fix: strengthen types, simplify logic

examples/complete/fixtures.us-east-2.tfvars

@@ -49,17 +49,18 @@ port_mappings = [
 log_configuration = {
   logDriver = "json-file"
   options = {
-    "max-size" = "10m"
-    "max-file" = "3"
+    max-size = "10m"
+    max-file = "3"
   }
   secretOptions = null
 }
 
 privileged = false
 
-extra_hosts = [{
-  ipAddress = "127.0.0.1"
-  hostname  = "app.local"
+extra_hosts = [
+  {
+    ipAddress = "127.0.0.1"
+    hostname  = "app.local"
   },
 ]
 

examples/complete/variables.tf

@@ -1,7 +1,3 @@
-variable "region" {
-  type = string
-}
-
 variable "container_name" {
   type        = string
   description = "The name of the container. Up to 255 characters ([a-z], [A-Z], [0-9], -, _ allowed)"
@@ -24,32 +20,145 @@ variable "container_memory_reservation" {
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html
 variable "container_definition" {
-  type        = map(any)
+  type = object({
+    command = optional(list(string))
+    cpu     = optional(number)
+    dependsOn = optional(list(object({
+      condition     = string
+      containerName = string
+    })))
+    disableNetworking     = optional(bool)
+    dnsSearchDomains      = optional(list(string))
+    dnsServers            = optional(list(string))
+    dockerLabels          = optional(map(string))
+    dockerSecurityOptions = optional(list(string))
+    entryPoint            = optional(list(string))
+    environment = optional(list(object({
+      name  = string
+      value = string
+    })))
+    environmentFiles = optional(list(object({
+      type  = string
+      value = string
+    })))
+    essential = optional(bool)
+    extraHosts = optional(list(object({
+      hostname  = string
+      ipAddress = string
+    })))
+    firelensConfiguration = optional(object({
+      options = optional(map(string))
+      type    = string
+    }))
+    healthCheck = optional(object({
+      command     = list(string)
+      interval    = optional(number)
+      retries     = optional(number)
+      startPeriod = optional(number)
+      timeout     = optional(number)
+    }))
+    hostname    = optional(string)
+    image       = optional(string)
+    interactive = optional(bool)
+    links       = optional(list(string))
+    linuxParameters = optional(object({
+      capabilities = optional(object({
+        add  = optional(list(string))
+        drop = optional(list(string))
+      }))
+      devices = optional(list(object({
+        containerPath = string
+        hostPath      = string
+        permissions   = optional(list(string))
+      })))
+      initProcessEnabled = optional(bool)
+      maxSwap            = optional(number)
+      sharedMemorySize   = optional(number)
+      swappiness         = optional(number)
+      tmpfs = optional(list(object({
+        containerPath = string
+        mountOptions  = optional(list(string))
+        size          = number
+      })))
+    }))
+    logConfiguration = optional(object({
+      logDriver = string
+      options   = optional(map(string))
+      secretOptions = optional(list(object({
+        name      = string
+        valueFrom = string
+      })))
+    }))
+    memory            = optional(number)
+    memoryReservation = optional(number)
+    mountPoints = optional(list(object({
+      containerPath = optional(string)
+      readOnly      = optional(bool)
+      sourceVolume  = optional(string)
+    })))
+    name = optional(string)
+    portMappings = optional(list(object({
+      containerPort = number
+      hostPort      = optional(number)
+      protocol      = optional(string)
+    })))
+    privileged             = optional(bool)
+    pseudoTerminal         = optional(bool)
+    readonlyRootFilesystem = optional(bool)
+    repositoryCredentials = optional(object({
+      credentialsParameter = string
+    }))
+    resourceRequirements = optional(list(object({
+      type  = string
+      value = string
+    })))
+    secrets = optional(list(object({
+      name      = string
+      valueFrom = string
+    })))
+    startTimeout = optional(number)
+    stopTimeout  = optional(number)
+    systemControls = optional(list(object({
+      namespace = string
+      value     = string
+    })))
+    ulimits = optional(list(object({
+      hardLimit = number
+      name      = string
+      softLimit = number
+    })))
+    user = optional(string)
+    volumesFrom = optional(list(object({
+      readOnly        = optional(bool)
+      sourceContainer = string
+    })))
+    workingDirectory = optional(string)
+  })
   description = "Container definition overrides which allows for extra keys or overriding existing keys."
   default     = {}
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PortMapping.html
 variable "port_mappings" {
   type = list(object({
     containerPort = number
-    hostPort      = number
-    protocol      = string
+    hostPort      = optional(number)
+    protocol      = optional(string)
   }))
-
   description = "The port mappings to configure for the container. This is a list of maps. Each map should contain \"containerPort\", \"hostPort\", and \"protocol\", where \"protocol\" is one of \"tcp\" or \"udp\". If using containers in a task with the awsvpc or host network mode, the hostPort can either be left blank or set to the same value as the containerPort"
-
-  default = []
+  default     = null
 }
 
 # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_HealthCheck.html
 variable "healthcheck" {
   type = object({
     command     = list(string)
-    retries     = number
-    timeout     = number
-    interval    = number
-    startPeriod = number
+    interval    = optional(number)
+    retries     = optional(number)
+    startPeriod = optional(number)
+    timeout     = optional(number)
   })
   description = "A map containing command (string), timeout, interval (duration in seconds), retries (1-10, number of times to retry before marking container unhealthy), and startPeriod (0-300, optional grace period to wait, in seconds, before failed healthchecks count toward retries)"
   default     = null
@@ -85,19 +194,20 @@ variable "working_directory" {
   default     = null
 }
 
