Add EFS transit encryption and authorization config options for ECS task definition #13136

jukie · 2020-05-02T15:53:04Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

Adds support for EFS transit encryption and authorization configuration options for ECS task definition's volume configuration

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSEcsTaskDefinition_' TEST=./aws
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSEcsTaskDefinition_ -timeout 120m
=== RUN   TestAccAWSEcsTaskDefinition_basic
=== PAUSE TestAccAWSEcsTaskDefinition_basic
=== RUN   TestAccAWSEcsTaskDefinition_withScratchVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withScratchVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== RUN   TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withEcsService
=== PAUSE TestAccAWSEcsTaskDefinition_withEcsService
=== RUN   TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== RUN   TestAccAWSEcsTaskDefinition_withNetworkMode
=== PAUSE TestAccAWSEcsTaskDefinition_withNetworkMode
=== RUN   TestAccAWSEcsTaskDefinition_withIPCMode
=== PAUSE TestAccAWSEcsTaskDefinition_withIPCMode
=== RUN   TestAccAWSEcsTaskDefinition_withPidMode
=== PAUSE TestAccAWSEcsTaskDefinition_withPidMode
=== RUN   TestAccAWSEcsTaskDefinition_constraint
=== PAUSE TestAccAWSEcsTaskDefinition_constraint
=== RUN   TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== PAUSE TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== RUN   TestAccAWSEcsTaskDefinition_arrays
=== PAUSE TestAccAWSEcsTaskDefinition_arrays
=== RUN   TestAccAWSEcsTaskDefinition_Fargate
=== PAUSE TestAccAWSEcsTaskDefinition_Fargate
=== RUN   TestAccAWSEcsTaskDefinition_ExecutionRole
=== PAUSE TestAccAWSEcsTaskDefinition_ExecutionRole
=== RUN   TestAccAWSEcsTaskDefinition_Inactive
=== PAUSE TestAccAWSEcsTaskDefinition_Inactive
=== RUN   TestAccAWSEcsTaskDefinition_Tags
=== PAUSE TestAccAWSEcsTaskDefinition_Tags
=== RUN   TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== PAUSE TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== RUN   TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== PAUSE TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_basic
=== CONT  TestAccAWSEcsTaskDefinition_withIPCMode
=== CONT  TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_Fargate
=== CONT  TestAccAWSEcsTaskDefinition_arrays
=== CONT  TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== CONT  TestAccAWSEcsTaskDefinition_constraint
=== CONT  TestAccAWSEcsTaskDefinition_ExecutionRole
=== CONT  TestAccAWSEcsTaskDefinition_withPidMode
=== CONT  TestAccAWSEcsTaskDefinition_withEcsService
=== CONT  TestAccAWSEcsTaskDefinition_withNetworkMode
=== CONT  TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== CONT  TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== CONT  TestAccAWSEcsTaskDefinition_Inactive
=== CONT  TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== CONT  TestAccAWSEcsTaskDefinition_Tags
--- PASS: TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume (23.19s)
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig (23.29s)
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolume
--- PASS: TestAccAWSEcsTaskDefinition_inferenceAccelerator (23.58s)
=== CONT  TestAccAWSEcsTaskDefinition_withScratchVolume
--- PASS: TestAccAWSEcsTaskDefinition_constraint (23.62s)
--- PASS: TestAccAWSEcsTaskDefinition_arrays (23.68s)
--- PASS: TestAccAWSEcsTaskDefinition_ExecutionRole (24.04s)
--- PASS: TestAccAWSEcsTaskDefinition_withIPCMode (24.34s)
--- PASS: TestAccAWSEcsTaskDefinition_withNetworkMode (24.34s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskRoleArn (24.42s)
--- PASS: TestAccAWSEcsTaskDefinition_withPidMode (24.43s)
--- PASS: TestAccAWSEcsTaskDefinition_Fargate (32.75s)
--- PASS: TestAccAWSEcsTaskDefinition_ProxyConfiguration (34.08s)
--- PASS: TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume (35.23s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolume (35.26s)
--- PASS: TestAccAWSEcsTaskDefinition_Inactive (38.16s)
--- PASS: TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource (38.18s)
--- PASS: TestAccAWSEcsTaskDefinition_basic (38.31s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSAccessPoint (41.70s)
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolume (21.80s)
--- PASS: TestAccAWSEcsTaskDefinition_withScratchVolume (22.06s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal (33.79s)
--- PASS: TestAccAWSEcsTaskDefinition_Tags (62.18s)
--- PASS: TestAccAWSEcsTaskDefinition_withEcsService (112.93s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	112.981s

jukie · 2020-05-02T15:56:44Z

Also have code ready for authorization config but depends on #11965 to use an access point Id in acc tests.

