AWS Fargate for Amazon ECS のアップデート

#!/usr/bin/env python3

from flask import Flask, render_template
from flask_nav import Nav
from flask_nav.elements import Navbar, View, Subgroup, Text
from flask_bootstrap import Bootstrap
from os import getenv, environ
from requests import get
import json

app = Flask(__name__)
Bootstrap(app)
nav = Nav(app)

nav.register_element('frontend', Navbar(
    'ECS Demo',
    View('Home', '.index'),
    View('Environment Variables', '.env_vars'),
    View('Secrets', '.secrets'),
    View('Metadata', '.metadata'),
    Text(getenv('DEPLOY_ENVIRONMENT', 'DEPLOY_ENV UNAVAILABLE')),
))

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/env-vars')
def env_vars():
    environment_variables = {x: y for x,y in environ.items() if "DEPLOY_ENVIRONMENT" in x}
    return render_template('env-vars.html', ev_dict=environment_variables)

@app.route('/secrets')
def secrets():
    secret_kvs = {x: y for x,y in environ.items() if "SECRETS_MANAGER" in x}
    return render_template('secrets.html', secret_dict=secret_kvs)
  
@app.route('/metadata')
def metadata():
    metadata_endpoint = getenv('ECS_CONTAINER_METADATA_URI_V4')
    json_response = json.loads(get("{}/task".format(metadata_endpoint)).text)
    launch_type, container_arn, log_driver = json_response['LaunchType'], json_response['Containers'][0]['ContainerARN'], json_response['Containers'][0]['LogDriver']
    metrics = json.loads(get("{}/stats".format(metadata_endpoint)).text)
  
    return render_template(
        'metadata.html', launch_type=launch_type, container_arn=container_arn, 
        log_driver=log_driver, rx=metrics['network_rate_stats']['rx_bytes_per_sec'], 
        tx=metrics['network_rate_stats']['tx_bytes_per_sec']
    )

if __name__ == '__main__':
    app().run(host='0.0.0.0')

#!/usr/bin/env python3

from aws_cdk import core, aws_ecs, aws_ecs_patterns, aws_ecr_assets, aws_s3, aws_secretsmanager


class FargateDemo(core.Stack):

    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        s3_bucket = aws_s3.Bucket.from_bucket_name(self, "EnvConfigBucket", bucket_name="ecs-demo-env-files")
        sm_secret = aws_secretsmanager.Secret.from_secret_name_v2(self, "SecretJson", secret_name="ecs-demo")
        
        container_image = aws_ecr_assets.DockerImageAsset(self, "Image", directory=".", exclude=["cdk.out"])
        
        task_def = aws_ecs_patterns.ApplicationLoadBalancedTaskImageOptions(
            image=aws_ecs.ContainerImage.from_docker_image_asset(asset=container_image),
            container_port=5000,
            environment={
                "TASK_DEF_SHARED_DEPLOY_ENVIRONMENT": "SAME_VALUE_SHARED_BETWEEN_ENVS",
            },
            secrets={
                "SECRETS_MANAGER_SECRET_ALL_PREVIOUS_VERSION": aws_ecs.Secret.from_secrets_manager(secret=sm_secret),
                "SECRETS_MANAGER_SECRET_ALL_CURRENT_VERSION": aws_ecs.Secret.from_secrets_manager(secret=sm_secret),
                "SECRETS_MANAGER_SECRET_JSON_KEY": aws_ecs.Secret.from_secrets_manager(secret=sm_secret, field="SECRET_KEY_2"),
            },
        )
        
        for deploy_env in ["test", "production"]:

            fargate_ecs_service = aws_ecs_patterns.ApplicationLoadBalancedFargateService(
                self, "FargateService{}".format(deploy_env),
                cpu=256,
                memory_limit_mib=512,
                platform_version=aws_ecs.FargatePlatformVersion.VERSION1_4,
                task_image_options=task_def
            )
            
            fargate_ecs_service.target_group.set_attribute(
                key='deregistration_delay.timeout_seconds',
                value='5'
            )
            
            cfn_task_definition = fargate_ecs_service.task_definition.node.default_child
            cfn_task_definition.add_override(
                "Properties.ContainerDefinitions.0.EnvironmentFiles", 
                [
                    {
                        "Type": "s3",
                        "Value": "{}/{}.env".format(s3_bucket.bucket_arn, deploy_env)
                    }
                ]
            )
            
            cfn_task_definition.add_override(
                "Properties.ContainerDefinitions.0.Secrets.0.ValueFrom",
                "{}::AWSPREVIOUS:".format(sm_secret.secret_arn)
            )

            
            _lb_url = "http://{}".format(fargate_ecs_service.load_balancer.load_balancer_dns_name)
            core.CfnOutput(
                self, "Output{}".format(deploy_env), 
                value=_lb_url,
                export_name="EnvAppUrl{}".format(deploy_env)
            )
            
            s3_bucket.grant_read(fargate_ecs_service.task_definition.execution_role)


app = core.App()
FargateDemo(app, "fargate-features-demo")
app.synth()

# Create S3 Bucket
aws s3 mb s3://ecs-demo-env-files

# Create two environment files: production.env & test.env
echo -e "DEPLOY_ENVIRONMENT=TEST\nDEPLOY_ENVIRONMENT_FILE_NAME=test.env" > test.env
echo -e "DEPLOY_ENVIRONMENT=PRODUCTION\nDEPLOY_ENVIRONMENT_FILE_NAME=production.env" > production.env

# Copy files to Amazon S3 Bucket
aws s3 cp --recursive --exclude "*" --include "*.env" ./ s3://ecs-demo-env-files/

# Create secret with JSON object
aws secretsmanager create-secret \
  --name ecs-demo \
  --secret-string '{ "SECRET_KEY_1": "SECRET_VALUE_1", "SECRET_KEY_2": "SECRET_VALUE_2" }'

# Update the secret by adding a new SECRET_KEY_3 key to the JSON
aws secretsmanager update-secret \
  --secret-id ecs-demo \
  --secret-string '{ "SECRET_KEY_1": "SECRET_VALUE_1", "SECRET_KEY_2": "SECRET_VALUE_2", "SECRET_KEY_3": "SECRET_VALUE_3" }'

# Deploy our demo environment and applications
cdk deploy --app "python3 cdk_app.py"

# Store the application URLs in as environment variables for reference throughout the demo
prod_url=$(aws cloudformation describe-stacks --stack-name fargate-features-demo --query 'Stacks[].Outputs[?ExportName == `EnvAppUrlproduction`].OutputValue' --output text)
test_url=$(aws cloudformation describe-stacks --stack-name fargate-features-demo --query 'Stacks[].Outputs[?ExportName == `EnvAppUrltest`].OutputValue' --output text)

# test.env file contents
DEPLOY_ENVIRONMENT=TEST
DEPLOY_ENVIRONMENT_FILE_NAME=test.env

# production.env file contents
DEPLOY_ENVIRONMENT=PRODUCTION
DEPLOY_ENVIRONMENT_FILE_NAME=production.env