[JamesDemeryNava]

…ask def, EFS, and s3 sync to BCDA s3 bucket

JIRA Ticket:
BB2-4910

What Does This PR Do?

This PR adds terraform code to create an ECS service, task definition, EFS, and a scheduled task to run an s3 sync between the new EFS and an s3 bucket in BCDA's AWS account. The ECS service references an ECR repository that is going to be created in a cdap PR, which is here.

The overall goal for this architecture is shown in the image below, though I still need to add the cloudwatch logs to this diagram:

This PR is in a weird spot, as there is another ticket to actually deploy it (BB2-5184). Also, there is the cdap PR that needs to be merged first, and then we need to send the ARN for the s3 sync task role over to the cdap team (or work with them) to add the write permissions for that task role to the bucket where our metrics CSVs will live.

What Should Reviewers Watch For?

• Is it okay to create a separate file for the its-log ECS service, as I do not want all the env vars that the bb-api service has, and the task definition is a bit different?
• When I ran tofu plan in the 20-microservices directory, I see 28 resources to create and 1 to destroy which is: # aws_ecs_task_definition.ecs_task["api"] must be replaced. That seems incorrect, but I'm not sure how my change is introducing that. Any thoughts there?

If you're reviewing this PR, please check for these things in particular:

Validation

• cd into ops/services/20-microservices, run the initial tofu commands, make sure you have kion activated for the test env
• Then run tofu plan, should see 28 to create and 1 to destroy, review the plan to confirm it lines up with

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval. @sb-DarenDean @sb-benohe we'll be adding a decent amount of infrastructure to our AWS accounts, so want to make sure you're aware.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• No migrations

[annamontare-nava]

Is it okay to create a separate file for the its-log ECS service, as I do not want all the env vars that the bb-api service has, and the task definition is a bit different?

I think this makes sense!

[annamontare-nava]

When I ran tofu plan in the 20-microservices directory, I see 28 resources to create and 1 to destroy which is: # aws_ecs_task_definition.ecs_task["api"] must be replaced. That seems incorrect, but I'm not sure how my change is introducing that. Any thoughts there?

I think this is because the terraform state gets out of sync with the updates made by GitHub actions to the task definition. The task definition resource can't be updated in place (I don't remember why) and so will be deleted and then re-added. This seems okay to me.

[annamontare-nava]

Validation steps look good on a quick pass.

[annamontare-nava]

Will also want to add Datadog to this!

[JamesDemeryNava]

I believe i've added it now, let me know if you see any issues