create_task_exec_iam_role = true
      create_task_exec_policy   = true

output "arn" {
  value = module.ecs.task_exec_iam_role_arn
}

output "name" {
  value = module.ecs.task_exec_iam_role_name
}

│ Error: Invalid for_each argument
│ 
│   on .terraform/modules/ecs/modules/service/main.tf line 781, in resource "aws_iam_role_policy_attachment" "task_exec_additional":
│  781:   for_each = { for k, v in var.task_exec_iam_role_policies : k => v if local.create_task_exec_iam_role }
│     ├────────────────
│     │ local.create_task_exec_iam_role is true
│     │ var.task_exec_iam_role_policies is a map of string, known only after apply
│ 
│ The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this
│ resource.
│ 
│ When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values.
│ 
│ Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.
╵

      task_exec_iam_role_policies = {
        "policy1" = aws_iam_policy.secret_manager_get_secret_policy.arn
        "policy1" = aws_iam_policy.allow_ssm_exec_policy.arn
      }

# ./cluster/main.tf

variable "name" {
  type = string
}

variable "instance_type" {
  type = string
}

variable "subnets" {
  type = list(string)
}

variable "security_group" {
  type = string
}

locals {
  # This is the convention we use to know what belongs to each other
  ec2_resources_name = "${var.name}-prod"

  image_data = jsondecode(data.aws_ssm_parameter.aws_ecs_recommended_image.value)
  image_id   = local.image_data["image_id"]
}

data "aws_ssm_parameter" "aws_ecs_recommended_image" {
  name = "/aws/service/ecs/optimized-ami/amazon-linux-2/arm64/recommended"
}

module "asg" {
  source = "terraform-aws-modules/autoscaling/aws"

  name = "${var.name}-asg"

  min_size                  = 2
  max_size                  = 5
  desired_capacity          = 2
  health_check_type         = "EC2"
  health_check_grace_period = 180 # 3 minutes

  vpc_zone_identifier = var.subnets
  security_groups     = [
    var.security_group
  ]

  create_iam_instance_profile = true
  iam_role_name               = "${var.name}-asg-instance-role"
  iam_role_path               = "/ec2/"
  iam_role_description        = "IAM role for ${var.name}-asg"
  iam_role_policies           = {
    AmazonSSMManagedInstanceCore        = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    AmazonEC2ContainerServiceforEC2Role = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
  }

  image_id      = local.image_id
  instance_type = var.instance_type

  user_data     = base64encode(templatefile("${path.module}/templates/user-data.sh", { cluster_name = var.name }))

  key_name = "xxxxxxxx"

  tags = {
    Cluster = "${var.name}-cluster"
    product = var.name
  }
}

module "ecs" {
  source = "terraform-aws-modules/ecs/aws"
  version = "~> 4.1.3"

  cluster_name = var.name

  autoscaling_capacity_providers = {
    one = {
      name                   = "${var.name}-provider"
      auto_scaling_group_arn = module.asg.autoscaling_group_arn
      weight                 = "1"
      managed_scaling        = {
        status = "ENABLED"
      }
      default_capacity_provider_strategy = {
        name   = "${var.name}-provider-strategy"
        weight = "1"
      }
    }
  }

  tags = {
    Cluster = "${var.name}-cluster"
    product = var.name
  }
}

  required_providers {
    aws = "~> 4.67"
  }

Terraform will perform the following actions:

  # aws_ecs_cluster.main will be created
  + resource "aws_ecs_cluster" "main" {
      + arn                = (known after apply)
      + capacity_providers = [
          + "arn:aws:autoscaling:eu-west-3:947226147474:autoScalingGroup:3daf2d5c-a6bc-4c44-8615-c87cf562863f:autoScalingGroupName/ECS-tr-express-20220209120348551000000002",
        ]
      + id                 = (known after apply)
      + name               = "ECS-tr-express-project-tr-express-dev"
      + tags               = {
          + "Application" = "tr-express"
          + "Deployer"    = "terraform"
          + "Environment" = "dev"
          + "Name"        = "ecs-cluster-tr-express-project-tr-express-dev"
          + "Project"     = "tr-express-project"
        }
      + tags_all           = {
          + "Application" = "tr-express"
          + "Deployer"    = "terraform"
          + "Environment" = "dev"
          + "Name"        = "ecs-cluster-tr-express-project-tr-express-dev"
          + "Project"     = "tr-express-project"
        }

