Merge pull request #366 from ministryofjustice/nd-624

enable ecs sessions manager for dns-dhcp
ministryofjustice · Dec 3, 2024 · 534a56a · 534a56a
2 parents 0968459 + 62b14ef
commit 534a56a
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 7 deletions.
diff --git a/modules/dns/ecs.tf b/modules/dns/ecs.tf
@@ -10,12 +10,13 @@ resource "aws_ecs_cluster" "server_cluster" {
 }
 
 resource "aws_ecs_service" "service" {
-  name            = "${var.prefix}-service"
-  cluster         = aws_ecs_cluster.server_cluster.id
-  task_definition = aws_ecs_task_definition.server_task.arn
-  desired_count   = 5
-  launch_type     = "FARGATE"
-  tags            = var.tags
+  name                   = "${var.prefix}-service"
+  cluster                = aws_ecs_cluster.server_cluster.id
+  task_definition        = aws_ecs_task_definition.server_task.arn
+  desired_count          = 5
+  launch_type            = "FARGATE"
+  tags                   = var.tags
+  enable_execute_command = true
 
   lifecycle {
     ignore_changes = [desired_count]

diff --git a/modules/dns_dhcp_common/iam.tf b/modules/dns_dhcp_common/iam.tf
@@ -77,7 +77,16 @@ resource "aws_iam_role_policy" "ecs_task_policy" {
         "cloudwatch:PutMetricData"
       ],
       "Resource": ["*"]
-    }
+    },{
+      "Effect": "Allow",
+      "Action": [
+      "ssmmessages:CreateControlChannel",
+      "ssmmessages:CreateDataChannel",
+      "ssmmessages:OpenControlChannel",
+      "ssmmessages:OpenDataChannel"
+      ],
+      "Resource": ["*"]
+  }
   ]
 }
 EOF