ewbankkit · 2020-05-03T20:43:49Z

@jukie Thanks for this.
Could you please add a separate acceptance tests for the new attributes and leave testAccAWSEcsTaskDefinitionWithEFSVolume() as-is so that we can ensure there are no regressions for existing functionality?

jukie · 2020-05-03T20:53:59Z

Sure, I’ll update it now

jukie · 2020-05-03T21:51:47Z

New Acctests output:

make testacc TESTARGS='-run=TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume' TEST=./aws
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume -timeout 120m
=== RUN   TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
--- PASS: TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume (29.10s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       30.761s

ewbankkit · 2020-05-03T23:27:22Z

Verified acceptance tests:

$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSEcsTaskDefinition_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -count 1 -parallel 20 -run=TestAccAWSEcsTaskDefinition_ -timeout 120m
=== RUN   TestAccAWSEcsTaskDefinition_basic
=== PAUSE TestAccAWSEcsTaskDefinition_basic
=== RUN   TestAccAWSEcsTaskDefinition_withScratchVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withScratchVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withEcsService
=== PAUSE TestAccAWSEcsTaskDefinition_withEcsService
=== RUN   TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== RUN   TestAccAWSEcsTaskDefinition_withNetworkMode
=== PAUSE TestAccAWSEcsTaskDefinition_withNetworkMode
=== RUN   TestAccAWSEcsTaskDefinition_withIPCMode
=== PAUSE TestAccAWSEcsTaskDefinition_withIPCMode
=== RUN   TestAccAWSEcsTaskDefinition_withPidMode
=== PAUSE TestAccAWSEcsTaskDefinition_withPidMode
=== RUN   TestAccAWSEcsTaskDefinition_constraint
=== PAUSE TestAccAWSEcsTaskDefinition_constraint
=== RUN   TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== PAUSE TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== RUN   TestAccAWSEcsTaskDefinition_arrays
=== PAUSE TestAccAWSEcsTaskDefinition_arrays
=== RUN   TestAccAWSEcsTaskDefinition_Fargate
=== PAUSE TestAccAWSEcsTaskDefinition_Fargate
=== RUN   TestAccAWSEcsTaskDefinition_ExecutionRole
=== PAUSE TestAccAWSEcsTaskDefinition_ExecutionRole
=== RUN   TestAccAWSEcsTaskDefinition_Inactive
=== PAUSE TestAccAWSEcsTaskDefinition_Inactive
=== RUN   TestAccAWSEcsTaskDefinition_Tags
=== PAUSE TestAccAWSEcsTaskDefinition_Tags
=== RUN   TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== PAUSE TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== RUN   TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== PAUSE TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_basic
=== CONT  TestAccAWSEcsTaskDefinition_withPidMode
=== CONT  TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== CONT  TestAccAWSEcsTaskDefinition_Tags
=== CONT  TestAccAWSEcsTaskDefinition_withIPCMode
=== CONT  TestAccAWSEcsTaskDefinition_Inactive
=== CONT  TestAccAWSEcsTaskDefinition_withNetworkMode
=== CONT  TestAccAWSEcsTaskDefinition_ExecutionRole
=== CONT  TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== CONT  TestAccAWSEcsTaskDefinition_Fargate
=== CONT  TestAccAWSEcsTaskDefinition_withEcsService
=== CONT  TestAccAWSEcsTaskDefinition_arrays
=== CONT  TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== CONT  TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== CONT  TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_constraint
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
--- PASS: TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume (27.77s)
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolume
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig (27.97s)
=== CONT  TestAccAWSEcsTaskDefinition_withScratchVolume
--- PASS: TestAccAWSEcsTaskDefinition_inferenceAccelerator (27.99s)
--- PASS: TestAccAWSEcsTaskDefinition_constraint (28.31s)
--- PASS: TestAccAWSEcsTaskDefinition_arrays (28.69s)
--- PASS: TestAccAWSEcsTaskDefinition_withIPCMode (29.49s)
--- PASS: TestAccAWSEcsTaskDefinition_withNetworkMode (29.50s)
--- PASS: TestAccAWSEcsTaskDefinition_withPidMode (29.84s)
--- PASS: TestAccAWSEcsTaskDefinition_ExecutionRole (29.89s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskRoleArn (29.94s)
--- PASS: TestAccAWSEcsTaskDefinition_ProxyConfiguration (38.56s)
--- PASS: TestAccAWSEcsTaskDefinition_Fargate (38.90s)
--- PASS: TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume (39.97s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolume (40.02s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal (40.15s)
--- PASS: TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource (44.26s)
--- PASS: TestAccAWSEcsTaskDefinition_Inactive (44.54s)
--- PASS: TestAccAWSEcsTaskDefinition_basic (44.55s)
--- PASS: TestAccAWSEcsTaskDefinition_withScratchVolume (23.66s)
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolume (24.33s)
--- PASS: TestAccAWSEcsTaskDefinition_Tags (68.27s)
--- PASS: TestAccAWSEcsTaskDefinition_withEcsService (118.16s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	118.264s

