ECSタスクを定期実行するEventBridge SchedulerをTerraformで実装してみる

cd tf-eventbridge-run-ecs-task-script
echo "ECR_IMAGE_URI=ECRのイメージURI:latest" > .env
# イメージをプッシュ
scripts/build-and-push-image.sh

# プロジェクトルートに移動
cd tf-eventbridge-run-ecs-task-script
echo "ECS_ROLE_ARN=arn:aws:iam::アカウントID:role/ecs-scheduler-example-ecs-task-role" >> .env
echo "ECS_EXECUTION_ROLE_ARN=arn:aws:iam::アカウントID:role/ecs-scheduler-example-ecs-task-execution-role" >> .env
echo "S3_BUCKET=結果格納先バケット名" >> .env
# タスク定義をプッシュ
scripts/push-task-definition.sh

data "aws_caller_identity" "current" {}

locals {
  aws_account_id        = data.aws_caller_identity.current.account_id
}

resource "aws_scheduler_schedule" "ecs_run_task_scheduler" {
  name       = "${local.project_name}-scheduler"
  group_name = "default"

  flexible_time_window {
    mode = "OFF"
  }

  # 毎月1日の4時に実行する
  schedule_expression          = "cron(0 4 1 * ? *)"
  schedule_expression_timezone = "Asia/Tokyo"

  target {
    arn      = aws_ecs_cluster.main.arn
    role_arn = aws_iam_role.ecs_task_scheduler.arn

    ecs_parameters {
      task_definition_arn = "arn:aws:ecs:ap-northeast-1:${local.aws_account_id}:task-definition/${local.project_name}"
      launch_type         = "FARGATE"
      platform_version    = "LATEST"
      network_configuration {
        subnets         = [aws_subnet.private.id]
        security_groups = [aws_security_group.ecs.id]
      }
    }

    input = jsonencode({
      containerOverrides = [
        {
          name = local.project_name
          environment = [
            {
              name  = "JOB_NAME"
              value = "bar"
            }
          ]
        }
      ]
    })
  }
}

data "aws_iam_policy_document" "ecs_task_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

# ECSタスク実行Role
resource "aws_iam_role" "ecs_task_execution" {
  name               = "${local.project_name}-ecs-task-execution-role"
  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
  role       = aws_iam_role.ecs_task_execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

# ECSタスクRole用ポリシー
data "aws_iam_policy_document" "ecs_task" {
  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:GetObject",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ecs_task" {
  name   = "${local.project_name}-ecs-task-policy"
  policy = data.aws_iam_policy_document.ecs_task.json
}

# ECSタスクRole
resource "aws_iam_role" "ecs_task" {
  name               = "${local.project_name}-ecs-task-role"
  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task" {
  role       = aws_iam_role.ecs_task.name
  policy_arn = aws_iam_policy.ecs_task.arn
}


data "aws_iam_policy_document" "ecs_run_task" {
  statement {
    effect = "Allow"

    actions = [
      "ecs:RunTask"
    ]
    resources = ["*"]
  }
  statement {
    actions = [
      "iam:PassRole"
    ]
    resources = ["*"]
    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "ecs_task_scheduler" {
  name   = "${local.project_name}-scheduler-policy"
  policy = data.aws_iam_policy_document.ecs_run_task.json
}

# EventBridge Scheduler Role
resource "aws_iam_role" "ecs_task_scheduler" {
  name = "${local.project_name}-scheduler-role"
  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Principal" : {
          "Service" : ["scheduler.amazonaws.com"]
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ecs_task_scheduler_policy_attachment" {
  role       = aws_iam_role.ecs_task_scheduler.name
  policy_arn = aws_iam_policy.ecs_task_scheduler.arn
}

resource "aws_ecs_cluster" "main" {
  name = "${local.project_name}-cluster"
}

task_definition_arn = "arn:aws:ecs:ap-northeast-1:${local.aws_account_id}:task-definition/${local.project_name}"

target {
  arn      = aws_ecs_cluster.main.arn
  role_arn = aws_iam_role.ecs_task_scheduler.arn

  ecs_parameters {
    task_definition_arn = "arn:aws:ecs:ap-northeast-1:${local.aws_account_id}:task-definition/${local.project_name}"
    launch_type         = "FARGATE"
    platform_version    = "LATEST"
    network_configuration {
      subnets         = [aws_subnet.private.id]
      security_groups = [aws_security_group.ecs.id]
    }
  }

  input = jsonencode({
    containerOverrides = [
      {
        name = local.project_name
        environment = [
          {
            name  = "JOB_NAME"
            value = "bar"
          }
        ]
      }
    ]
  })
}