initial commit

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: [programmingwithalex]
+patreon: programmingwithalex

.github/workflows/aws_ecs_deploy.yaml

@@ -0,0 +1,144 @@
+# ****************************************************************************************************** #
+# This workflow will build and push a new container image to Amazon ECR,
+# and then will deploy a new task definition to Amazon ECS, when a release is created.
+#
+# Uses whoan/docker-build-with-cache-action to cache the Docker image to
+# speed up build times. Does so by creating a second AWS ECR repo with
+# [-stage] at the end to pull cached images from.
+#
+# Must define the env vars at the top of the file with your specific ones.
+#
+# Must specify the following GitHub secrets:
+#   * AWS_ACCESS_KEY_ID
+#   * AWS_SECRET_ACCESS_KEY
+#
+# To use this workflow, you will need to complete the following set-up steps:
+#
+# 1. Create an ECR repository to store your images.
+#    For example: `aws ecr create-repository --repository-name my-ecr-repo --region us-east-2`.
+#    Replace the value of `ECR_REPOSITORY` in the workflow below with your repository's name.
+#    Replace the value of `aws-region` in the workflow below with your repository's region.
+#
+# 2. Create an ECS task definition, an ECS cluster, and an ECS service.
+#    For example, follow the Getting Started guide on the ECS console:
+#      https://us-east-2.console.aws.amazon.com/ecs/home?region=us-east-2#/firstRun
+#    Replace the values for `service` and `cluster` in the workflow below with your service and cluster names.
+#
+# 3. Store your ECS task definition as a JSON file in your repository.
+#    The format should follow the output of `aws ecs register-task-definition --generate-cli-skeleton`.
+#    Replace the value of `task-definition` in the workflow below with your JSON file's name.
+#    Replace the value of `container-name` in the workflow below with the name of the container
+#    in the `containerDefinitions` section of the task definition.
+#
+# 4. Store an IAM user access key in GitHub Actions secrets named `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
+#    See the documentation for each action used below for the recommended IAM policies for this IAM user,
+#    and best practices on handling the access key credentials.
+# ****************************************************************************************************** #
+
+on:
+  release:
+    types: [created]
+  workflow_dispatch:
+
+name: AWS ECS Deploy
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    env:
+      # shared between all services
+      AWS_ECR_REPOSITORY_NAME: service-connect-demo-ecr
+      AWS_ECR_CLUSTER_NAME: service-connect-demo-cluster
+      AWS_ECS_SERVICE_NAME_1: service-connect-demo-service-1
+      AWS_ECS_SERVICE_NAME_2: service-connect-demo-service-2
+      AWS_ECS_SERVICE_NAME_3: service-connect-demo-service-3
+      # shared between all services - not used in
+      AWS_ECS_TASK_DEFINITION_1: service-connect-demo-task-def-1
+      AWS_ECS_TASK_DEFINITION_2: service-connect-demo-task-def-2
+      AWS_ECS_TASK_DEFINITION_3: service-connect-demo-task-def-3
+      AWS_DEFAULT_REGION: us-east-1
+      AWS_LOG_GROUP: service-connect-demo-log-group
+      AWS_LOG_STREAM: service-connect-demo-log-stream
+      IMAGE_TAG: ${{ github.sha }}
+#       IMAGE_TAG: latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@main