      + default_capacity_provider_strategy {
          + base              = (known after apply)
          + capacity_provider = (known after apply)
          + weight            = (known after apply)
        }

      + setting {
          + name  = (known after apply)
          + value = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + arn  = (known after apply)
  + name = "ECS-tr-express-project-tr-express-dev"

│ Error: failed creating ECS Cluster (ECS-tr-express-project-tr-express-dev): InvalidParameterException: The specified capacity provider was not found. Specify a valid capacity provider and try again.
│ 
│   with aws_ecs_cluster.main,
│   on main.tf line 1, in resource "aws_ecs_cluster" "main":
│    1: resource "aws_ecs_cluster" "main" {

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.ecs.module.ecs.aws_ecs_cluster.this[0] will be updated in-place
  ~ resource "aws_ecs_cluster" "this" {
        id                 = "arn:aws:ecs:us-east-1:XXXXXXXXXXXXXXX:cluster/dev"
        name               = "dev"
        tags               = {
            "Environment" = "dev"
        }
        # (3 unchanged attributes hidden)

      + configuration {
        }

        # (1 unchanged block hidden)
    }

  # module.ecs.module.ecs.aws_ecs_cluster_capacity_providers.this[0] will be updated in-place
  ~ resource "aws_ecs_cluster_capacity_providers" "this" {
      ~ capacity_providers = [
          - "FARGATE_SPOT",
            # (1 unchanged element hidden)
        ]
        id                 = "dev"
        # (1 unchanged attribute hidden)

      + default_capacity_provider_strategy {
          + base              = 0
          + capacity_provider = "FARGATE"
          + weight            = 100
        }
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.ecs.module.ecs.aws_ecs_cluster.this[0]: Modifying... [id=arn:aws:ecs:us-east-1:XXXXXXXXXXXXXXX:cluster:cluster/dev]
╷
│ Error: Request cancelled
│ 
│   with module.ecs.module.ecs.aws_ecs_cluster.this[0],
│   on .terraform/modules/ecs.ecs/main.tf line 5, in resource "aws_ecs_cluster" "this":
│    5: resource "aws_ecs_cluster" "this" {
│ 
│ The plugin.(*GRPCProvider).ApplyResourceChange request was cancelled.
╵
Releasing state lock. This may take a few moments...

Stack trace from the terraform-provider-aws_v4.17.1_x5 plugin:

