ECS Worker

Run background worker containers on ECS Fargate or EC2 without exposed ports, ideal for queue consumers, cron jobs, and asynchronous processing tasks.

Type: rvn-ecs-worker · Latest version: 0.3.3

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Background worker ECS service for running private container workloads without exposed ports.

Overview

The ECS Worker module creates an ECS service for background jobs, queue consumers, event processors, and other private workloads in an existing Ravion ECS cluster. It uses the same ECS service Terraform module as ECS Web Server, but does not create or attach a load balancer target group and does not expose a primary container port.

Terraform source: flightcontrolhq/modules/compute/ecs_service

Use cases

Scenario	ECS Worker helps by…
Queue consumers	Running scalable workers for SQS, Kafka, Redis, or custom queues
Background jobs	Processing async work without public HTTP routing
Event processors	Running long-lived containers that consume streams or events
Private workloads	Keeping tasks off external load balancers and public ports

Networking

Workers do not expose a primary app port and are not registered with an Application Load Balancer. Run in private subnets is enabled by default so tasks stay private while using NAT or equivalent egress for outbound dependencies.

Sidecars may still define port mappings for task-local agents, proxies, or helper containers. Those sidecar ports are not exposed through a load balancer by this module.

Build and deployment

Workers support Dockerfile, Railpack, and Pull from image registry deployments. Deployments update the ECS service task definition with the selected image, generated container definition, logs, runtime environment variables, secrets, IAM roles, volumes, sidecars, and selected capacity provider settings. For Railpack builds, you can optionally pin the Railpack version and override install, build, and start commands. For Fargate and Fargate Spot, App ephemeral storage uses the AWS default of 20 GiB unless you increase it to 21-200 GiB. For image registry deployments, use Start command to override the image default CMD when the worker process uses a different command.

Persistent storage

Enable the EFS file system setting, select a Ravion EFS module, and set the EFS mount path. Ravion adds the task volume, mounts it into the worker container, attaches the file system’s client security group to the service so NFS traffic is allowed, and mounts through the file system’s access point when one is enabled. Sidecars mount the same file system through their Mount points setting with efs as the source volume.

EFS volumes work with Fargate and EC2 Linux tasks and keep data across task replacement. Transit encryption is enabled by default. Enable EFS IAM authorization to authorize file system access with the task role; the task role must allow elasticfilesystem:ClientMount, plus elasticfilesystem:ClientWrite or elasticfilesystem:ClientRootAccess as needed.

Autoscaling

Autoscaling is enabled by default with CPU and memory target tracking. Use custom metric scaling policies for queue depth, lag, backlog, or other workload-specific metrics that better represent worker demand. When autoscaling is disabled, Desired tasks controls how many worker tasks the ECS service keeps running.

Configuration

Field	Required	Default	Description
ECS cluster	Yes	-	Existing rvn-ecs-cluster module instance
Service name	Yes	{project}-{env}-{module}	Name for the ECS service and related resources
Run in private subnets	No	true	Run tasks in private subnets without public IPs
Build source	Yes	dockerfile	Dockerfile, Railpack, or Pull from image registry
Start command	No	[]	Command arguments that override an image default CMD
Capacity provider	Yes	fargate	Primary service capacity provider
App size	No	2 vCPU, 4 GB	Fargate task CPU and memory
App ephemeral storage (GiB)	No	20	Fargate task ephemeral storage
Autoscaling	No	true	Enable CPU and optional memory target tracking
Desired tasks	Yes*	1	Number of worker tasks when autoscaling is disabled
Custom metric scaling policies	No	[]	Queue/backlog-oriented target tracking policies
Runtime environment variables	No	-	Environment variables passed to the worker container
Runtime secrets	No	-	Secrets injected from SSM Parameter Store or Secrets Manager
Sidecars	No	[]	Additional containers in the worker task
EFS file system	No	false	Mount an EFS file system into the worker container
EFS mount path	Yes*	/mnt/efs	Worker container path for the referenced file system

Design decisions

• The module intentionally creates an ECS service without load balancer attachment or primary container port mappings.
• Sidecar port mappings are allowed for task-local communication, agents, and proxies.
• Desired count uses the autoscaling minimum when autoscaling is enabled and the Desired tasks input when autoscaling is disabled.
• Advanced Terraform variables exist for exceptional lower-level overrides. Prefer the typed Ravion fields whenever possible.