jukie · 2020-05-20T04:13:49Z

Now that #11965 is merged I'll update this to include the changes for efs access points.

aws/resource_aws_ecs_task_definition.go

website/docs/r/waf_sql_injection_match_set.html.markdown

jukie · 2020-06-10T22:18:33Z

Didn't mean to change the reviewer if someone's able to change it back to @terraform-providers/aws-provider

marsavela · 2020-06-11T13:15:32Z

This looks good. Any idea on how to push this further? I will update with my passing test shortly.

EDIT: Tests look good too.

➜  terraform-provider-aws git:(12809-efs-vol-conf) make testacc TESTARGS='-run=TestAccAWSEcsTaskDefinition_' TEST=./aws
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSEcsTaskDefinition_ -timeout 120m
=== RUN   TestAccAWSEcsTaskDefinition_basic
=== PAUSE TestAccAWSEcsTaskDefinition_basic
=== RUN   TestAccAWSEcsTaskDefinition_withScratchVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withScratchVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== PAUSE TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== RUN   TestAccAWSEcsTaskDefinition_withEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== RUN   TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== PAUSE TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== RUN   TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== RUN   TestAccAWSEcsTaskDefinition_withEcsService
=== PAUSE TestAccAWSEcsTaskDefinition_withEcsService
=== RUN   TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== PAUSE TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== RUN   TestAccAWSEcsTaskDefinition_withNetworkMode
=== PAUSE TestAccAWSEcsTaskDefinition_withNetworkMode
=== RUN   TestAccAWSEcsTaskDefinition_withIPCMode
=== PAUSE TestAccAWSEcsTaskDefinition_withIPCMode
=== RUN   TestAccAWSEcsTaskDefinition_withPidMode
=== PAUSE TestAccAWSEcsTaskDefinition_withPidMode
=== RUN   TestAccAWSEcsTaskDefinition_constraint
=== PAUSE TestAccAWSEcsTaskDefinition_constraint
=== RUN   TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== PAUSE TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== RUN   TestAccAWSEcsTaskDefinition_arrays
=== PAUSE TestAccAWSEcsTaskDefinition_arrays
=== RUN   TestAccAWSEcsTaskDefinition_Fargate
=== PAUSE TestAccAWSEcsTaskDefinition_Fargate
=== RUN   TestAccAWSEcsTaskDefinition_ExecutionRole
=== PAUSE TestAccAWSEcsTaskDefinition_ExecutionRole
=== RUN   TestAccAWSEcsTaskDefinition_Inactive
=== PAUSE TestAccAWSEcsTaskDefinition_Inactive
=== RUN   TestAccAWSEcsTaskDefinition_Tags
=== PAUSE TestAccAWSEcsTaskDefinition_Tags
=== RUN   TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== PAUSE TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== RUN   TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== PAUSE TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_basic
=== CONT  TestAccAWSEcsTaskDefinition_inferenceAccelerator
=== CONT  TestAccAWSEcsTaskDefinition_Inactive
=== CONT  TestAccAWSEcsTaskDefinition_withEcsService
=== CONT  TestAccAWSEcsTaskDefinition_arrays
=== CONT  TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource
=== CONT  TestAccAWSEcsTaskDefinition_constraint
=== CONT  TestAccAWSEcsTaskDefinition_withPidMode
=== CONT  TestAccAWSEcsTaskDefinition_withIPCMode
=== CONT  TestAccAWSEcsTaskDefinition_withNetworkMode
=== CONT  TestAccAWSEcsTaskDefinition_withTaskRoleArn
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume
=== CONT  TestAccAWSEcsTaskDefinition_withEFSAccessPoint
=== CONT  TestAccAWSEcsTaskDefinition_Tags
=== CONT  TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig
=== CONT  TestAccAWSEcsTaskDefinition_ProxyConfiguration
=== CONT  TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal
=== CONT  TestAccAWSEcsTaskDefinition_Fargate
--- PASS: TestAccAWSEcsTaskDefinition_inferenceAccelerator (40.44s)
=== CONT  TestAccAWSEcsTaskDefinition_withDockerVolume
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig (40.50s)
=== CONT  TestAccAWSEcsTaskDefinition_withScratchVolume
--- PASS: TestAccAWSEcsTaskDefinition_arrays (40.52s)
=== CONT  TestAccAWSEcsTaskDefinition_ExecutionRole
--- PASS: TestAccAWSEcsTaskDefinition_constraint (41.54s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume (42.43s)
--- PASS: TestAccAWSEcsTaskDefinition_withIPCMode (43.81s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskRoleArn (44.38s)
--- PASS: TestAccAWSEcsTaskDefinition_withNetworkMode (44.54s)
--- PASS: TestAccAWSEcsTaskDefinition_withPidMode (44.94s)
--- PASS: TestAccAWSEcsTaskDefinition_ProxyConfiguration (55.94s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolume (56.45s)
--- PASS: TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume (56.78s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal (58.86s)
--- PASS: TestAccAWSEcsTaskDefinition_Fargate (58.91s)
--- PASS: TestAccAWSEcsTaskDefinition_Inactive (67.74s)
--- PASS: TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource (69.27s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSAccessPoint (70.78s)
--- PASS: TestAccAWSEcsTaskDefinition_basic (71.92s)
--- PASS: TestAccAWSEcsTaskDefinition_withScratchVolume (41.32s)
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolume (42.19s)
--- PASS: TestAccAWSEcsTaskDefinition_ExecutionRole (47.46s)
--- PASS: TestAccAWSEcsTaskDefinition_Tags (103.71s)
--- PASS: TestAccAWSEcsTaskDefinition_withEcsService (133.23s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	135.491s
➜  terraform-provider-aws git:(12809-efs-vol-conf)

