493 lines
15 KiB
YAML
493 lines
15 KiB
YAML
---
|
|
- name: Configure and Deploy ECS Application (Enterprise Security)
|
|
hosts: inventory_hosts
|
|
# DO NOT use blanket root access
|
|
become: no
|
|
gather_facts: yes
|
|
vars:
|
|
ecs_cluster_name: "nvhi-atsila-cluster"
|
|
service_name: "nvhi-atsila-cluster-service"
|
|
task_family: "nvhi-atsila-cluster-task"
|
|
container_name: "nvhi-atsila-microservice"
|
|
app_version: "{{ app_version | default('latest') }}"
|
|
aws_region: "{{ aws_region | default('us-east-2') }}"
|
|
log_group: "/ecs/{{ ecs_cluster_name }}"
|
|
# Security: Use dedicated service account
|
|
ecs_user: "ecs-user"
|
|
ecs_group: "ecs-group"
|
|
|
|
pre_tasks:
|
|
- name: Validate required variables
|
|
assert:
|
|
that:
|
|
- ecs_cluster_name is defined
|
|
- aws_region is defined
|
|
- aws_account_id is defined
|
|
- task_execution_role_arn is defined
|
|
fail_msg: "Required variables missing. Check app_version, aws_account_id, task_execution_role_arn"
|
|
tags: [validation]
|
|
|
|
- name: Test connectivity
|
|
ping:
|
|
tags: [validation]
|
|
|
|
# Security: Create dedicated service account
|
|
- name: Create ECS service group
|
|
group:
|
|
name: "{{ ecs_group }}"
|
|
state: present
|
|
become: yes
|
|
become_user: root
|
|
tags: [security, users]
|
|
|
|
- name: Create ECS service user
|
|
user:
|
|
name: "{{ ecs_user }}"
|
|
group: "{{ ecs_group }}"
|
|
system: yes
|
|
shell: /bin/bash
|
|
home: /home/{{ ecs_user }}
|
|
create_home: yes
|
|
state: present
|
|
become: yes
|
|
become_user: root
|
|
tags: [security, users]
|
|
|
|
- name: Add ECS user to docker group
|
|
user:
|
|
name: "{{ ecs_user }}"
|
|
groups: docker
|
|
append: yes
|
|
become: yes
|
|
become_user: root
|
|
tags: [security, users]
|
|
|
|
tasks:
|
|
# Infrastructure Setup - Only escalate when necessary
|
|
- name: Update system packages
|
|
yum:
|
|
name: '*'
|
|
state: latest
|
|
update_cache: yes
|
|
become: yes
|
|
become_user: root
|
|
async: 300
|
|
poll: 0
|
|
register: yum_update
|
|
tags: [infrastructure]
|
|
|
|
- name: Wait for package update to complete
|
|
async_status:
|
|
jid: "{{ yum_update.ansible_job_id }}"
|
|
register: update_result
|
|
until: update_result.finished
|
|
retries: 30
|
|
delay: 10
|
|
tags: [infrastructure]
|
|
|
|
- name: Install required packages
|
|
yum:
|
|
name:
|
|
- docker
|
|
- ecs-init
|
|
- curl
|
|
- wget
|
|
- jq
|
|
state: present
|
|
become: yes
|
|
become_user: root
|
|
retries: 3
|
|
delay: 5
|
|
tags: [infrastructure]
|
|
|
|
# Security: Configure Docker securely
|
|
- name: Create Docker configuration directory
|
|
file:
|
|
path: /etc/docker
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
become: yes
|
|
become_user: root
|
|
tags: [infrastructure, security]
|
|
|
|
- name: Configure Docker daemon securely
|
|
copy:
|
|
dest: /etc/docker/daemon.json
|
|
content: |
|
|
{
|
|
"log-driver": "json-file",
|
|
"log-opts": {
|
|
"max-size": "100m",
|
|
"max-file": "3"
|
|
},
|
|
"live-restore": true,
|
|
"userland-proxy": false,
|
|
"no-new-privileges": true
|
|
}
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
become: yes
|
|
