Files

T

History

Robert Fairburn e2681aea79 Add configurable Fleet private key delivery, optional command override, and caller-managed private key secret ARN support (#205 )

## Summary

  This PR extends the Fleet ECS modules to support:

  - configurable Fleet server private key delivery via ecs or iam
  - optional fleet_config.command overrides for Fleet task definitions
- caller-managed Fleet server private key secrets via
fleet_config.private_key_secret_arn

It also updates the external vuln scans addon to follow the same
private-key delivery and command behavior, and refreshes the generated
module documentation.

  ## What changed

- Added fleet_config.private_key_delivery_method with supported values:
- ecs (default): inject the private key as FLEET_SERVER_PRIVATE_KEY
      - iam: inject the secret ARN as FLEET_SERVER_PRIVATE_KEY_ARN
  - Added validation so only ecs or iam are accepted
- Added fleet_config.command support so callers can override the Fleet
container command when needed
- Added fleet_config.private_key_secret_arn support so callers can
supply an existing Secrets Manager secret instead of having this module
create and populate one
- Updated IAM policy wiring so private-key secret access and private-key
KMS decrypt permissions are granted to the correct role based on the
selected delivery method
- Updated module outputs so fleet_server_private_key_secret_arn returns
the effective ARN whether the secret is module-managed or caller-managed
- Updated addons/external-vuln-scans to consume the same private-key
delivery mode and optional command behavior from the passed fleet_config
  - Updated byo-ecs documentation and regenerated README files

  ## Behavior

  ### Private key delivery

- ecs mode injects the secret value into the container and uses the ECS
execution role for private-key secret access
- iam mode injects the secret ARN into the container environment and
uses the Fleet task role for private-key secret access

  ### Command override

- When fleet_config.command is unset, the task definition omits command
- When fleet_config.command is set, the provided command is passed
through to the Fleet container
- This behavior now applies consistently to both the main ECS service
and external vuln scans

  ### Caller-managed private key secret

- When fleet_config.private_key_secret_arn is unset, the module creates
and populates the Fleet private key secret
- When fleet_config.private_key_secret_arn is set, the module uses the
provided secret ARN and does not create the secret, secret version, or
generated random value

  ## KMS note for external secrets

If a caller-managed private-key secret uses a CMK, the caller must also
provide the existing private-key KMS ARN input so the correct role
receives decrypt permissions for the selected delivery mode.

  ## Validation

  Validated successfully with:

  - terraform validate -no-color at repo root
  - terraform validate -no-color in byo-vpc
  - terraform validate -no-color in byo-vpc/byo-db
  - terraform validate -no-color in byo-vpc/byo-db/byo-ecs

Also verified that existing module-managed private-key resources plan as
non-destructive state-address moves when transitioning to the new
counted resources:

  - 0 to add
  - 0 to change
  - 0 to destroy

2026-04-06 19:25:17 -05:00

.header.md

Initial migration (#1 )

2025-02-04 10:07:51 -06:00

.terraform-docs.yml

Initial migration (#1 )

2025-02-04 10:07:51 -06:00

main.tf

Add configurable Fleet private key delivery, optional command override, and caller-managed private key secret ARN support (#205 )

2026-04-06 19:25:17 -05:00

outputs.tf

Initial migration (#1 )

2025-02-04 10:07:51 -06:00

README.md

AWS Region Terraform deprecation fixes (#87 )

2025-08-11 11:49:01 -04:00

variables.tf

Initial migration (#1 )

2025-02-04 10:07:51 -06:00

README.md

External Vulnerability Scans addon

This addon creates an additional ECS service that only runs a single task, responsible for vuln processing. It receives no web traffic. We utilize current instance checks to make this happen. The advantages of this mechanism:

dedicating processing power to vuln processing 2. ensures task responsible for vuln processing isn't also trying to serve web traffic
caching of vulnerability artifacts/dependencies

Usage is simplified by using the output from the fleet byo-ecs module (../terraform/byo-vpc/byo-db/byo-ecs/README.md)

Requirements

No requirements.

Providers

Name	Version
aws	6.8.0

Modules

No modules.

Resources

Name	Type
aws_ecs_service.fleet	resource
aws_ecs_task_definition.vuln-processing	resource
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
awslogs_config	n/a	object({ group = string region = string prefix = string })	n/a	yes
customer_prefix	n/a	`string`	`"fleet"`	no
ecs_cluster	The ecs cluster module that is created by the byo-db module	`any`	n/a	yes
execution_iam_role_arn	The ARN of the fleet execution role, this is necessary to pass role from ecs events	`any`	n/a	yes
fleet_config	The root Fleet config object	`any`	n/a	yes
fleet_s3_software_installers_config	use the output of the byo-vpc module with the same name	`map(string)`	n/a	yes
fleet_server_private_key_secret_arn	The ARN of the secret that stores the Fleet private key	`string`	n/a	yes
security_groups	n/a	`list(string)`	n/a	yes
subnets	n/a	`list(string)`	n/a	yes
task_role_arn	The ARN of the fleet task role, this is necessary to pass role from ecs events	`any`	n/a	yes
vuln_processing_cpu	The amount of CPU to dedicate to the vuln processing command	`number`	`1024`	no
vuln_processing_memory	The amount of memory to dedicate to the vuln processing command	`number`	`4096`	no
vuln_processing_task_cpu	The amount of CPU to dedicate to the vuln processing task including sidecars	`number`	`1024`	no
vuln_processing_task_memory	The amount of memory to dedicate to the vuln processing task including sidecars	`number`	`4096`	no

Outputs

Name	Description
extra_environment_variables	n/a
vuln_service_arn	n/a