marsavela

LGTM

DrFaust92

small changes. ill add the provider as reviewer

aws/resource_aws_ecs_task_definition.go

DrFaust92 · 2020-06-11T13:46:24Z

added @bflad as i cant re-add the provider

…ncryption

marsavela · 2020-06-15T11:17:18Z

Does anyone here know who could or how to push this further? Seems a pretty requested feature.

daspn · 2020-06-17T19:37:55Z

+1 to push this further! This is exactly what I currently need. My options are: wait for this change to be included or find a workaround (maybe create my task definition using CloudFormation). But this would cause some serious changes on my code base.

milpog · 2020-06-18T15:50:58Z

Is there something we can do to help releasing it with the next version of the AWS provider?

daspn · 2020-06-18T21:18:08Z

I've compiled the PR here and tested attaching an EFS volume to a container that does not run as root and everything went as expected.

Access Point

Volume created on the Task Definition

Terraform code

resource "aws_ecs_task_definition" "default" {
  family                = var.name
  container_definitions = var.container_definitions
  task_role_arn         = var.task_role_arn
  execution_role_arn    = var.execution_role_arn
  network_mode          = var.task_network_mode

  dynamic "volume" {
    for_each = var.efs_volumes

    content {
      name = volume.value["name"]
      efs_volume_configuration {
        file_system_id     = volume.value["file_system_id"]
        root_directory     = volume.value["root_directory"]
        transit_encryption = volume.value["transit_encryption"] != "ENABLED" ? "" : "ENABLED"
        dynamic "authorization_config" {
          for_each = volume.value["access_point_id"] != "" ? [1] : []
          content {
            access_point_id = volume.value["access_point_id"]
            iam             = volume.value["iam"] != "ENABLED" ? "" : "ENABLED"
          }
        }
      }
    }
  }
}

milpog · 2020-06-19T07:12:45Z

I've compiled the PR here and tested attaching an EFS volume to a container that does not run as root and everything went as expected.