panic: interface conversion: interface {} is nil, not map[string]interface {}

goroutine 40 [running]:
github.com/hashicorp/terraform-provider-aws/internal/service/ecs.expandClusterConfiguration({0xc0021d02e0, 0x94ce2e8, 0x2})
	github.com/hashicorp/terraform-provider-aws/internal/service/ecs/cluster.go:557 +0x113
github.com/hashicorp/terraform-provider-aws/internal/service/ecs.resourceClusterUpdate(0xc002ccb500, {0x8027680, 0xc00037f500})
	github.com/hashicorp/terraform-provider-aws/internal/service/ecs/cluster.go:332 +0x2a5
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).update(0xa5a7760, {0xa5a7760, 0xc002cfbb60}, 0xd, {0x8027680, 0xc00037f500})
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/resource.go:729 +0x178
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc000d01880, {0xa5a7760, 0xc002cfbb60}, 0xc001692750, 0xc002ccb380, {0x8027680, 0xc00037f500})
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/resource.go:847 +0x9e5
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc000296930, {0xa5a76b8, 0xc002c97100}, 0xc002c94d20)
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/grpc_provider.go:1021 +0xe3c
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ApplyResourceChange(0xc001ae3860, {0xa5a7760, 0xc002cfb380}, 0xc0001b65b0)
	github.com/hashicorp/[email protected]/tfprotov5/tf5server/server.go:812 +0x56b
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler({0x92321e0, 0xc001ae3860}, {0xa5a7760, 0xc002cfb380}, 0xc002c8d860, 0x0)
	github.com/hashicorp/[email protected]/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:385 +0x170
google.golang.org/grpc.(*Server).processUnaryRPC(0xc00013e700, {0xa6b4510, 0xc000cac1a0}, 0xc002186c60, 0xc001aef830, 0x1030dda0, 0x0)
	google.golang.org/[email protected]/server.go:1282 +0xccf
google.golang.org/grpc.(*Server).handleStream(0xc00013e700, {0xa6b4510, 0xc000cac1a0}, 0xc002186c60, 0x0)
	google.golang.org/[email protected]/server.go:1619 +0xa2a
google.golang.org/grpc.(*Server).serveStreams.func1.2()
	google.golang.org/[email protected]/server.go:921 +0x98
created by google.golang.org/grpc.(*Server).serveStreams.func1
	google.golang.org/[email protected]/server.go:919 +0x294

Error: The terraform-provider-aws_v4.17.1_x5 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "5.0.1"
  cluster_name = "myecscluster"
  

   fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
    FARGATE_SPOT = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
  }

  services = {
  container_definitions = {
    myfront_end = {
      cpu       = 256
      memory    = 512
      essential = true
      image     = "650623132949.dkr.ecr.ap-south-1.amazonaws.com/myapp:latest"
      execution_role_arn       = "module.ecs_task_execution_role.arn"
      subnet_ids    = var.subnet_ids[0]
      port_mappings = [
        {
          name          = "myapp"
          containerPort = 8080
          hostPort      = 8080
          protocol      = "tcp"
        }
      ]
      # Example image used requires access to write to root filesystem
      readonly_root_filesystem = false
      memory_reservation = 100
    }
  }
    service_connect_configuration = {
    namespace = "myapp"
    service = {
      client_alias = {
        port     = 8080
        dns_name = "testcase.lmapps.io"
      }
    }
  }
   load_balancer = {
    service = {
      target_group_arn = element(module.alb.target_group_arns, 0)
      container_name   = "myapp"
      container_port   = "8080"
      
    }
  }
  
  }
}

  task_exec_iam_statements = {
    sns = {
      sid       = "SNS"
      effect    = "Allow"
      actions   = ["sns:Publish"]
      resources = ["arn:aws:sns:eu-central-1:XXXXXXXXXXXX:*"] 
    }
  }

module "ecs" {
  source = "terraform-aws-modules/ecs/aws"
  version = "5.2.1"

  task_exec_iam_statements = {
    sns = {
      sid       = "SNS"
      effect    = "Allow"
      actions   = ["sns:Publish"]
      resources = ["arn:aws:sns:eu-central-1:XXXXXXXXXXXX:*"] 
    }
  }

  ...

  services = {
    service_name => {
      ...

      container_definitions = {
        taks_name = {
          ...
        }
      }
    }
  }
}

User: arn:aws:sts::XXXXXXXXXXXX:assumed-role/service_name-20230802080059751700000006/624dd649a11d44c09f90367ea64a7afa is not authorized to perform: SNS:Publish on resource: arn:aws:sns:eu-central-1:XXXXXXXXXXXX:some-sns-name because no identity-based policy allows the SNS:Publish action

module "ecs_cluster" {
  source = "../../modules/cluster"

  cluster_name = local.name

  # Capacity provider
  fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = 50
        base   = 20
      }
    }
    FARGATE_SPOT = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
  }

  tags = local.tags
}

################################################################################
# Service
################################################################################

module "ecs_service" {
  source = "../../modules/service"

  name        = local.name
  cluster_arn = module.ecs_cluster.arn

  cpu    = 256
  memory = 512

  # Container definition(s)
  container_definitions = {

    fluent-bit = {
      cpu       = 256
      memory    = 512
      essential = true
      image     = 650623132949.dkr.ecr.ap-south-1.amazonaws.com/myapp      
      memory_reservation = 50
      user               = "0"
    }