become_user: root
|
|
notify: restart docker
|
|
tags: [infrastructure, security]
|
|
|
|
- name: Start and enable Docker
|
|
systemd:
|
|
name: docker
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
become: yes
|
|
become_user: root
|
|
register: docker_service
|
|
tags: [infrastructure]
|
|
|
|
- name: Verify Docker is running
|
|
command: docker info
|
|
register: docker_check
|
|
failed_when: docker_check.rc != 0
|
|
retries: 3
|
|
delay: 5
|
|
changed_when: false
|
|
# Security: Run as regular user (ECS user is in docker group)
|
|
become: yes
|
|
become_user: "{{ ecs_user }}"
|
|
tags: [infrastructure, validation]
|
|
|
|
# Security: Create ECS directory with proper permissions
|
|
- name: Create ECS config directory
|
|
file:
|
|
path: /etc/ecs
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: "{{ ecs_group }}"
|
|
become: yes
|
|
become_user: root
|
|
tags: [infrastructure, security]
|
|
|
|
- name: Configure ECS agent
|
|
copy:
|
|
dest: /etc/ecs/ecs.config
|
|
content: |
|
|
ECS_CLUSTER={{ ecs_cluster_name }}
|
|
ECS_AVAILABLE_LOGGING_DRIVERS=["json-file","awslogs"]
|
|
ECS_ENABLE_TASK_IAM_ROLE=true
|
|
ECS_ENABLE_CONTAINER_METADATA=true
|
|
ECS_CONTAINER_STOP_TIMEOUT=30s
|
|
# Security: Disable privileged containers by default
|
|
ECS_DISABLE_PRIVILEGED=true
|
|
# Security: Enable AppArmor/SELinux support
|
|
ECS_SELINUX_CAPABLE=true
|
|
ECS_APPARMOR_CAPABLE=true
|
|
mode: '0640' # Security: More restrictive permissions
|
|
owner: root
|
|
group: "{{ ecs_group }}" # Security: Group ownership for ECS
|
|
backup: yes
|
|
become: yes
|
|
become_user: root
|
|
notify: restart ecs
|
|
tags: [infrastructure, security]
|
|
|
|
# Security: Configure ECS agent service with proper user
|
|
- name: Create ECS service override directory
|
|
file:
|
|
path: /etc/systemd/system/ecs.service.d
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
become: yes
|
|
become_user: root
|
|
tags: [infrastructure, security]
|
|
|
|
- name: Configure ECS service security settings
|
|
copy:
|
|
dest: /etc/systemd/system/ecs.service.d/security.conf
|
|
content: |
|
|
[Service]
|
|
# Security: Additional hardening
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
# Allow access to ECS directories
|
|
ReadWritePaths=/var/lib/ecs /var/log/ecs /etc/ecs
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
become: yes
|
|
become_user: root
|
|
notify:
|
|
- reload systemd
|
|
- restart ecs
|
|
tags: [infrastructure, security]
|
|
|
|
- name: Start and enable ECS agent
|
|
systemd:
|
|
name: ecs
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
become: yes
|
|
become_user: root
|
|
tags: [infrastructure]
|
|
|
|
- name: Wait for ECS agent to register
|
|
shell: |
|
|
count=0
|
|
while [ $count -lt 30 ]; do
|
|
instances=$(aws ecs list-container-instances --cluster {{ ecs_cluster_name }} --region {{ aws_region }} --query 'length(containerInstanceArns)' --output text 2>/dev/null || echo "0")
|
|
if [ "$instances" != "0" ] && [ "$instances" != "None" ]; then
|
|
echo "ECS agent registered successfully"
|
|
exit 0
|
|
fi
|
|
echo "Waiting for ECS agent registration (attempt $((count+1))/30)..."
