id: greentic.deployer.aws-ecs.wizard
title: AWS-ECS deployer
version: "0.1.0"
description: >-
Records the AWS account scope the AWS-ECS deployer env-pack will
operate against. Phase C: answers are captured on the binding
(`answers_ref`) but NOT yet honored by `credentials validate` — the
C3 probe uses the ambient AWS chain. Phase D wires these answers into
the SDK client builder so probes scope to the captured identity.
Credential MATERIAL is never collected here.
presentation:
intro: >-
Bind an AWS-ECS environment. Phase-C disclosure: today's `gtc op
credentials requirements` probes the AMBIENT AWS chain
(`AWS_PROFILE`, `~/.aws/credentials`, IRSA, IMDS, …) — the answers
below are recorded on the binding but DO NOT scope today's
validation. Make sure the host's ambient AWS identity points at the
same account/region you fill in here, or validation will pass/fail
for the wrong principal. Phase D removes this gap by feeding the
answers into the SDK client builder.
questions:
- id: region
type: string
title: AWS region
description: >-
AWS region the ECS cluster lives in (e.g. `us-east-1`,
`eu-west-1`). Used as the `region` field on the resolved AWS SDK
config when the deployer's typed clients are built.
required: true
constraint:
pattern: '^[a-z]{2}-[a-z]+-[0-9]$'
- id: aws_profile
type: string
title: AWS profile (optional)
description: >-
Named profile from `~/.aws/credentials` / `~/.aws/config`. Leave
blank to let the SDK walk the default credential chain
(env vars → shared config → IMDS → IRSA).
required: false
- id: assume_role_arn
type: string
title: Assume-role ARN (optional)
description: >-
IAM role ARN to assume after the base credential chain resolves
(typical for cross-account ECS deploys). Leave blank to use the
base credentials directly.
required: false
constraint:
pattern: '^arn:aws:iam::[0-9]{12}:role/.+$'
- id: ecs_cluster_name
type: string
title: ECS cluster name
description: >-
Name of the ECS cluster the deployer manages services in.
Must already exist; this wizard does not provision it. The Phase-D
D-AWS-1 train will optionally render Terraform to provision it.
required: true
constraint:
min_len: 1
max_len: 255
pattern: '^[a-zA-Z0-9_-]+$'
- id: ecr_repository_prefix
type: string
title: ECR repository prefix
description: >-
Prefix appended to every revision's container image (e.g.
`<account>.dkr.ecr.<region>.amazonaws.com/greentic/`). The
deployer's `ecr:PutImage` IAM probe is scoped to this prefix.
required: true
constraint:
min_len: 1
pattern: '^[a-zA-Z0-9._/-]+$'
- id: alb_listener_arn
type: string
title: ALB listener ARN (optional)
description: >-
Listener ARN for the ALB the deployer will write weighted target-
group rules to (mirrors `TrafficSplit`). Leave blank when the
runtime dispatcher is authoritative for traffic splitting and no
ALB mirror is configured.
required: false
constraint:
pattern: '^arn:aws:elasticloadbalancing:[a-z0-9-]+:[0-9]{12}:listener/.+$'
- id: container_image_tag_prefix
type: string
title: Container image tag prefix
description: >-
Prefix every revision's image tag is built from (e.g. `rev-`).
Combined with the revision ULID at deploy time. Leave blank to
tag with the raw revision ULID.
required: false
default_value: "rev-"
constraint:
pattern: '^[a-zA-Z0-9_.-]*$'
- id: execution_role_arn
type: string
title: Task execution role ARN
description: >-
IAM role the ECS agent assumes to pull the image and write logs
(the Fargate task execution role). Required to deploy a worker;
the rules pack the bootstrap renders creates a suitable role.
required: true
constraint:
pattern: '^arn:aws:iam::[0-9]{12}:role/.+$'
- id: task_role_arn
type: string
title: Task role ARN (optional)
description: >-
IAM role the worker's containers assume for app-level AWS access.
Leave blank when the worker needs no AWS API access of its own.
required: false
constraint:
pattern: '^arn:aws:iam::[0-9]{12}:role/.+$'
- id: subnets
type: string
title: Fargate subnets
description: >-
Comma-separated awsvpc subnet IDs the task ENIs attach to (e.g.
`subnet-aaaa,subnet-bbbb`). At least one; private subnets need a
NAT, or set "Assign public IP", to reach ECR.
required: true
constraint:
pattern: '^subnet-[a-z0-9]+(\s*,\s*subnet-[a-z0-9]+)*$'
- id: security_groups
type: string
title: Task security groups
description: >-
Comma-separated security-group IDs applied to the task ENIs (e.g.
`sg-aaaa,sg-bbbb`). At least one.
required: true
constraint:
pattern: '^sg-[a-z0-9]+(\s*,\s*sg-[a-z0-9]+)*$'
- id: assign_public_ip
type: enum
title: Assign public IP
description: >-
Give Fargate tasks a public IP. Required for tasks in public
subnets with no NAT gateway so they can pull the image from ECR.
required: false
default_value: "false"
choices: ["false", "true"]
- id: cpu
type: string
title: Task CPU units
description: >-
Fargate task-level CPU units (`256` = 0.25 vCPU, `512`, `1024`,
…). Must form a valid Fargate CPU/memory combination.
required: false
default_value: "256"
constraint:
pattern: '^[0-9]+$'
- id: memory
type: string
title: Task memory (MiB)
description: >-
Fargate task-level memory in MiB (`512`, `1024`, …). Must pair
with the CPU units per the Fargate combination table.
required: false
default_value: "512"
constraint:
pattern: '^[0-9]+$'
- id: container_name
type: string
title: Container name
description: >-
Logical container name in the task definition; also the
`containerName` the load balancer routes to.
required: false
default_value: "worker"
constraint:
pattern: '^[a-zA-Z0-9_-]{1,255}$'
- id: container_port
type: string
title: Container port
description: >-
Port the worker container listens on and the target group
forwards to.
required: false
default_value: "8080"
constraint:
pattern: '^[0-9]{1,5}$'
- id: target_group_arns
type: string
title: Target-group pool
description: >-
Comma-separated pool of pre-provisioned ALB target groups (ARNs,
or names up to 32 chars) the deployer assigns revisions to for
blue/green traffic shifting. Provide at least two for a blue/green
rollout; the deployer binds each live revision to a free pool
member. Leave blank when no ALB mirror is configured.
required: false
constraint:
min_len: 1