Terraform中ECS任务定义的动态化改造及代码精简咨询

需求背景 #

我维护多个ECS任务定义资源，不想为每个独特定义单独创建模块，希望打造一个通用型模块适配所有容器场景。核心难点在于不同任务的环境变量差异明显：有的仅4个变量，有的多达12个；部分变量值还依赖其他模块的输出（比如数据库端点）。

现有任务定义示例：

resource "aws_ecs_task_definition" "service" {

  execution_role_arn = var.ecsTaskExecutionRole
  task_role_arn      = var.ecsTaskExecutionRole
  requires_compatibilities = ["FARGATE"]
  family                   = "${var.name}-definition"
  container_definitions = jsonencode([
    {
      "environment" : [
        { "name" : "database_endpoint",
          "value" : "${var.database_endpoint}"
        },
        { "name" : "database_password",
          "value" : "admin"
        }
      ],
      "healthCheck" : {
        "command" : [
          "CMD-SHELL",
          "echo \"hello\""
        ],
        "interval" : 10,
        "timeout" : 60,
        "retries" : 10,
        "startPeriod" : 60
      },
      command   = ["start", "--auto-build"]
      name      = "${var.name}"
      image     = "${var.image}"
      cpu       = 1024
      memory    = 2048
      essential = true
      portMappings = [
        {
          containerPort = 7278
          hostPort      = 7278
        }
      ]
    },
  ])
  network_mode = "awsvpc"
  cpu          = 1024
  memory       = 2048

  runtime_platform {
    operating_system_family = "LINUX"
  }

}

我希望实现的效果是：调用模块时传入结构化的容器配置对象，动态生成对应的environment列表，示例传入变量如下（空字符串值后续会更新）：

containers = {
  image1 = {
    image = "imageUrl"
  }
  image2 = {
    image = "imageUrl"
    documentdb_endpoint = ""
  }
  image3 = {
    image = "imageUrl"
    redis_endpoint = ""
  }
  image4 = {
    image = "imageUrl"
  }
}

实现方案 #

1. 定义通用模块的输入变量 #

通过optional类型为通用配置设置默认值，减少重复代码，同时保留自定义灵活性：

variable "ecs_task_execution_role" {
  type        = string
  description = "ECS任务执行角色ARN"
}

variable "family_prefix" {
  type        = string
  description = "任务定义family前缀"
}

variable "cpu" {
  type        = number
  description = "任务级CPU分配"
  default     = 1024
}

variable "memory" {
  type        = number
  description = "任务级内存分配"
  default     = 2048
}

variable "containers" {
  type = map(object({
    image           = string
    command         = optional(list(string), ["start", "--auto-build"])
    cpu             = optional(number, 1024)
    memory          = optional(number, 2048)
    container_port  = optional(number, 7278)
    health_check    = optional(object({
      command     = list(string)
      interval    = number
      timeout     = number
      retries     = number
      startPeriod = number
    }), {
      command     = ["CMD-SHELL", "echo \"hello\""]
      interval    = 10
      timeout     = 60
      retries     = 10
      startPeriod = 60
    })
    # 动态环境变量：键为环境变量名，值为变量值（支持空字符串后续更新）
    environment = optional(map(string), {})
  }))
  description = "容器配置集合，key为容器名称"
}

2. 编写通用任务定义资源 #

通过for循环遍历容器配置，动态生成容器定义和环境变量列表：

resource "aws_ecs_task_definition" "service" {
  execution_role_arn         = var.ecs_task_execution_role
  task_role_arn              = var.ecs_task_execution_role
  requires_compatibilities   = ["FARGATE"]
  family                     = "${var.family_prefix}-definition"
  network_mode               = "awsvpc"
  cpu                        = var.cpu
  memory                     = var.memory

  runtime_platform {
    operating_system_family = "LINUX"
  }

  container_definitions = jsonencode([
    for container_name, cfg in var.containers : {
      name      = container_name
      image     = cfg.image
      command   = cfg.command
      cpu       = cfg.cpu
      memory    = cfg.memory
      essential = true
      portMappings = [
        {
          containerPort = cfg.container_port
          hostPort      = cfg.container_port
        }
      ]
      healthCheck = cfg.health_check
      # 转换map格式的环境变量为ECS要求的列表结构
      environment = [
        for env_name, env_val in cfg.environment : {
          name  = env_name
          value = env_val
        }
        # 若需过滤空值，可添加条件：if env_val != ""
      ]
    }
  ])
}

3. 调用通用模块示例 #

根据不同容器的需求传入配置，环境变量支持直接引用其他模块输出：

module "ecs_task" {
  source = "./modules/ecs-task-def"

  ecs_task_execution_role = var.ecs_task_execution_role_arn
  family_prefix           = "my-app-service"
  cpu                     = 1024
  memory                  = 2048

  containers = {
    image1 = {
      image = "my-repo/image1:latest"
    }
    image2 = {
      image = "my-repo/image2:latest"
      environment = {
        documentdb_endpoint = "" # 后续通过terraform apply更新
      }
    }
    image3 = {
      image = "my-repo/image3:latest"
      environment = {
        redis_endpoint = module.redis_cluster.endpoint
      }
    }
    image4 = {
      image = "my-repo/image4:latest"
      environment = {
        database_endpoint = module.db.instance_endpoint
        database_password = "admin"
        api_key           = var.api_key
      }
    }
  }
}

额外优化建议 #

• 敏感信息处理：密码、密钥等敏感值建议改用secrets字段集成AWS Secrets Manager/SSM Parameter Store，模块中可添加secrets可选字段增强安全性
• 端口映射灵活性：将portMappings设为可选类型，适配无需端口暴露的容器
• 多容器任务支持：当前天然支持多容器任务，只需在containers中添加多个键值对即可

内容的提问来源于stack exchange，提问作者Christian Townsend