로드 밸런서

1. CI 유저에 로드 밸런스 권한 부여

"elasticloadbalancing:*"

2. 로드 밸런서 구축(feat.terraform)

load_balancer.tf

resource "aws_lb" "api" {
    name = "${local.prefix}-main"
    load_balancer_type="application"
    subnets = [
        aws_subnet.public_a.id,
        aws_subnet.public_b.id
    ]
    security_groups = [aws_security_group.lb.id]
    
    tags = local.common_tags
}

resource "aws_lb_target_group" "api" {
    name = "${local.prefix}-api"
    protocol = "HTTP"
    vpc_id = aws_vpc.main.id
    target_type = "ip"
    port = 8000
    
    health_check {
        path = "/admin/login/"
    } 
}

resource "aws_lb_listener" "api" {
    load_balancer_arn = aws_lb.api.arn
    port = 80
    protocol = "HTTP"
    default_action {
        type = "forward"
        target_group_arn = aws_lb_target_group.api.arn
    }
}

resource "aws_security_group" "lb" {
    description = "Allow access to Application Load Balancer"
    name = "${local.prefix}-lb"
    vpc_id = aws_vpc.main.id
    
    ingress {
      protocol = "tcp"
      from_port = 80 
      to_port = 80
      cidr_blocks = ["0.0.0.0/0"]
    } 
    
    egress {
        protocol = "tcp"
        from_port = 8000
        to_port = 8000
        cidr_blocks = ["0.0.0.0/0"]
    }
    
    tags = local.common_tags
}

ecs.tf 파일 수정

• 변경 전

(중략)

data "template_file" "api_container_definitions" {
  template = file("./templates/ecs/container-definitions.json.tpl")

  vars = {
    app_image         = var.ecr_image_api
    proxy_image       = var.ecr_image_proxy
    django_secret_key = var.django_secret_key
    db_host           = aws_db_instance.main.address
    db_name           = aws_db_instance.main.name
    db_user           = aws_db_instance.main.username
    db_pass           = aws_db_instance.main.password
    log_group_name    = aws_cloudwatch_log_group.ecs_task_logs.name
    log_group_region  = data.aws_region.current.name
    allowed_hosts     = "*"
  }
}



(중략)

resource "aws_security_group" "ecs_service" {
  description = "Access for the ECS Service"
  name        = "${local.prefix}-ecs-service"
  vpc_id      = aws_vpc.main.id

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port = 5432
    to_port   = 5432
    protocol  = "tcp"
    cidr_blocks = [
      aws_subnet.private_a.cidr_block,
      aws_subnet.private_b.cidr_block
    ]
  }

  ingress {
    from_port   = 8000
    to_port     = 8000
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = local.common_tags
}

로드밸런서를 구축했으니 컨테이너의 allowed_hosts를 변경시켜준다.

• 변경 후

data "template_file" "api_container_definitions" {
  template = file("./templates/ecs/container-definitions.json.tpl")

  vars = {
    app_image         = var.ecr_image_api
    proxy_image       = var.ecr_image_proxy
    django_secret_key = var.django_secret_key
    db_host           = aws_db_instance.main.address
    db_name           = aws_db_instance.main.name
    db_user           = aws_db_instance.main.username
    db_pass           = aws_db_instance.main.password
    log_group_name    = aws_cloudwatch_log_group.ecs_task_logs.name
    log_group_region  = data.aws_region.current.name
    allowed_hosts     = aws_lb.api.dns_name
  }
}


(중략)

resource "aws_security_group" "ecs_service" {
  description = "Access for the ECS Service"
  name        = "${local.prefix}-ecs-service"
  vpc_id      = aws_vpc.main.id

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port = 5432
    to_port   = 5432
    protocol  = "tcp"
    cidr_blocks = [
      aws_subnet.private_a.cidr_block,
      aws_subnet.private_b.cidr_block
    ]
  }

  ingress {
    from_port   = 8000
    to_port     = 8000
    protocol    = "tcp"
    security_groups = [
        aws_security_group.lb.id
    ] 
  }

  tags = local.common_tags
}


(중략)

resource "aws_ecs_service" "api" {
  name            = "${local.prefix}-api"
  cluster         = aws_ecs_cluster.main.name
  task_definition = aws_ecs_task_definition.api.family
  desired_count   = 1
  launch_type     = "FARGATE"

  network_configuration {
    subnets = [
      aws_subnet.private_a.id,
      aws_subnet.private_b.id,
    ]
    security_groups = [aws_security_group.ecs_service.id]
  }
  load_balancer {
    target_group_arn = aws_lb_target_group.api.arn
    container_name   = "proxy"
    container_port   = 8000
  }
}

outputs.tf 파일 수정

(중략)

output "api_endpoint"{
  value = aws_lb.api.dns_name
}