Skip to content

fix: remove portmapping and fix container order #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 19, 2025
Merged

fix: remove portmapping and fix container order #354

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0942c63
fix: remove portmapping and fix container order
lewinkedrs Aug 16, 2025
8450c77
fix: remove context
lewinkedrs Aug 16, 2025
b90cbe9
Merge branch 'aws-samples:feat/cdkpipeline' into feat/cdkpipeline
lewinkedrs Aug 18, 2025
489767d
fix: OpenSearch config and perms
lewinkedrs Aug 18, 2025
4c7ca60
Merge branch 'feat/cdkpipeline' of https://github.com/lewinkedrs/one-…
lewinkedrs Aug 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 0 additions & 19 deletions src/cdk/cdk.context.json
View file
Open in desktop

This file was deleted.

45 changes: 13 additions & 32 deletions src/cdk/lib/constructs/ecs-service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ import {
} from 'aws-cdk-lib/aws-ecs-patterns';
import { Construct } from 'constructs';
import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
import { RemovalPolicy, Stack } from 'aws-cdk-lib';
import { RemovalPolicy, Stack, Fn } from 'aws-cdk-lib';
import { NagSuppressions } from 'cdk-nag';
import { Port, Peer, SubnetType } from 'aws-cdk-lib/aws-ec2';
import { IPrivateDnsNamespace } from 'aws-cdk-lib/aws-servicediscovery';
Expand All @@ -45,8 +45,6 @@ export interface EcsServiceProperties extends MicroserviceProperties {
};
}

export const OPENSEARCH_PORT = 24_224;

export abstract class EcsService extends Microservice {
public readonly taskDefinition: TaskDefinition;
public readonly loadBalancedService?: ApplicationLoadBalancedServiceBase;
Expand Down Expand Up @@ -139,11 +137,6 @@ export abstract class EcsService extends Microservice {
}),
);

// Add FireLens log router container if OpenSearch collection is provided
if (properties.openSearchCollection) {
this.addFireLensLogRouter(taskDefinition, properties);
}

const image = ContainerImage.fromRegistry(properties.repositoryURI);

const container = taskDefinition.addContainer('container', {
Expand All @@ -162,6 +155,11 @@ export abstract class EcsService extends Microservice {
protocol: Protocol.TCP,
});

// Add FireLens log router container if OpenSearch collection is provided
if (properties.openSearchCollection) {
this.addFireLensLogRouter(taskDefinition, properties);
}

if (!properties.disableService) {
if (properties.createLoadBalancer === false) {
// Create service without load balancer
Expand Down Expand Up @@ -256,13 +254,6 @@ export abstract class EcsService extends Microservice {
Port.tcp(properties.containerPort || 80),
'Allow load balancer to reach ECS tasks',
);
if (properties.openSearchCollection) {
properties.securityGroup.addIngressRule(
loadBalancedService.loadBalancer.connections.securityGroups[0],
Port.tcp(OPENSEARCH_PORT),
'Allow load balancer to reach OpenSearch for health check',
);
}
}

// Allow traffic from specified subnet type to load balancer
Expand Down Expand Up @@ -333,16 +324,19 @@ export abstract class EcsService extends Microservice {
const openSearchEndpoint =
'collection' in collection ? collection.collection.attrCollectionEndpoint : collection.collectionEndpoint;

// Use CloudFormation functions to strip https:// prefix at deployment time
const openSearchHostWithoutProtocol = Fn.select(1, Fn.split('https://', openSearchEndpoint));

return new FireLensLogDriver({
options: {
Name: 'es',
Host: openSearchEndpoint.replace('https://', ''),
Name: 'opensearch',
Host: openSearchHostWithoutProtocol,
Port: '443',
aws_auth: 'On',
AWS_Region: Stack.of(this).region,
AWS_Service_Name: 'aoss',
Index: `${properties.name}-logs`,
tls: 'Off',
tls: 'On',
Suppress_Type_Name: 'On',
Trace_Error: 'On',
Trace_Output: 'On',
Expand Down Expand Up @@ -373,12 +367,6 @@ export abstract class EcsService extends Microservice {
},
});

// Add port mappings for the log router (required by ECS)
logRouter.addPortMappings({
containerPort: OPENSEARCH_PORT,
protocol: Protocol.TCP,
});

// Add task role permissions for OpenSearch access
if (properties.openSearchCollection) {
const collection = properties.openSearchCollection;
Expand All @@ -387,14 +375,7 @@ export abstract class EcsService extends Microservice {
taskDefinition.taskRole.addToPrincipalPolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: [
'aoss:WriteDocument',
'aoss:CreateIndex',
'aoss:DescribeIndex',
'aoss:UpdateIndex',
'es:ESHttpPost',
'es:ESHttpPut',
],
actions: ['aoss:*', 'es:ESHttpPost', 'es:ESHttpPut'],
resources: [collectionArn],
}),
);
Expand Down