Error when trying to use network_configuration for FARGATE tasks

[fsanzdev]

Hi,

I'm having some issues when trying to use network_configuration for FARGATE tasks. This is the code I have:

  desired_number_of_tasks = "1"
  launch_type             = "FARGATE"
  network_mode            = "awsvpc"
  task_cpu                = 512
  task_memory             = 1024
  network_configuration   = {
    subnets                       = dependency.vpc.outputs.private_app_subnet_ids
    vpc_id                        = dependency.vpc.outputs.vpc_id
    security_group_rules          = {
      sg-service-name-port = {
        type                     = "ingress"
        from_port                = local.container_port
        to_port                  = local.container_port
        protocol                 = "tcp"
        # source_security_group_id = "sg-${local.service_name}"
        cidr_blocks              = [dependency.vpc.outputs.vpc_cidr_block]
      }
    }
    additional_security_group_ids = []
    assign_public_ip              = false

But it looks like both, source_security_group_id and cidr_blocks attributes are required by the module, when according to the SG rule documentation you can't have both, having an Error: Conflicting configuration arguments message when applying the plan.

Could you please confirm if I'm doing something wrong?

[denis256]

Hello,
if I matched correctly definition, in module is created aws_security_group_rule with source_security_group_id / cidr_blocks :

https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/master/modules/services/ecs-service/main.tf#L126

Definition of aws_security_group_rule specify:

• cidr_blocks - (Optional) List of CIDR blocks. Cannot be specified with source_security_group_id

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule

[fsanzdev]

Thanks for the reply @denis256, but it looks like in GW code there is no conditional and according to the TF documentation you refer:

source_security_group_id - (Optional) Security group id to allow access to/from, depending on the type. Cannot be specified with cidr_blocks, ipv6_cidr_blocks, or self.

So it looks like both (cidr_blocks and source_security_group_id) can't be used at the same time, it looks like it has to be one or the other

[fsanzdev]

It was not quite clear looking at the code or the documentation, but all made sense after looking at this example https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/master/examples/for-learning-and-testing/services/ecs-service/main.tf

One of those fields has to be set to null (not just remove it)