|
|
sleep 10
|
|
count=$((count+1))
|
|
done
|
|
echo "ECS agent failed to register"
|
|
exit 1
|
|
environment:
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: Run AWS CLI as regular user with proper AWS credentials
|
|
become: no
|
|
tags: [infrastructure]
|
|
|
|
# Application Deployment - No root required
|
|
- name: Create CloudWatch log group
|
|
shell: |
|
|
aws logs create-log-group --log-group-name "{{ log_group }}" --region {{ aws_region }} 2>/dev/null || echo "Log group exists"
|
|
aws logs put-retention-policy --log-group-name "{{ log_group }}" --retention-in-days 7 --region {{ aws_region }} 2>/dev/null || echo "Retention policy exists"
|
|
environment:
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: No root required for AWS API calls
|
|
become: no
|
|
tags: [deployment]
|
|
|
|
# Security: Create temp file in user's home directory
|
|
- name: Create task definition file
|
|
copy:
|
|
dest: "/tmp/task-definition-{{ ansible_date_time.epoch }}.json"
|
|
content: |
|
|
{
|
|
"family": "{{ task_family }}",
|
|
"executionRoleArn": "{{ task_execution_role_arn }}",
|
|
"networkMode": "bridge",
|
|
"requiresCompatibilities": ["EC2"],
|
|
"cpu": "256",
|
|
"memory": "512",
|
|
"containerDefinitions": [
|
|
{
|
|
"name": "{{ container_name }}",
|
|
"image": "{{ aws_account_id }}.dkr.ecr.{{ aws_region }}.amazonaws.com/{{ container_name }}:{{ app_version }}",
|
|
"cpu": 256,
|
|
"memory": 512,
|
|
"essential": true,
|
|
"user": "1000:1000",
|
|
"readonlyRootFilesystem": true,
|
|
"portMappings": [
|
|
{
|
|
"containerPort": 8080,
|
|
"hostPort": 8080,
|
|
"protocol": "tcp"
|
|
}
|
|
],
|
|
"logConfiguration": {
|
|
"logDriver": "awslogs",
|
|
"options": {
|
|
"awslogs-group": "{{ log_group }}",
|
|
"awslogs-region": "{{ aws_region }}",
|
|
"awslogs-stream-prefix": "ecs"
|
|
}
|
|
},
|
|
"healthCheck": {
|
|
"command": [
|
|
"CMD-SHELL",
|
|
"curl -f http://localhost:8080/health || exit 1"
|
|
],
|
|
"interval": 30,
|
|
"timeout": 5,
|
|
"retries": 3,
|
|
"startPeriod": 60
|
|
},
|
|
"tmpfs": [
|
|
{
|
|
"containerPath": "/tmp",
|
|
"size": 100
|
|
}
|
|
],
|
|
"mountPoints": [],
|
|
"volumesFrom": []
|
|
}
|
|
]
|
|
}
|
|
mode: '0644'
|
|
# Security: File owned by current user, not root
|
|
owner: "{{ ansible_user | default(ansible_ssh_user) }}"
|
|
group: "{{ ansible_user | default(ansible_ssh_user) }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: No root required
|
|
become: no
|
|
register: task_def_file
|
|
tags: [deployment, security]
|
|
|
|
- name: Register task definition
|
|
shell: |
|
|
aws ecs register-task-definition \
|
|
--cli-input-json file://{{ task_def_file.dest }} \
|
|
--region {{ aws_region }} \
|
|
--output json
|
|
environment:
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: No root required for AWS API calls
|
|
become: no
|
|
register: task_registration
|
|
tags: [deployment]
|
|
|
|
- name: Update ECS service
|
|
shell: |
|
|
aws ecs update-service \
|
|
--cluster {{ ecs_cluster_name }} \
|
|
--service {{ service_name }} \
|
|
--task-definition {{ task_family }} \
|
|
--desired-count 1 \
|
|
--force-new-deployment \
|
|
--region {{ aws_region }} \
|
|
--output json
|
|
environment:
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: No root required
|
|
become: no
|
|
register: service_update
|
|
tags: [deployment]
|
|
|
|
- name: Wait for service deployment to complete
|
|
shell: |
|
|
echo "Waiting for service to stabilize..."