    (local.container_name) = {
      cpu       = 256
      memory    = 512
      essential = true
      image     = "650623132949.dkr.ecr.ap-south-1.amazonaws.com/myapp"
      port_mappings = [
        {
          name          = local.container_name
          containerPort = local.container_port
          hostPort      = local.container_port
          protocol      = "tcp"
        }
      ]

      # Example image used requires access to write to root filesystem
      readonly_root_filesystem = false
      enable_cloudwatch_logging = false  
      memory_reservation = 100
    }
  }

  service_connect_configuration = {
    namespace = aws_service_discovery_http_namespace.this.arn
    service = {
      client_alias = {
        port     = local.container_port
        dns_name = local.container_name
      }
      port_name      = local.container_name
      discovery_name = local.container_name
    }
  }

  load_balancer = {
    service = {
      target_group_arn = element(module.alb.target_group_arns, 0)
      container_name   = local.container_name
      container_port   = local.container_port
    }
  }

  subnet_ids = var.subnets
  security_group_rules = {
    alb_ingress_3000 = {
      type                     = "ingress"
      from_port                = local.container_port
      to_port                  = local.container_port
      protocol                 = "tcp"
      description              = "Service port"
      source_security_group_id = module.albapp_sg.security_group_id
    }
    egress_all = {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }

  tags = local.tags
}

aws_iam_policy.task_exec[0]: Modifying... [id=arn:aws:iam::0000000000:policy/staging-ecs-execution-role]
╷
│ Error: updating IAM Policy (arn:aws:iam::0000000000:policy/staging-ecs-execution-role): LimitExceeded: Cannot exceed quota for PolicySize: 6144
│ 	status code: 409, request id: 52ab06e4-c96a-4ea8-a617-14f65667f9c1
│ 
│   with aws_iam_policy.task_exec[0],
│   on main.tf line 875, in resource "aws_iam_policy" "task_exec":
│  875: resource "aws_iam_policy" "task_exec" {

module "ecs" {
  source = "terraform-aws-modules/ecs/aws"

  name = "my-ecs"

  container_insights = true

  capacity_providers = ["FARGATE", "FARGATE_SPOT"]

  default_capacity_provider_strategy = [
    {
      capacity_provider = "FARGATE_SPOT"
    }
  ]

  tags = {
    Environment = "Development"
  }
}

Terraform v1.0.9
on linux_amd64
Configuring remote state backend...
Initializing Terraform configuration...
╷
│ Error: Invalid index
│ 
│   on .terraform/modules/ecs/main.tf line 13, in resource "aws_ecs_cluster" "this":
│   13:       capacity_provider = strategy.value["capacity_provider"]
│     ├────────────────
│     │ strategy.value is map of string with 1 element
│ 
│ The given key does not identify an element in this collection value.

step_adjustment {
  scaling_adjustment = -1
  metric_interval_upper_bound = 0
}

resource "aws_ecs_cluster" "test" {
  name = "example"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.example.arn
      logging    = "OVERRIDE"

      log_configuration {
        cloud_watch_encryption_enabled = true
        cloud_watch_log_group_name     = aws_cloudwatch_log_group.example.name
      }
    }
  }
}

Error: Missing required argument

  on main.tf line 56, in data "aws_ami" "amazon_linux_ecs":
  56: data "aws_ami" "amazon_linux_ecs" {

The argument "owners" is required, but no definition was found.