Learn more

• Amazon ECS services
• Amazon ECS capacity providers
• Amazon ECS service auto scaling

Inputs reference

All inputs for rvn-ecs-worker version 0.3.3. Use the name shown for each field as the input key in module config.

ECS cluster

cluster · $ref:rvn-ecs-cluster · required

ECS cluster.

• Immutable after creation

Worker service

name · string · required

Service name. Name for the ECS worker service and related resources.

• Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
• Immutable after creation
• Pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$ — Use 1-255 letters, numbers, underscores, or hyphens, starting with a letter or number.

private_subnet_placement_enabled · boolean

Run in private subnets. Recommended. Requires a NAT gateway or equivalent for internet access and keeps worker tasks off public subnets.

• Default: true

Build config

build_source · string · required

Build source.

• Default: dockerfile
• Allowed values: dockerfile (Dockerfile), railpack (Railpack), image_registry (Pull from image registry)

source_repo · gitrepo · required

Git repository. Repository containing the application source for Dockerfile or Railpack builds.

• Shown when: {"build_source":["dockerfile","railpack"]}

source_base_path · string

Source base path. Repository-relative source and build root.

• Default: .
• Shown when: {"build_source":["dockerfile","railpack"]}

image_repository · string · required

Image repository. Image repository without a tag or digest, such as nginx, ghcr.io/org/app, or 123456789012.dkr.ecr.us-east-1.amazonaws.com/app.

• Shown when: {"build_source":"image_registry"}

image_registry_credentials_secret_arn · string

Registry credentials secret ARN. Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.

• Shown when: {"build_source":"image_registry"}

image_start_command · string_array

Start command. Optional command arguments that override the image default command. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

• Default: []
• Shown when: {"build_source":"image_registry"}

Docker

dockerfile · string

Dockerfile path. Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.

• Shown when: {"build_source":"dockerfile"}

dockerfile_context · string

Docker build context path. Directory to use as the Docker build context, relative to the repository root or configured source base path.

• Shown when: {"build_source":"dockerfile"}

Railpack

railpack_version · string

Railpack version. Optional Railpack version to use for the build. Leave blank to use the Ravion default.

• Pattern: ^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$ — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0.
• Shown when: {"build_source":"railpack"}

railpack_install_cmd · string

Install command. Optional dependency installation command. Leave blank to use Railpack detection.

• Shown when: {"build_source":"railpack"}

railpack_build_cmd · string

Build command. Optional application build command. Leave blank to use Railpack detection.

• Shown when: {"build_source":"railpack"}

railpack_start_cmd · string

Start command.

• Shown when: {"build_source":"railpack"}

Container resources

capacity_provider · string · required

Capacity provider. Choose the primary capacity provider. Most services should use only one provider.

• Default: fargate
• Allowed values: fargate (Fargate), fargate_spot (Fargate spot), ec2 (EC2)

additional_fargate_capacity_enabled · boolean

Also use Fargate. Add Fargate to the capacity provider strategy in addition to the primary provider.

• Default: false
• Shown when: {"capacity_provider":{"not":"fargate"}}

additional_fargate_spot_capacity_enabled · boolean

Also use Fargate spot. Add lower-cost interruptible Fargate spot capacity in addition to the primary provider.

• Default: false
• Shown when: {"capacity_provider":{"not":"fargate_spot"}}

additional_ec2_capacity_enabled · boolean

Also use EC2. Add EC2 capacity from the selected cluster in addition to the primary provider.

• Default: false
• Shown when: {"capacity_provider":{"not":"ec2"}}

fargate_size · compound · required

App size. CPU and memory for Fargate tasks. Prices are estimated from AWS Fargate pricing for the selected region, architecture, and capacity provider.

• Default: {"memory_gb":4,"vcpu":2}
• Shown when: {"capacity_provider":["fargate","fargate_spot"]}

task_ephemeral_storage_size_gib · number

App ephemeral storage (GiB). Optional ephemeral storage size for each Fargate app task, from 21 to 200 GiB. Leave blank to use the AWS default of 20 GiB.

• Min: 21
• Max: 200
• Shown when: {"capacity_provider":["fargate","fargate_spot"]}

task_cpu · string · required

App vCPU. vCPU reserved for each app task on EC2 capacity. Leave at least 0.25 vCPU unreserved on each EC2 instance for the ECS agent and system processes.

• Default: 1.5
• Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a vCPU value, such as 0.5, 1, or 2.
• Shown when: {"capacity_provider":"ec2"}

task_memory · string · required

App memory in GB. Memory reserved for each app task on EC2 capacity. Leave at least 0.5 GB unreserved on each EC2 instance for the ECS agent and system processes.