|
|
count=0
|
|
while [ $count -lt 30 ]; do
|
|
service_status=$(aws ecs describe-services \
|
|
--cluster {{ ecs_cluster_name }} \
|
|
--services {{ service_name }} \
|
|
--region {{ aws_region }} \
|
|
--query 'services[0]' \
|
|
--output json 2>/dev/null)
|
|
|
|
if [ $? -eq 0 ]; then
|
|
running=$(echo "$service_status" | jq -r '.runningCount // 0')
|
|
pending=$(echo "$service_status" | jq -r '.pendingCount // 0')
|
|
|
|
echo "Running: $running, Pending: $pending"
|
|
|
|
if [ "$running" -ge "1" ] && [ "$pending" -eq "0" ]; then
|
|
echo "Service deployment completed successfully"
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
echo "Waiting for deployment completion (attempt $((count+1))/30)..."
|
|
sleep 20
|
|
count=$((count+1))
|
|
done
|
|
|
|
echo "Service deployment did not complete within expected time"
|
|
exit 1
|
|
environment:
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
# Security: No root required
|
|
become: no
|
|
tags: [deployment]
|
|
|
|
# Health Verification - No root required
|
|
- name: Wait for application health check
|
|
uri:
|
|
url: "http://{{ ansible_default_ipv4.address }}:8080/health"
|
|
method: GET
|
|
timeout: 10
|
|
status_code: 200
|
|
register: health_check
|
|
until: health_check.status == 200
|
|
retries: 10
|
|
delay: 15
|
|
# Security: No root required for HTTP requests
|
|
become: no
|
|
tags: [verification]
|
|
|
|
- name: Display deployment summary
|
|
debug:
|
|
msg: |
|
|
========================================
|
|
🎉 SECURE DEPLOYMENT COMPLETED
|
|
========================================
|
|
Cluster: {{ ecs_cluster_name }}
|
|
Service: {{ service_name }}
|
|
Task Family: {{ task_family }}
|
|
Image Version: {{ app_version }}
|
|
Instance IP: {{ ansible_default_ipv4.address }}
|
|
Health Status: HEALTHY
|
|
Security: Non-root containers, least privilege
|
|
Application URL: http://{{ ansible_default_ipv4.address }}:8080
|
|
========================================
|
|
tags: [reporting]
|
|
|
|
handlers:
|
|
- name: reload systemd
|
|
systemd:
|
|
daemon_reload: yes
|
|
become: yes
|
|
become_user: root
|
|
|
|
- name: restart docker
|
|
systemd:
|
|
name: docker
|
|
state: restarted
|
|
become: yes
|
|
become_user: root
|
|
|
|
- name: restart ecs
|
|
systemd:
|
|
name: ecs
|
|
state: restarted
|
|
daemon_reload: true
|
|
become: yes
|
|
become_user: root
|
|
|
|
post_tasks:
|
|
- name: Cleanup temporary files
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- "/tmp/task-definition-{{ ansible_date_time.epoch }}.json"
|
|
delegate_to: localhost
|
|
# Security: No root required for cleanup
|
|
become: no
|
|
tags: [cleanup]
|
|
|
|
# Security: Audit log
|
|
- name: Log deployment action
|
|
lineinfile:
|
|
path: /var/log/ecs-deployments.log
|
|
line: "{{ ansible_date_time.iso8601 }} - Deployment v{{ app_version }} by {{ ansible_user | default('unknown') }} from {{ ansible_env.SSH_CLIENT.split()[0] | default('unknown') }}"
|
|
create: yes
|
|
mode: '0644'
|
|
owner: root
|
|
group: "{{ ecs_group }}"
|
|
become: yes
|
|
become_user: root
|
|
tags: [audit, security] |