source(s)

aws_ecs_cluster

Potential Terraform Configuration

resource "aws_ecs_cluster" "my_cluster" {
  name = "my_cluster"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.my_kms_key.id
    }

   managedStorageConfiguration {
      fargateEphemeralStorageKmsKeyId = aws_kms_key.my_kms_key.id
   }
  }
}

References

https://aws.amazon.com/blogs/compute/securing-amazon-ecs-workloads-on-aws-fargate-with-customer-managed-keys/

Would you like to implement a fix?

No
@markbaird markbaird added the enhancement Requests to existing resources that expand the functionality or scope. label Jun 11, 2024
@github-actions github-actions bot added the service/ecs Issues and PRs that pertain to the ecs service. label Jun 11, 2024
@github-actions GitHub Actions
Copy link

Community Note

Voting for Prioritization

  • Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
  • Please see our prioritization guide for information on how we prioritize.
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

  • If you are interested in working on this issue, please leave a comment.
  • If this would be your first contribution, please review the contribution guide.

@terraform-aws-provider terraform-aws-provider bot added the needs-triage Waiting for first response or review from a maintainer. label Jun 11, 2024
@justinretzolk justinretzolk removed the needs-triage Waiting for first response or review from a maintainer. label Jun 11, 2024
@acwwat acwwat linked a pull request Jun 12, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Requests to existing resources that expand the functionality or scope. service/ecs Issues and PRs that pertain to the ecs service.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: Add managed_storage_configuration block to aws_ecs_cluster acwwat/terraform-provider-aws
2 participants
@markbaird @justinretzolk