• Default: 3.5
• Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a memory value in GB, such as 0.5, 1, or 4.
• Shown when: {"capacity_provider":"ec2"}

cpu_architecture · string

CPU architecture. Use x86_64 for broad compatibility; use ARM64 for lower cost when your image and dependencies support it.

• Default: X86_64
• Allowed values: X86_64 (x86_64 - widest compatibility), ARM64 (ARM64 - lower cost)

execute_command_enabled · boolean

ECS exec. Enable ECS Exec for interactive debugging in running containers. Leave off by default for tighter access control; turn on when operators need shell/debug access through AWS Systems Manager.

• Default: false

Autoscaling

auto_scaling_enabled · boolean

Autoscaling.

• Default: true

min_capacity · number

Minimum tasks. Recommend at least 2 for production.

• Default: 1
• Min: 0
• Shown when: {"auto_scaling_enabled":true}

max_capacity · number

Maximum tasks.

• Default: 3
• Min: 1
• Shown when: {"auto_scaling_enabled":true}

desired_count · number

Desired tasks. Number of tasks to keep running when autoscaling is disabled.

• Default: 1
• Min: 1
• Shown when: {"auto_scaling_enabled":false}

cpu_target_value · number

CPU target (%).

• Default: 70
• Min: 1
• Max: 100
• Shown when: {"auto_scaling_enabled":true}

memory_target_value · number

Memory target (%). Target average memory utilization for memory-based autoscaling. Leave blank to disable memory autoscaling.

• Default: 80
• Min: 1
• Max: 100
• Shown when: {"auto_scaling_enabled":true}

scale_in_cooldown · number

Scale-in cooldown (secs). Time after a scale-in activity before another scale-in can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

• Default: 300
• Min: 0
• Shown when: {"auto_scaling_enabled":true}

scale_out_cooldown · number

Scale-out cooldown (secs). Time after a scale-out activity before another scale-out can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

• Default: 300
• Min: 0
• Shown when: {"auto_scaling_enabled":true}

scale_in_enabled · boolean

Scale in. Allow autoscaling to reduce task count automatically.

• Default: true
• Shown when: {"auto_scaling_enabled":true}

scheduled_scaling · object_array

Scheduled scaling actions. Optional Application Auto Scaling scheduled actions for the ECS service desired count. Each action sets a recurring, one-time, or rate-based schedule and may update the minimum capacity, maximum capacity, or both.

• Default: []
• Shown when: {"auto_scaling_enabled":true}

Show item fields

name · string · required

Action name. Unique scheduled action name for this ECS service scalable target. AWS allows 1-256 characters and rejects leading/trailing spaces, control characters, colon, slash, and pipe.

• Pattern: ^(?! )(?!.* $)(?!.*[\x00-\x1F\x7F-\x9F:/|]).{1,256}$ — Use 1-256 characters with no leading/trailing spaces and no control characters, colon, slash, or pipe.

schedule · string · required

Schedule expression. Application Auto Scaling schedule expression: at(yyyy-mm-ddThh:mm:ss), rate(value unit), or cron(fields). Cron normally uses six fields: minutes, hours, day-of-month, month, day-of-week, year.

• Pattern: ^(at\(.+\)|rate\([1-9][0-9]* (minute|minutes|hour|hours|day|days)\)|cron\(.+\))$ — Use at(…), rate(value minute|minutes|hour|hours|day|days), or cron(…).

min_capacity · number

Minimum capacity. Optional desired-count floor to apply when this action runs. Set minimum capacity, maximum capacity, or both.

• Min: 0

max_capacity · number

Maximum capacity. Optional desired-count ceiling to apply when this action runs. Set maximum capacity, minimum capacity, or both.

• Min: 0

timezone · string

Time zone. IANA/Joda-Time canonical time zone used for at() and cron() expressions. Defaults to UTC. Does not affect start_time or end_time.

• Default: UTC
• Pattern: ^[A-Za-z_+-]+(?:/[A-Za-z0-9_+.-]+)*$ — Use a canonical IANA/Joda-Time time zone such as UTC, America/New_York, Etc/GMT+9, or Pacific/Tahiti.

start_time · string

Start time. Optional UTC boundary for when a recurring scheduled action starts. Terraform expects RFC 3339 format and this value is not affected by timezone.

• Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$ — Use UTC RFC 3339 format, for example 2026-01-02T15:04:05Z.

end_time · string

End time. Optional UTC boundary for when a recurring scheduled action stops. Terraform expects RFC 3339 format and this value is not affected by timezone.

• Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$ — Use UTC RFC 3339 format, for example 2026-01-02T23:04:05Z.

custom_metric_scaling_policies · object_array

Custom metric scaling policies. Additional target tracking scaling policies using custom CloudWatch metrics. Each policy must use a metric that changes proportionally with ECS service capacity.

• Default: []
• Shown when: {"auto_scaling_enabled":true}

Show item fields

policy_name · string · required

Policy name. Application Auto Scaling policy name. Terraform/AWS require 1-255 characters and this name must be unique for the scalable target.

• Pattern: ^.{1,255}$ — Use 1-255 characters.

target_value · number · required

Target value. Target value for the custom metric. Choose a value appropriate for the CloudWatch metric, such as desired average queue depth per task.

custom_metric · object · required

Custom metric. CloudWatch customized metric specification supported by this Terraform module: metric_name, namespace, statistic, and optional dimensions map. Statistic must be Average, Minimum, Maximum, SampleCount, or Sum.

• Default: {"dimensions":{}}

scale_in_cooldown · number

Scale-in cooldown seconds. Seconds after a scale-in activity completes before another scale-in activity can start.

• Default: 300
• Min: 0

scale_out_cooldown · number

Scale-out cooldown seconds. Seconds to wait for a previous scale-out activity to take effect.

• Default: 300
• Min: 0

scale_in_enabled · boolean

Scale in. Allow this target tracking policy to remove running tasks automatically.

• Default: true

Environment variables

build_environment_variables · object

Build environment variables. Environment variables available during builds. Values can be plain strings or references loaded from Parameter Store or Secrets Manager.

dockerfile_inject_env_variables · boolean

Inject environment variables in Dockerfile. Pass build environment variables into Dockerfile builds as build arguments.

• Default: false
• Shown when: {"build_source":"dockerfile"}

environment_variables · array

Runtime environment variables. Runtime environment variables passed to the worker container.

secrets · array

Runtime secrets. Secrets injected into the ECS task at runtime as an array of {name, value_from} objects. value_from can be an SSM parameter or Secrets Manager ARN.

Pre and post deploy

pre_deploy_enabled · boolean

Run pre-deploy command. Run a one-off ECS task before updating the ECS service.

• Default: false

pre_deploy_command · string_array · required

Pre-deploy command. Command arguments to run before updating the ECS service. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

• Default: []
• Shown when: {"pre_deploy_enabled":true}

pre_deploy_environment_variables · array

Pre-deploy environment variables. Additional environment variables for the pre-deploy task. Runtime environment variables and secrets are already inherited from the app container.

• Default: []
• Shown when: {"pre_deploy_enabled":true}

pre_deploy_cpu · number

Pre-deploy CPU units. Optional CPU units for the pre-deploy task. Leave blank to use the app task CPU setting.

• Min: 1
• Shown when: {"pre_deploy_enabled":true}

pre_deploy_memory · number

Pre-deploy memory (MiB). Optional memory in MiB for the pre-deploy task. Leave blank to use the app task memory setting.

• Min: 1
• Shown when: {"pre_deploy_enabled":true}

pre_deploy_ephemeral_storage_size_gib · number

Pre-deploy ephemeral storage (GiB). Optional ephemeral storage size for the pre-deploy task. Leave blank to use the task definition default.

• Min: 21
• Max: 200
• Shown when: {"pre_deploy_enabled":true}

pre_deploy_timeout · number

Pre-deploy timeout (secs). Maximum time to wait for the pre-deploy task to finish.

• Default: 1800
• Min: 1
• Shown when: {"pre_deploy_enabled":true}

post_deploy_enabled · boolean

Run post-deploy command. Run a one-off ECS task after the ECS service deployment succeeds.

• Default: false

post_deploy_command · string_array · required

Post-deploy command. Command arguments to run after the ECS service deployment succeeds. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

• Default: []
• Shown when: {"post_deploy_enabled":true}

post_deploy_environment_variables · array

Post-deploy environment variables. Additional environment variables for the post-deploy task. Runtime environment variables and secrets are already inherited from the app container.

• Default: []
• Shown when: {"post_deploy_enabled":true}

post_deploy_cpu · number

Post-deploy CPU units. Optional CPU units for the post-deploy task. Leave blank to use the app task CPU setting.