+
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@main
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+    - name: Login to Amazon ECR
+      id: login-ecr
+      uses: aws-actions/amazon-ecr-login@main
+
+    - name: Build, tag, and push image to Amazon ECR
+      id: build-deploy-image
+      uses: whoan/docker-build-with-cache-action@master
+      with:
+        username: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+        password: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+        registry: ${{ steps.login-ecr.outputs.registry }}
+        image_name: ${{ env.AWS_ECR_REPOSITORY_NAME }}
+        image_tag: ${{ env.IMAGE_TAG }}
+        build_extra_args: >-
+            --build-arg AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }}
+            --build-arg AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            --build-arg AWS_DEFAULT_REGION=${{ env.AWS_DEFAULT_REGION }}
+            --build-arg AWS_LOG_GROUP=${{ env.AWS_LOG_GROUP }}
+            --build-arg AWS_LOG_STREAM=${{ env.AWS_LOG_STREAM }}
+        push_image_and_stages: true
+
+    - name: Fill in the new image ID in the Amazon ECS task definition 1
+      id: task-def
+      uses: aws-actions/amazon-ecs-render-task-definition@master
+      with:
+        task-definition: aws-task-definition-1.json
+        container-name: ${{ env.AWS_ECR_REPOSITORY_NAME }}
+        image: ${{ steps.login-ecr.outputs.registry }}/${{ env.AWS_ECR_REPOSITORY_NAME }}:${{ env.IMAGE_TAG }}
+
+    - name: Fill in the new image ID in the Amazon ECS task definition 2
+      id: task-def
+      uses: aws-actions/amazon-ecs-render-task-definition@master
+      with:
+        task-definition: aws-task-definition-2.json
+        container-name: ${{ env.AWS_ECR_REPOSITORY_NAME }}
+        image: ${{ steps.login-ecr.outputs.registry }}/${{ env.AWS_ECR_REPOSITORY_NAME }}:${{ env.IMAGE_TAG }}
+
+    - name: Fill in the new image ID in the Amazon ECS task definition 3
+      id: task-def
+      uses: aws-actions/amazon-ecs-render-task-definition@master
+      with:
+        task-definition: aws-task-definition-3.json
+        container-name: ${{ env.AWS_ECR_REPOSITORY_NAME }}
+        image: ${{ steps.login-ecr.outputs.registry }}/${{ env.AWS_ECR_REPOSITORY_NAME }}:${{ env.IMAGE_TAG }}
+
+    - name: Deploy Amazon ECS task definition to ECS service 1
+      uses: aws-actions/amazon-ecs-deploy-task-definition@master
+      with:
+        task-definition: ${{ steps.task-def.outputs.task-definition }}
+        service: ${{ env.AWS_ECS_SERVICE_NAME_1 }}
+        cluster: ${{ env.AWS_ECR_CLUSTER_NAME }}
+        wait-for-service-stability: true
+
+    - name: Deploy Amazon ECS task definition to ECS service 2
+      uses: aws-actions/amazon-ecs-deploy-task-definition@master
+      with:
+        task-definition: ${{ steps.task-def.outputs.task-definition }}
+        service: ${{ env.AWS_ECS_SERVICE_NAME_2 }}
+        cluster: ${{ env.AWS_ECR_CLUSTER_NAME }}
+        wait-for-service-stability: true
+
+    - name: Deploy Amazon ECS task definition to ECS service 3
+      uses: aws-actions/amazon-ecs-deploy-task-definition@master
+      with:
+        task-definition: ${{ steps.task-def.outputs.task-definition }}
+        service: ${{ env.AWS_ECS_SERVICE_NAME_3 }}
+        cluster: ${{ env.AWS_ECR_CLUSTER_NAME }}
+        wait-for-service-stability: true

Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.11-slim
+
+# Set the working directory in the container
+WORKDIR /app
+
+# Avoid cache purge by adding requirements first
+ADD ./pyproject.toml ./pyproject.toml
+
+RUN pip install uv wheel
+RUN uv pip install -r pyproject.toml --system
+
+# Add the rest of the files
+COPY . /app
+WORKDIR /app

LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2024, [GitHub@programmingwithalex](https://github.com/programmingwithalex)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -1,2 +1,145 @@
-# aws_ecs_service_connect
-enable Service Connect with AWS ECS to create a microservices architecture
+<a id="readme-top"></a>
+
+[![Contributors][contributors-shield]][contributors-url]
+[![Forks][forks-shield]][forks-url]
+[![Stargazers][stars-shield]][stars-url]
+[![Issues][issues-shield]][issues-url]
+[![BSD-3-Clause License][license-shield]][license-url]
+
+---
+
+<br />
+<div align="center">
+    <p>Copyright (c) 2024, <a href="https://github.com/programmingwithalex">GitHub@programmingwithalex</a></p>
+
+
+  <h3 align="center">AWS ECS Service Connect</h3>
+
+  <p align="center">
+    Enable Service Connect with AWS ECS to create a microservices architecture.
+    <br />
+    <a href="https://github.com/programmingwithalex/aws_ecs_service_connect">View Demo</a>
+    ·
+    <a href="https://github.com/programmingwithalex/aws_ecs_service_connect/issues/new?labels=bug&template=bug-report---.md">Report Bug</a>
+    ·
+    <a href="https://github.com/programmingwithalex/aws_ecs_service_connect/issues/new?labels=enhancement&template=feature-request---.md">Request Feature</a>
+  </p>
+</div>
+
+<details>
+  <summary>Table of Contents</summary>
+  <ol>
+    <li>
+      <a href="#series-outline">Series Outline</a>
+      <ul>
+        <li><a href="#aws-components">AWS Components</a></li>
+      </ul>
+    </li>
+    <li>
+      <a href="#getting-started">Getting Started</a>
+      <ul>
+        <li><a href="#prerequisites">Prerequisites</a></li>
+        <ul>
+            <li><a href="#software">Software</a></li>
+            <li><a href="#aws">AWS</a></li>
+            <li><a href="#cmd-line">CMD Line</a></li>
+          </ul>
+      </ul>
+    </li>
+    <li><a href="#aws-cdk-commands">AWS (CDK) Commands</a></li>
+    <li><a href="#refences">References</a></li>
+  </ol>
+</details>
+
+## Series Outline
+
+1. Create [ECS components](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) (Clusters, Task Definitions, & Services)
+
+2. Enable [Service Connect](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html) for ECS Services using AWS Cloud Map
+
+3. Push Flask web apps from [ECR Repos](https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html) as Docker Images to Each ECS Service to Test Connectivity
+
+4. Automate deployments with [AWS CDK](https://docs.aws.amazon.com/cdk/v2/guide/home.html)
+
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+### AWS Components
+
+- Virtual Private Cloud (VPC)
+- NAT Gateway & Internet Gateway (IGW)
+- Elastic Container Registry (ECR)
+- Elastic Container Service (ECS)
+- ECS Clusters
+- ECS Services
+- ECS Task Definitions
+- Cloud Map
+- Application Load Balancer (ALB)
+- AWS Cloud Development Kit (CDK)
+  - written in Python
+
+
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+## Getting Started
+
+### Prerequisites
+
+#### Software
+
+- Python: version requirement determined by [AWS CLI requirement](https://github.com/aws/aws-cli) and optionally [AWS CDK requirement](https://github.com/aws/aws-cdk)
+- [Docker Desktop](https://www.docker.com/products/docker-desktop/): account not required, just installation
+
+#### AWS
+
+- create [AWS IAM user account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) than can be configured with the AWS CLI
+
+#### CMD Line
+
+- follow setup guides for [`aws-cli`](https://github.com/aws/aws-cli?tab=readme-ov-file#getting-started) if not already configured
+
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+## AWS Cloud Development (CDK)
+
+### Installation (Windows)
+
+- [download](https://nodejs.org/en/download/prebuilt-installer) `node.js`, includes `npm` which is necessary to install the `aws-cli`
+- [install](https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html) `aws-cdk`
+
+```bash
+npm install -g aws-cdk
+```
+
+### Commands
+
+- `cdk bootstrap` - deploying the AWS CDK for the first time
+- `cdk synth` - constucts CloudFormation template and does some verification checks
+- `cdk deploy --all` - deploy all CDK components
+- `cdk destroy --all` - destroys all CDK components
+  - issue with calling because of Fargate Cluster dependency - `FargateCluster/FargateCluster (...) Resource handler returned message: "The specified capacity provider is in use and cannot be removed.`
+  - if called **twice** then all elements will be deleted
+
+## References
+
+<sup>1</sup>https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-application-load-balancer.html
+> If your service's task definition uses the awsvpc network mode (which is required for the Fargate launch type), you must choose IP addresses as the target type. This is because tasks that use the awsvpc network mode are associated with an elastic network interface, not an Amazon EC2 instance.
+
+<sup>2</sup>https://stackoverflow.com/questions/42715647/whats-the-target-group-port-for-when-using-application-load-balancer-ec2-con
+> Protocol port will be overriden by ECS anwyays so doesn't matter.
+
+<sup>3</sup>https://www.cloudkeeper.com/insight/blog/amazon-ecs-service-communication-via-service-discovery-connect
+> Choose client and server service if the container exposes and listens on a port for network traffic. This service gets an endpoint to communicate with any service within the same namespace
+
+[CDK Workshop](https://cdkworkshop.com/)
+> Instructions on using the AWS Cloud Development Kit (CDK)
+
+[contributors-shield]: https://img.shields.io/github/contributors/programmingwithalex/aws_ecs_service_connect?style=for-the-badge
+[contributors-url]: https://github.com/programmingwithalex/aws_ecs_service_connect/graphs/contributors
+[forks-shield]: https://img.shields.io/github/forks/programmingwithalex/aws_ecs_service_connect?style=for-the-badge
+[forks-url]: https://github.com/programmingwithalex/aws_ecs_service_connect/network/members
+[stars-shield]: https://img.shields.io/github/stars/programmingwithalex/aws_ecs_service_connect?style=for-the-badge
+[stars-url]: https://github.com/programmingwithalex/aws_ecs_service_connect/stargazers
+[issues-shield]: https://img.shields.io/github/issues/programmingwithalex/aws_ecs_service_connect?style=for-the-badge
+[issues-url]: https://github.com/programmingwithalex/aws_ecs_service_connect/issues
+[license-shield]: https://img.shields.io/github/license/programmingwithalex/aws_ecs_service_connect.svg?style=for-the-badge
+[license-url]: https://github.com/programmingwithalex/aws_ecs_service_connect/blob/main/LICENSE