Same for me!

krishanhettihewa · 2020-06-20T13:00:09Z

Hello @bflad, this very useful feature, Any idea when you are going to complete the review. Thanks in advance.

krishanhettihewa · 2020-06-23T03:03:11Z

+1 to push this further! This is exactly what I currently need. My options are: wait for this change to be included or find a workaround (maybe create my task definition using CloudFormation). But this would cause some serious changes on my code base.

+1 me too also on hold exactly at this place. For now, as a workaround I would manually adding the this EFS AP block after creating the task from the TF. Then, passing the incremented task version to the service as a variable. I know, it sounds weird and not a good practice, however still easier than moving to CF for this purpose as feature gonna release soon.

bflad

Thank you so much @jukie and everyone involved. Looks great. 🚀

Output from acceptance testing:

--- PASS: TestAccAWSEcsTaskDefinition_arrays (20.05s)
--- PASS: TestAccAWSEcsTaskDefinition_basic (33.04s)
--- PASS: TestAccAWSEcsTaskDefinition_changeVolumesForcesNewResource (32.93s)
--- PASS: TestAccAWSEcsTaskDefinition_constraint (20.00s)
--- PASS: TestAccAWSEcsTaskDefinition_ExecutionRole (20.53s)
--- PASS: TestAccAWSEcsTaskDefinition_Fargate (27.83s)
--- PASS: TestAccAWSEcsTaskDefinition_Inactive (35.23s)
--- PASS: TestAccAWSEcsTaskDefinition_inferenceAccelerator (20.16s)
--- PASS: TestAccAWSEcsTaskDefinition_ProxyConfiguration (32.37s)
--- PASS: TestAccAWSEcsTaskDefinition_Tags (53.63s)
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolume (19.53s)
--- PASS: TestAccAWSEcsTaskDefinition_withDockerVolumeMinimalConfig (19.77s)
--- PASS: TestAccAWSEcsTaskDefinition_withEcsService (55.57s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSAccessPoint (36.35s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolume (32.50s)
--- PASS: TestAccAWSEcsTaskDefinition_withEFSVolumeMinimal (32.62s)
--- PASS: TestAccAWSEcsTaskDefinition_withIPCMode (20.97s)
--- PASS: TestAccAWSEcsTaskDefinition_withNetworkMode (20.95s)
--- PASS: TestAccAWSEcsTaskDefinition_withPidMode (20.92s)
--- PASS: TestAccAWSEcsTaskDefinition_withScratchVolume (19.86s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskRoleArn (19.80s)
--- PASS: TestAccAWSEcsTaskDefinition_withTaskScopedDockerVolume (20.78s)
--- PASS: TestAccAWSEcsTaskDefinition_withTransitEncryptionEFSVolume (32.56s)

ghost · 2020-06-26T00:42:55Z

This has been released in version 2.68.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

ghost · 2020-07-24T17:11:01Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

jukie added 3 commits May 2, 2020 11:45

Update ECS task def resource schema

a2e0a3e

Update EFS volume config to account for transit encryption

384fb86

Update acceptance tests to use transit encryption

ecd240d

jukie requested a review from a team May 2, 2020 15:53

jukie changed the title ~~12809 efs vol conf~~ Add transit encryption options for EFS volume config in ECS task definition May 2, 2020

ghost added the documentation Introduces or discusses updates to documentation. label May 2, 2020

Update website docs for EFS volume config options

3fdfdfb

jukie force-pushed the 12809-efs-vol-conf branch from 18504ff to 3fdfdfb Compare May 2, 2020 16:13

ghost added the service/waf Issues and PRs that pertain to the waf service. label May 2, 2020

jukie mentioned this pull request May 2, 2020

Add transitEncryption and authorizationConfig to efs_volume_configuration in ECS task definition #12810

Closed

"Update acceptance tests to use transit encryption"

8a69551

ghost added size/M Managed by automation to categorize the size of a PR. and removed size/S Managed by automation to categorize the size of a PR. labels May 3, 2020