• Min: 1
• Shown when: {"post_deploy_enabled":true}

post_deploy_memory · number

Post-deploy memory (MiB). Optional memory in MiB for the post-deploy task. Leave blank to use the app task memory setting.

• Min: 1
• Shown when: {"post_deploy_enabled":true}

post_deploy_ephemeral_storage_size_gib · number

Post-deploy ephemeral storage (GiB). Optional ephemeral storage size for the post-deploy task. Leave blank to use the task definition default.

• Min: 21
• Max: 200
• Shown when: {"post_deploy_enabled":true}

post_deploy_timeout · number

Post-deploy timeout (secs). Maximum time to wait for the post-deploy task to finish.

• Default: 1800
• Min: 1
• Shown when: {"post_deploy_enabled":true}

Logging

firelens_enabled · boolean

FireLens log routing. Routes the app container logs through a Fluent Bit sidecar. CloudWatch output stays enabled by default so Ravion runtime logs continue to work.

• Default: false

firelens_image · string · required

FireLens image. Container image for the Fluent Bit log router sidecar.

• Default: public.ecr.aws/aws-observability/aws-for-fluent-bit:stable
• Shown when: {"firelens_enabled":true}

firelens_config · text

Additional Fluent Bit config. Optional Fluent Bit config appended after the generated [SERVICE] block. Add [OUTPUT] blocks here for destinations such as Datadog, Splunk, Firehose, OpenSearch, or S3.

• Shown when: {"firelens_enabled":true}

firelens_cloudwatch_output_enabled · boolean

Keep CloudWatch output enabled. Recommended. Sends FireLens-routed app logs to the service CloudWatch log group so Ravion runtime logs continue to work. Disable only if all app logs should go exclusively to external destinations.

• Default: true
• Shown when: {"firelens_enabled":true}

firelens_ecs_metadata_enabled · boolean

Add ECS log metadata. Adds ECS cluster, task, and container metadata to FireLens log records.

• Default: true
• Shown when: {"firelens_enabled":true}

firelens_environment_variables · array

FireLens environment variables. Environment variables passed to the log router sidecar. Use these for non-secret destination options.

• Default: []
• Shown when: {"firelens_enabled":true}

firelens_secrets · array

FireLens secrets. Secrets injected into the log router sidecar as an array of {name, value_from} objects. Use these for API keys or tokens stored in SSM Parameter Store or Secrets Manager.

• Default: []
• Shown when: {"firelens_enabled":true}

IAM roles and policies

execution_role_arn · string

Execution role ARN override. Optional existing ECS task execution role ARN. Leave blank to let the module create and manage the execution role used for pulling images and writing logs.

task_role_arn · string

Task role ARN override. Optional existing ECS task role ARN for application AWS permissions. Leave blank to let the module create a task role and attach the policies configured below.

task_role_policies · string_array

Task role policy ARNs. Additional managed IAM policy ARNs to attach to the generated task role. Only used when task role ARN override is blank.

• Default: []

task_role_inline_policies · object

Task role inline policies. Inline IAM policy documents keyed by policy name.

• Default: {}

execution_role_policies · string_array

Execution role policy ARNs. Additional managed IAM policy ARNs to attach to the generated execution role. Only used when execution role ARN override is blank.

• Default: []

Networking and deployment

deployment_minimum_healthy_percent · number

Minimum healthy percent. Minimum percentage of desired tasks that must stay healthy during rolling deployments. Keep 100 for zero-downtime deploys. Lower it only when the cluster does not have enough spare capacity to start replacement tasks first, since lowering it can reduce availability during deploys.

• Default: 100
• Min: 0
• Max: 200

deployment_maximum_percent · number

Maximum percent. Maximum temporary task count during rolling deployments. Keep 200 for fast replacement capacity. Lower it when cluster capacity, IP availability, or burst cost should limit how many extra tasks ECS can start.

• Default: 200
• Min: 100
• Max: 400

security_group_ids · string_array

Additional security groups. Additional security group IDs to attach to ECS tasks.

• Default: []

allowed_cidr_blocks · string_array

Allowed CIDR blocks. CIDR blocks allowed direct access to the service in addition to load balancer traffic.

• Default: []

sidecars · object_array

Sidecars. Optional containers that run in the same ECS task as the app container. Use sidecars for agents, local proxies, lightweight workers, or helper processes that should share task networking and lifecycle with the app.

• Default: []

Show item fields

name · string · required

Container name. Unique name for this sidecar container within the task.

