如何通过Terraform将本地.yml文件添加至ECS Task容器？

注意：Fargate无法直接挂载本地主机的文件，必须先把文件上传到AWS的存储服务，以下是两种常用实现方案：

方案一：通过S3下载配置文件（适合单个配置文件场景） #

1. 用Terraform自动上传本地文件到S3
   在main.tf中添加以下资源，把本地的datasource.yml上传到S3桶：

   # 创建S3桶，桶名必须唯一
   resource "aws_s3_bucket" "grafana_config" {
     bucket = "your-unique-grafana-config-bucket"
   }
   
   # 上传本地datasource.yml到S3
   resource "aws_s3_object" "datasource_config" {
     bucket = aws_s3_bucket.grafana_config.id
     key    = "datasource.yml"
     source = "./datasource.yml"
   }
   

2. 给ECS任务添加S3访问权限
   创建IAM权限策略并附加到任务执行角色，让任务能读取S3上的配置文件：

   # 创建S3访问策略
   resource "aws_iam_policy" "grafana_s3_access" {
     name        = "grafana-s3-config-access"
     description = "允许ECS任务读取S3中的Grafana配置文件"
   
     policy = jsonencode({
       Version = "2012-10-17"
       Statement = [
         {
           Action   = ["s3:GetObject"]
           Effect   = "Allow"
           Resource = aws_s3_object.datasource_config.arn
         }
       ]
     })
   }
   
   # 将策略附加到ECS任务执行角色（替换成你的任务执行角色名）
   resource "aws_iam_role_policy_attachment" "grafana_s3_attach" {
     role       = aws_iam_role.ecs_task_execution_role.name
     policy_arn = aws_iam_policy.grafana_s3_access.arn
   }
   

3. 修改ECS任务定义，添加启动命令下载文件
   更新容器定义，在启动时从S3下载配置文件到Grafana的数据源目录：

   resource "aws_ecs_task_definition" "grafana" {
     family                   = "grafana"
     cpu                      = "256"
     memory                   = "512"
     network_mode             = "awsvpc"
     requires_compatibilities = ["FARGATE"]
     execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn # 指定任务执行角色
     container_definitions = jsonencode([
       {
         name  = "grafana"
         # 注意：官方Grafana镜像没有预装AWS CLI，需替换为带AWS CLI的自定义镜像，或用curl下载（不推荐生产环境）
         image = "your-custom-grafana-with-awscli-image:latest"
         portMappings = [
           {
             containerPort = 3000,
             hostPort      = 3000,
             protocol      = "tcp"
           }
         ]
         # 启动命令：先下载配置文件，再启动Grafana
         entryPoint = ["sh", "-c"]
         command = [
           "aws s3 cp s3://${aws_s3_bucket.grafana_config.id}/datasource.yml /etc/grafana/provisioning/datasources/datasource.yml && /run.sh"
         ]
       }
     ])
   }
   

方案二：通过EFS挂载卷（适合多文件或持久化配置场景） #

1. 创建EFS文件系统和挂载目标

   # 创建EFS文件系统
   resource "aws_efs_file_system" "grafana_config" {
     creation_token = "grafana-config"
   }
   
   # 在每个子网创建挂载目标（替换为你的子网ID和安全组ID）
   resource "aws_efs_mount_target" "grafana_mount" {
     count             = length(var.subnet_ids)
     file_system_id    = aws_efs_file_system.grafana_config.id
     subnet_id         = var.subnet_ids[count.index]
     security_groups   = [var.efs_security_group_id] # 安全组需开放NFS（2049端口）访问
   }
   

2. 上传本地datasource.yml到EFS
   可以通过临时EC2实例挂载EFS后上传文件，或用Terraform的local-exec执行脚本上传。

3. 修改ECS任务定义，配置卷挂载

   resource "aws_ecs_task_definition" "grafana" {
     family                   = "grafana"
     cpu                      = "256"
     memory                   = "512"
     network_mode             = "awsvpc"
     requires_compatibilities = ["FARGATE"]
     # 配置EFS卷
     volume {
       name = "grafana-config-volume"
       efs_volume_configuration {
         file_system_id     = aws_efs_file_system.grafana_config.id
         root_directory     = "/datasources" # EFS上存放配置文件的目录
         transit_encryption = "ENABLED"
       }
     }
     container_definitions = jsonencode([
       {
         name  = "grafana"
         image = "grafana/grafana:latest"
         portMappings = [
           {
             containerPort = 3000,
             hostPort      = 3000,
             protocol      = "tcp"
           }
         ]
         # 将EFS卷挂载到Grafana数据源目录
         mountPoints = [
           {
             sourceVolume  = "grafana-config-volume"
             containerPath = "/etc/grafana/provisioning/datasources"
             readOnly      = true
           }
         ]
       }
     ])
   }
   

内容的提问来源于stack exchange，提问作者flowermia