Set file systems to be read only, rely on mounted volume for any writ…

…e needs
UKHSA-Internal · Dec 16, 2024 · 478cee6 · 478cee6
1 parent 8fd17b8
commit 478cee6
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/terraform/20-app/ecs.service.cms-admin.tf b/terraform/20-app/ecs.service.cms-admin.tf
@@ -35,7 +35,7 @@ module "ecs_service_cms_admin" {
       cpu                                    = local.use_prod_sizing ? 2048 : 512
       memory                                 = local.use_prod_sizing ? 4096 : 1024
       essential                              = true
-      readonly_root_filesystem               = false
+      readonly_root_filesystem               = true
       image                                  = module.ecr_back_end_ecs.image_uri
       mount_points                           = [
         {

diff --git a/terraform/20-app/ecs.service.feedback-api.tf b/terraform/20-app/ecs.service.feedback-api.tf
@@ -35,7 +35,7 @@ module "ecs_service_feedback_api" {
       cpu                                    = local.use_prod_sizing ? 1024 : 512
       memory                                 = local.use_prod_sizing ? 2048 : 1024
       essential                              = true
-      readonly_root_filesystem               = false
+      readonly_root_filesystem               = true
       image                                  = module.ecr_back_end_ecs.image_uri
       mount_points                           = [
         {

diff --git a/terraform/20-app/ecs.service.private-api.tf b/terraform/20-app/ecs.service.private-api.tf
@@ -37,7 +37,7 @@ module "ecs_service_private_api" {
       cpu                                    = local.use_prod_sizing ? 2048 : 512
       memory                                 = local.use_prod_sizing ? 4096 : 1024
       essential                              = true
-      readonly_root_filesystem               = false
+      readonly_root_filesystem               = true
       image                                  = module.ecr_back_end_ecs.image_uri
       mount_points                           = [
         {