Error: Unsupported block type

  on main.tf line 110, in data "template_file" "user_data":
 110:   vars {

Blocks of type "vars" are not expected here. Did you mean to define argument
"vars"? If so, use the equals sign to assign it a value.

  port_mappings = [
    {
      name          = local.container_name
      containerPort = 53
      hostPort      = 53
      protocol      = "tcp"
    },
    {
      name          = "${local.container_name}-53-udp"
      containerPort = 53
      hostPort      = 53
      protocol      = "udp"
    }
  ]

  port_mappings = [
    {
      name          = local.container_name
      containerPort = 53
      hostPort      = 53
      protocol      = "tcp"
    },
    {
      name          = "${local.container_name}-53-udp"
      containerPort = 53
      hostPort      = 53
      protocol      = "udp"
    }
  ]

locals {
  crewfare_frontend_task_definition_name = format("%s-%s", var.application_environment, var.crewfare_frontend_container_name)
  next_js_frontend_task_definition_name  = format("%s-%s", var.application_environment, var.next_js_frontend_container_name)
  backstage_nginx_task_definition_name   = format("%s-%s", var.application_environment, var.backstage_nginx_container_name)
}

module "ecs_service" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "5.2.0"

  create = true

  cluster_name     = "${var.application_environment}-${var.application_name}"
  cluster_settings = { "name" : "containerInsights", "value" : "enabled" }

  create_task_exec_iam_role = true
  task_exec_iam_role_name   = "${var.application_environment}-${var.application_name}-task-execution"
  create_task_exec_policy   = true

  default_capacity_provider_use_fargate = true
  fargate_capacity_providers = {
    FARGATE      = {}
    FARGATE_SPOT = {}
  }

  create_cloudwatch_log_group            = true
  cloudwatch_log_group_retention_in_days = 90

  services = {
    (local.backstage_nginx_task_definition_name) = {
      cpu    = 512
      memory = 1024

      container_definitions = {
        (var.backstage_nginx_container_name) = {
          cpu       = 512
          memory    = 1024
          essential = true
          image     = var.backstage_nginx_image
          port_mappings = [
            {
              name          = var.backstage_nginx_container_name
              containerPort = var.backstage_nginx_container_port
              hostPort      = var.backstage_nginx_container_port
              protocol      = "tcp"
            }
          ]
          readonly_root_filesystem  = false
          enable_cloudwatch_logging = true
        }
      }

      load_balancer = {
        service = {
          target_group_arn = data.terraform_remote_state.ecs-elb.outputs.backstage_nginx_target_group_arn
          container_name   = var.backstage_nginx_container_name
          container_port   = var.backstage_nginx_container_port
        }
      }

      subnet_ids = data.terraform_remote_state.vpc.outputs.private_subnets
      security_group_rules = {
        alb_ingress = {
          type                     = "ingress"
          from_port                = var.backstage_nginx_container_port
          to_port                  = var.backstage_nginx_container_port
          protocol                 = "tcp"
          description              = "${var.backstage_nginx_container_name} port"
          source_security_group_id = data.terraform_remote_state.ecs-elb.outputs.lb_security_group_id
        }
        egress_all = {
          type        = "egress"
          from_port   = 0
          to_port     = 0
          protocol    = "-1"
          cidr_blocks = ["0.0.0.0/0"]
        }
      }

      force_new_deployment      = true
      wait_for_steady_state     = true
      wait_until_stable         = true
      wait_until_stable_timeout = "10m"
    }
  }
}

Error: Invalid value for input variable

  on .terraform/modules/ecs_service/main.tf line 155, in module "service":
 155:   wait_until_stable_timeout = try(each.value.wait_until_stable_timeout, null)

The given value is not suitable for
module.ecs_service.module.service["develop-ecs-backstage-nginx"].var.wait_until_stable_timeout
declared at
.terraform/modules/ecs_service/modules/service/variables.tf:546,1-37: a
number is required.