README_aws_service_discovery.md

@@ -0,0 +1,50 @@
+# AWS ECS Service Discovery
+
+* allows multiple AWS ECS services to talk to each other
+* deployment order of services matters - for the **first** deployment
+  * subsequent deployment all services will be aware of each other
+  * ex: if `app` service depends on `db` service, deploy the `db` service first
+
+* service task definitions CloudFormation
+  * `portName` - referencing port name in task definition json file
+  * `discoveryName` - reservation of application name
+    * defaults to portName
+    * can have more than one `discoveryName`
+    * sub-parameter: `dnsName` - tells how client to connect to service
+      * defaults to `discoverName`.`namespace`
+
+* in each service's task definition, there will be two containers:
+  (1) the app you specified in task definition
+  (2) ecs-service-connect container (sidecar container)
+  * can be multiple task definition's per service if want replication
+
+* to communicate across namespaces, use load balancers
+  * TO DO: look into how to do this
+
+---
+
+## Creating the components in AWS ECS
+
+* can specify the `Dockerfile` `command` argument for the container when creating the `task-definition`
+  * means can reuse base `Dockerfile`
+* when creating AWS service must put task in the public subnet or it can't communicate with the ECR repo
+  * [reference](https://stackoverflow.com/questions/61265108/aws-ecs-fargate-resourceinitializationerror-unable-to-pull-secrets-or-registry)
+  * [cloudformation example](https://containersonaws.com/pattern/large-vpc-for-amazon-ecs-cluster)
+
+## Debugging references
+
+* [https://stackoverflow.com/questions/61265108/aws-ecs-fargate-resourceinitializationerror-unable-to-pull-secrets-or-registry](https://stackoverflow.com/questions/61265108/aws-ecs-fargate-resourceinitializationerror-unable-to-pull-secrets-or-registry)
+* [https://stackoverflow.com/questions/63123466/all-tasks-on-a-ecs-service-stuck-in-provisioning-state](https://stackoverflow.com/questions/63123466/all-tasks-on-a-ecs-service-stuck-in-provisioning-state)
+* [https://containersonaws.com/pattern/large-vpc-for-amazon-ecs-cluster](https://containersonaws.com/pattern/large-vpc-for-amazon-ecs-cluster)
+
+* [https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-application-load-balancer.html](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-application-load-balancer.html)
+  * If your service's task definition uses the awsvpc network mode (which is required for the Fargate launch type), you must choose IP addresses as the target type This is because tasks that use the awsvpc network mode are associated with an elastic network interface, not an Amazon EC2 instance.
+
+## AWS Networking Setup
+
+* [https://www.secopsolution.com/blog/enable-internet-access-for-ec2-instances-in-private-subnet](https://www.secopsolution.com/blog/enable-internet-access-for-ec2-instances-in-private-subnet)
+
+## AWS Service Connect References
+
+* [service connect component definitions](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect-concepts.html#service-connect-concepts-terms)
+* [service connect vs service discovery](https://www.cloudkeeper.com/insight/blog/amazon-ecs-service-communication-via-service-discovery-connect)