-variable "container_environment" {
+variable "environment" {
   type = list(object({
     name  = string
     value = string
   }))
   description = "The environment variables to pass to the container. This is a list of maps. map_environment overrides environment"
-  default     = []
+  default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_HostEntry.html
 variable "extra_hosts" {
   type = list(object({
-    ipAddress = string
     hostname  = string
+    ipAddress = string
   }))
   description = "A list of hostnames and IP address mappings to append to the /etc/hosts file on the container. This is a list of maps"
   default     = null
@@ -109,16 +219,23 @@ variable "map_environment" {
   default     = null
 }
 
+variable "map_secrets" {
+  type        = map(string)
+  description = "The secrets variables to pass to the container. This is a map of string: {key: value}. map_secrets overrides secrets"
+  default     = null
+}
+
 # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_EnvironmentFile.html
 variable "environment_files" {
   type = list(object({
-    value = string
     type  = string
+    value = string
   }))
   description = "One or more files containing the environment variables to pass to the container. This maps to the --env-file option to docker run. The file must be hosted in Amazon S3. This option is only available to tasks using the EC2 launch type. This is a list of maps"
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Secret.html
 variable "secrets" {
   type = list(object({
     name      = string
@@ -137,51 +254,62 @@ variable "readonly_root_filesystem" {
 # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LinuxParameters.html
 variable "linux_parameters" {
   type = object({
-    capabilities = object({
-      add  = list(string)
-      drop = list(string)
-    })
-    devices = list(object({
+    capabilities = optional(object({
+      add  = optional(list(string))
+      drop = optional(list(string))
+    }))
+    devices = optional(list(object({
       containerPath = string
       hostPath      = string
-      permissions   = list(string)
-    }))
-    initProcessEnabled = bool
-    maxSwap            = number
-    sharedMemorySize   = number
-    swappiness         = number
-    tmpfs = list(object({
+      permissions   = optional(list(string))
+    })))
+    initProcessEnabled = optional(bool)
+    maxSwap            = optional(number)
+    sharedMemorySize   = optional(number)
+    swappiness         = optional(number)
+    tmpfs = optional(list(object({
       containerPath = string
-      mountOptions  = list(string)
+      mountOptions  = optional(list(string))
       size          = number
-    }))
+    })))
   })
   description = "Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LinuxParameters.html"
   default     = null
 }
 
 # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html
 variable "log_configuration" {
-  type        = any
+  type = object({
+    logDriver = string
+    options   = optional(map(string))
+    secretOptions = optional(list(object({
+      name      = string
+      valueFrom = string
+    })))
+  })
   description = "Log configuration options to send to a custom log driver for the container. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html"
   default     = null
 }
 
 # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html
 variable "firelens_configuration" {
   type = object({
+    options = optional(map(string))
     type    = string
-    options = map(string)
   })
   description = "The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more details, see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_FirelensConfiguration.html"
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_MountPoint.html
 variable "mount_points" {
-  type = list(any)
-
-  description = "Container mount points. This is a list of maps, where each map should contain a `containerPath` and `sourceVolume`. The `readOnly` key is optional."
-  default     = []
+  type = list(object({
+    containerPath = optional(string)
+    readOnly      = optional(bool)
+    sourceVolume  = optional(string)
+  }))
+  description = "Container mount points. This is a list of maps, where each map should contain `containerPath`, `sourceVolume` and `readOnly`"
+  default     = null
 }
 
 variable "dns_servers" {
@@ -196,29 +324,34 @@ variable "dns_search_domains" {
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Ulimit.html
 variable "ulimits" {
   type = list(object({
-    name      = string
     hardLimit = number
+    name      = string
     softLimit = number
   }))
   description = "Container ulimit settings. This is a list of maps, where each map should contain \"name\", \"hardLimit\" and \"softLimit\""
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RepositoryCredentials.html
 variable "repository_credentials" {
-  type        = map(string)
+  type = object({
+    credentialsParameter = string
+  })
   description = "Container repository credentials; required when using a private repo.  This map currently supports a single key; \"credentialsParameter\", which should be the ARN of a Secrets Manager's secret holding the credentials"
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_VolumeFrom.html
 variable "volumes_from" {
   type = list(object({
+    readOnly        = optional(bool)
     sourceContainer = string
-    readOnly        = bool
   }))
   description = "A list of VolumesFrom maps which contain \"sourceContainer\" (name of the container that has the volumes to mount) and \"readOnly\" (whether the container can write to the volume)"
-  default     = []
+  default     = null
 }
 
 variable "links" {
@@ -233,10 +366,11 @@ variable "user" {
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDependency.html
 variable "container_depends_on" {
   type = list(object({
-    containerName = string
     condition     = string
+    containerName = string
   }))
   description = "The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. The condition can be one of START, COMPLETE, SUCCESS or HEALTHY"
   default     = null
@@ -266,8 +400,12 @@ variable "privileged" {
   default     = null
 }
 
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SystemControl.html
 variable "system_controls" {
-  type        = list(map(string))
+  type = list(object({
+    namespace = string
+    value     = string
+  }))
   description = "A list of namespaced kernel parameters to set in the container, mapping to the --sysctl option to docker run. This is a list of maps: { namespace = \"\", value = \"\"}"
   default     = null
 }
@@ -301,3 +439,13 @@ variable "docker_security_options" {
   description = "A list of strings to provide custom labels for SELinux and AppArmor multi-level security systems."
   default     = null
 }
+
+# https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ResourceRequirement.html
+variable "resource_requirements" {
+  type = list(object({
+    type  = string
+    value = string
+  }))
+  description = "The type and amount of a resource to assign to a container. The only supported resource is a GPU."
+  default     = null
+}