  # module.ecs.aws_ecs_cluster.this[0] will be updated in-place
  ~ resource "aws_ecs_cluster" "this" {
        id                 = "arn:aws:ecs:eu-west-1:1234567890:cluster/test-ecs"
        name               = "test-ecs"
        tags               = {}
        # (3 unchanged attributes hidden)


      + setting {
          + name  = "containerInsights"
          + value = "disabled"
        }
        # (1 unchanged block hidden)
    }

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "~> 3.3"

  name               = "test-ecs"
  capacity_providers = ["FARGATE_SPOT"]

  default_capacity_provider_strategy = [
    {
      capacity_provider = "FARGATE_SPOT"
      weight            = "1"
    }
  ]
}

      + setting {
          + name  = "containerInsights"
          + value = "enabled"
        }

          mountPoints = [
            {
              readOnly = null,
              containerPath = "/var/run/docker.sock",
              sourceVolume = "docker_sock"
            }
          ]

      volume = [{

        name      = "docker_sock"
        host = {
          sourcePath = "/var/run/docker.sock"
        }
      }]

cluster_configuration = {
    execute_command_configuration = {
      logging = "NONE" # NONE DEFAULT, OVERRIDE 
    }
  }

╷
│ Error: Variables not allowed
│ 
│   on <value for var.environment> line 1:
│   (source code not available)
│ 
│ Variables may not be used here.

Terraform v1.5.0
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.13.1

provider "aws" {
  region = "us-west-2"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.0"

  name = local.name

  cidr = "10.1.0.0/16"

  azs             = ["us-west-2a", "us-west-2b"]
  private_subnets = ["10.1.1.0/24", "10.1.2.0/24"]
  public_subnets  = ["10.1.11.0/24", "10.1.12.0/24"]

  enable_nat_gateway = false # this is faster, but should be "true" for real

  tags = {
    Environment = local.environment
    Name        = local.name
  }
}

  # Auto scaling group
  asg_name                  = local.ec2_resources_name
  vpc_zone_identifier       = module.vpc.private_subnets
  health_check_type         = "EC2"
  min_size                  = 1
  max_size                  = 3
  desired_capacity          = 1
  wait_for_capacity_timeout = 0

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "5.0.1"
  cluster_name = "myecscluster"
   fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
    FARGATE_SPOT = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
  }
   container_definitions = {
    myfront_end = {
      cpu       = 256
      memory    = 512
      essential = true
      image     = "650623132949.dkr.ecr.ap-south-1.amazonaws.com/myapp:latest"
      port_mappings = [
        {
          name          = "myapp"
          containerPort = 8080
          hostPort      = 8080
          protocol      = "tcp"
        }
      ]
      # Example image used requires access to write to root filesystem
      readonly_root_filesystem = false
      memory_reservation = 100
    }
  }
    service_connect_configuration = {
    namespace = "myapp"
    service = {
      client_alias = {
        port     = 8080
        dns_name = "testcase.lmapps.io"
      }
    }
  }
}

module "alb" {
  source  = "terraform-aws-modules/alb/aws"
  version = "8.0"
  name = "my-alb"
  load_balancer_type = "application"
  vpc_id             = "vpc-075fcd4310a0f65c0"
  subnets            = ["subnet-0f06b2cbbb7b9b4bf", "subnet-070fdb57f5e2fef8b"]
  security_groups    = [module.sgroupalb.security_group_id]
  target_groups = [
    {
      name_prefix      = "pref-"
      backend_protocol = "HTTP"
      backend_port     = 80
      target_type      = "ip"
      targets = {
        my_target = {
          target_id = "???????????"
          port = 80
        }       
      }
    }
  ]
  https_listeners = [
    {
      port               = 443
      protocol           = "HTTPS"
      certificate_arn    = "arn:aws:iam::123456789012:server-certificate/test_cert-123456789012"
      target_group_index = 0
    }
  ]
  http_tcp_listeners = [
    {
      port               = 80
      protocol           = "HTTP"
      target_group_index = 0
    }
  ]
  tags = {
    Environment = "Test"
  }
}