This was referenced May 11, 2020

More ECS task definition EFS volume configuration options #12809

Closed

ECS Task Definition needs additional parameters for EFS Access Points #13286

Closed

Merge remote-tracking branch 'upstream/master' into 12809-efs-vol-conf

9cc8178

DrFaust92 suggested changes May 20, 2020

View reviewed changes

aws/resource_aws_ecs_task_definition.go Show resolved Hide resolved

aws/resource_aws_ecs_task_definition.go Show resolved Hide resolved

website/docs/r/waf_sql_injection_match_set.html.markdown Outdated Show resolved Hide resolved

Add EFS Access Point config schema and tests

69b738b

ghost added size/L Managed by automation to categorize the size of a PR. and removed size/M Managed by automation to categorize the size of a PR. labels May 20, 2020

jukie requested review from DrFaust92 and removed request for a team June 10, 2020 22:12

marsavela approved these changes Jun 11, 2020

View reviewed changes

DrFaust92 suggested changes Jun 11, 2020

View reviewed changes

aws/resource_aws_ecs_task_definition.go Show resolved Hide resolved

aws/resource_aws_ecs_task_definition.go Show resolved Hide resolved

DrFaust92 requested review from tf-release-bot and bflad and removed request for tf-release-bot June 11, 2020 13:45

jukie added 2 commits June 11, 2020 18:43

Add validator functions for EFSAuthorizationConfigIAM and EFSTransitE…

68a9800

…ncryption

Fix typo in function name

4c5c6e4

Rebase from master

b18cda5

bflad self-assigned this Jun 24, 2020

bflad added this to the v2.68.0 milestone Jun 24, 2020

bflad linked an issue Jun 24, 2020 that may be closed by this pull request

ECS Task Definition needs additional parameters for EFS Access Points #13286

Closed

bflad approved these changes Jun 24, 2020

View reviewed changes

bflad merged commit a6d8095 into hashicorp:master Jun 24, 2020

bflad added a commit that referenced this pull request Jun 24, 2020

Update CHANGELOG for #13136

08b415c

ghost locked and limited conversation to collaborators Jul 24, 2020

justinretzolk added the partner Contribution from a partner. label May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add EFS transit encryption and authorization config options for ECS task definition #13136

Add EFS transit encryption and authorization config options for ECS task definition #13136

jukie commented May 2, 2020 •

edited

Loading

jukie commented May 2, 2020

ewbankkit commented May 3, 2020

jukie commented May 3, 2020

jukie commented May 3, 2020

ewbankkit commented May 3, 2020

jukie commented May 20, 2020

jukie commented Jun 10, 2020

marsavela commented Jun 11, 2020 •

edited

Loading

marsavela left a comment

DrFaust92 left a comment

DrFaust92 commented Jun 11, 2020

marsavela commented Jun 15, 2020

daspn commented Jun 17, 2020

milpog commented Jun 18, 2020

daspn commented Jun 18, 2020 •

edited

Loading

milpog commented Jun 19, 2020

krishanhettihewa commented Jun 20, 2020 •

edited

Loading

krishanhettihewa commented Jun 23, 2020

bflad left a comment

ghost commented Jun 26, 2020

ghost commented Jul 24, 2020

Add EFS transit encryption and authorization config options for ECS task definition #13136

Add EFS transit encryption and authorization config options for ECS task definition #13136

Conversation

jukie commented May 2, 2020 • edited Loading

Community Note

jukie commented May 2, 2020

ewbankkit commented May 3, 2020

jukie commented May 3, 2020

jukie commented May 3, 2020

ewbankkit commented May 3, 2020

jukie commented May 20, 2020

jukie commented Jun 10, 2020

marsavela commented Jun 11, 2020 • edited Loading

marsavela left a comment

Choose a reason for hiding this comment

DrFaust92 left a comment

Choose a reason for hiding this comment

DrFaust92 commented Jun 11, 2020

marsavela commented Jun 15, 2020

daspn commented Jun 17, 2020

milpog commented Jun 18, 2020

daspn commented Jun 18, 2020 • edited Loading

Access Point

Volume created on the Task Definition

Terraform code

milpog commented Jun 19, 2020

krishanhettihewa commented Jun 20, 2020 • edited Loading

krishanhettihewa commented Jun 23, 2020

bflad left a comment

Choose a reason for hiding this comment

ghost commented Jun 26, 2020

ghost commented Jul 24, 2020

jukie commented May 2, 2020 •

edited

Loading

marsavela commented Jun 11, 2020 •

edited

Loading

daspn commented Jun 18, 2020 •

edited

Loading

krishanhettihewa commented Jun 20, 2020 •

edited

Loading