1.0.11

aws = {
    source  = "hashicorp/aws"
    version = "~> 4.0"
}

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "~> 4.0.2"

  cluster_name = local.cluster_name

  fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = var.fargate_weight
      }
    }
    FARGATE_SPOT = {
      default_capacity_provider_strategy = {
        weight = var.fargate_spot_weight
      }
    }
  }

  autoscaling_capacity_providers = {
    linux = {
      auto_scaling_group_arn         = module.asg_linux.autoscaling_group_arn
      managed_termination_protection = "DISABLED"

      managed_scaling = {
        maximum_scaling_step_size = 5
        minimum_scaling_step_size = 1
        status                    = "ENABLED"
        target_capacity           = 90
      }

      default_capacity_provider_strategy = {
        weight = 60
        base   = 20
      }
    }
    windows = {
      auto_scaling_group_arn         = module.asg_windows.autoscaling_group_arn
      managed_termination_protection = "DISABLED"

      managed_scaling = {
        maximum_scaling_step_size = 2
        minimum_scaling_step_size = 1
        status                    = "ENABLED"
        target_capacity           = 90
      }

      default_capacity_provider_strategy = {
        weight = 40
      }
    }
  }

}

Error: Invalid for_each argument
on .terraform/modules/ecs/modules/service/main.tf line 525, in module "container_definition":
  for_each = { for k, v in var.container_definitions : k => v if local.create_task_definition }
local.create_task_definition is true
var.container_definitions will be known only after apply
The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.

When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values.

Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.

module "ecs_cluster" {
  source  = "terraform-aws-modules/ecs/aws//modules/cluster"
  # modules/cluster
  version = "5.2.0"

  cluster_name = local.base_name

  create_cloudwatch_log_group = false

  default_capacity_provider_use_fargate = false
  autoscaling_capacity_providers = {
    default = {
      auto_scaling_group_arn         = module.asg.autoscaling_group_arn
      managed_termination_protection = "DISABLED"

      # ecs manages scaling
      managed_scaling = {
        maximum_scaling_step_size = 5
        minimum_scaling_step_size = 1
        status                    = "ENABLED"
        target_capacity           = 50
      }

    }
  }

  tags = local.tags
}

module "asg" {
  source  = "terraform-aws-modules/autoscaling/aws"
  version = "6.10.0"

  # Autoscaling group
  name = local.base_name
  use_name_prefix = true
  ignore_desired_capacity_changes = false

  min_size                  = 0
  max_size                  = 1
  desired_capacity          = 1
  wait_for_capacity_timeout = 0
  health_check_type         = "EC2"
  vpc_zone_identifier       = data.aws_subnets.private.ids

  initial_lifecycle_hooks = [
    {
      name                  = "ExampleStartupLifeCycleHook"
      default_result        = "CONTINUE"
      heartbeat_timeout     = 60
      lifecycle_transition  = "autoscaling:EC2_INSTANCE_LAUNCHING"
      notification_metadata = jsonencode({ "hello" = "world" })
    },
    {
      name                  = "ExampleTerminationLifeCycleHook"
      default_result        = "CONTINUE"
      heartbeat_timeout     = 180
      lifecycle_transition  = "autoscaling:EC2_INSTANCE_TERMINATING"
      notification_metadata = jsonencode({ "goodbye" = "world" })
    }
  ]

  instance_refresh = {
    strategy = "Rolling"
    preferences = {
      #checkpoint_delay       = 600
      #checkpoint_percentages = [35, 70, 100]
      #instance_warmup        = 300 # replace with lifecycle hook
      min_healthy_percentage = 90 # check
    }
    triggers = ["tag"] # check
  }

  # Launch template
  launch_template_name        = "ecs-${local.base_name}"
  launch_template_use_name_prefix = true
  launch_template_description = "ECS launch template"
  update_default_version      = true

  image_id          = local.ami_id
  instance_type     = var.instance_type
  ebs_optimized     = true # check
  enable_monitoring = true

  # IAM role & instance profile
  create_iam_instance_profile = true
  iam_role_name               = "ecs-${local.base_name}"
  iam_role_path               = "/ec2/"
  iam_role_description        = "ECS role for cluster: ${var.product} ${var.env}"
  iam_role_tags = {Name = "ecs-${local.base_name}"}
  iam_role_policies = {
    AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  }

  block_device_mappings = [
    {
      # Root volume
      device_name = "/dev/xvda"
      no_device   = 0
      ebs = {
        delete_on_termination = true # check if we can reuse instead?
        encrypted             = true
        volume_size           = 50 # check
        volume_type           = "gp2" # check
      }
    }
  ]

  capacity_reservation_specification = {
    capacity_reservation_preference = "open"
  }

  instance_market_options = {
    market_type = "spot"
    spot_options = {
      instance_interruption_behavior = "terminate" # check
      #max_price                      = "one-time" # check
      spot_instance_type = "one-time"
      #spot_instance_type             = ??? # check - i think this should be disabled as it would then default to th eon-demand price
      #valid_until                    = ??? # check - not sure at the mo
    }
  }

  metadata_options = {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 32
  }

  network_interfaces = [
    {
      delete_on_termination = true
      description           = "eth0"
      device_index          = 0
      security_groups       = [module.ecs_sg.security_group_id] # TODO: add default
    }
  ]

  placement = {
    availability_zone = var.region
  }

  tags = local.tags
}

module "ecs_sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "5.1.0"

  name        = local.base_name
  description = "Security group for ECS cluster: ${var.product} ${var.env}"
  vpc_id      = var.vpc_id

  # ingress_cidr_blocks      = ["10.10.0.0/16"]
  # ingress_rules            = ["https-443-tcp"]
  ingress_with_cidr_blocks = [
    {
      from_port   = 8000
      to_port     = 8000
      protocol    = "tcp"
      description = "fill me in"
      cidr_blocks = "0.0.0.0/0" # this seems too open
    }
    ### snipped for conciseness
  ]

}

data "aws_vpc" "this" {
  id = var.vpc_id
}

data "aws_security_group" "this" {
  name   = "default"
  vpc_id = data.aws_vpc.this.id
}

data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [var.vpc_id]
  }

  tags = {
    Name = "REDACTED*"
  }
}

data "aws_ami" "ecs_optimised" {
    most_recent = true

    filter {
        name   = "name"
        # TODO: see if we need gp2 or gp3 disks? Also check if we need ebs-optimised. how important is HDD?
        values = ["amzn2-ami-ecs-hvm-2.0.202*x86_64-ebs*"]
        # aws ssm get-parameters --names /aws/service/ecs/optimized-ami/amazon-linux-2/recommended --region us-east-1
        # amzn2-ami-ecs-hvm-*-x86_64-ebs
    }

    filter {
        name   = "virtualization-type"
        values = ["hvm"]
    }

    owners = ["amazon"]
}

locals {
  ami_id = data.aws_ami.ecs_optimised.id

  tags = {
    environment = var.env
    product     = var.product
    owner       = "REDACTED"
    created_by  = "terraform"
    ami_id = local.ami_id
  }

  base_name = "ecs-${var.product}-${var.env}-rr"

  # TODO: Move this into separate script file if larger
  user_data = <<-EOT
    #!/bin/bash
    echo "Hello Terraform!"
  EOT
}

variable "vpc_id" {
  description = "AWS VPC ID. e.g. vpc-xxxxx"
  type        = string
}

variable "region" {
  description = "AWS region. e.g. eu-west-1"
  type        = string
}

variable "env" {
  description = "Deployment environment. e.g. dev, uat, prod"
  type        = string
}

variable "product" {
  description = "Product name. e.g. vfdb"
  type        = string
}

variable "instance_type" {
  description = "EC2 Instance type for ECS cluster. e.g. t3a.medium"
  type        = string
}

rm -rf .terraform .terraform.lock.hcl \
&& terraform_v1.5.1 init \
&& terraform_v1.5.1 apply -var-file=../../envs/dev/dev.tfvars -auto-approve`