• Pattern: ^[A-Za-z0-9_-]{1,255}$ — Use 1-255 characters: letters, numbers, hyphens, and underscores only.

image · string · required

Container image. Container image URI or registry reference for the sidecar.

essential · boolean

Essential container. When enabled, ECS stops the whole task if this sidecar exits. Leave disabled for optional agents or helpers that should not take down the app.

• Default: false

cpu · number

CPU units. Optional CPU units reserved for this sidecar. Increase the task size if sidecars need dedicated CPU.

• Min: 0

memory · number

Memory limit in MiB. Optional hard memory limit for this sidecar. ECS stops the container if it exceeds this limit.

• Min: 0

memory_reservation · number

Memory reservation in MiB. Optional soft memory reservation for this sidecar. Useful for agents that can burst above their normal memory use.

• Min: 0

environment · object_array

Environment variables. Environment variables passed to this sidecar container.

• Default: []

Show item fields

name · string · required

Name. Environment variable name.

• Pattern: ^[A-Za-z_][A-Za-z0-9_]*$ — Use a valid environment variable name.

value · string · required

Value. Environment variable value.

secrets · object_array

Secrets. Secrets injected into this sidecar from SSM Parameter Store or Secrets Manager.

• Default: []

Show item fields

name · string · required

Name. Environment variable name exposed to the sidecar.

• Pattern: ^[A-Za-z_][A-Za-z0-9_]*$ — Use a valid environment variable name.

value_from · string · required

Value from. SSM parameter or Secrets Manager ARN containing the secret value.

port_mappings · object_array

Port mappings. Optional ports exposed by this sidecar inside the task. Most helper sidecars do not need port mappings.

• Default: []

Show item fields

container_port · number · required

Container port. Port exposed by the sidecar container.

• Min: 1
• Max: 65535

host_port · number

Host port. Optional host port for EC2 networking modes. Leave empty for awsvpc tasks unless you need a fixed host port.

• Min: 1
• Max: 65535

protocol · string

Protocol. Network protocol for this port mapping.

• Default: tcp
• Allowed values: tcp (TCP), udp (UDP)

app_protocol · string

Application protocol. Optional application protocol used by service connect integrations.

• Allowed values: http (HTTP), http2 (HTTP/2), grpc (gRPC)

mount_points · object_array

Mount points. Optional task volume mounts for this sidecar. Use the volume name efs to mount the EFS file system when the EFS file system setting is enabled.

• Default: []

Show item fields

source_volume · string · required

Source volume. Task volume name to mount into the sidecar. Use efs for the EFS file system volume.

container_path · string · required

Container path. Path inside the sidecar container where the volume is mounted.

• Pattern: ^/ — Use an absolute container path.

read_only · boolean

Read only. Mount the volume as read-only inside the sidecar.

• Default: false

depends_on · object_array

Container dependencies. Optional startup dependencies for this sidecar. Use this when the sidecar should wait for another container to start or become healthy.

• Default: []

Show item fields

container_name · string · required

Container name. Container this sidecar depends on.

condition · string · required

Condition. Startup condition to wait for before starting this sidecar.

• Default: START
• Allowed values: START (Start), HEALTHY (Healthy), COMPLETE (Complete), SUCCESS (Success)

command · string_array

Command. Optional command arguments that override the image default command.

• Default: []

entry_point · string_array

Entry point. Optional entry point arguments that override the image default entry point.

• Default: []

working_directory · string

Working directory. Optional working directory inside the sidecar container.

Persistent storage

efs_enabled · boolean

EFS file system. Mount an EFS file system into the app container. The service attaches the file system’s client security group and adds the volume and mount point automatically.

• Default: false

efs · $ref:rvn-efs · required

EFS file system.

• Shown when: {"efs_enabled":true}

efs_mount_path · string · required

EFS mount path. Path inside the app container where the file system is mounted.

• Default: /mnt/efs
• Pattern: ^/ — Use an absolute container path.
• Shown when: {"efs_enabled":true}

efs_read_only · boolean

EFS read only. Mount the file system as read-only inside the app container.

• Default: false
• Shown when: {"efs_enabled":true}

efs_iam_authorization · boolean

EFS IAM authorization. Use the task role to authorize file system access. The task role must allow elasticfilesystem:ClientMount, plus elasticfilesystem:ClientWrite or elasticfilesystem:ClientRootAccess as needed.

• Default: false
• Shown when: {"efs_enabled":true}

Builder config

build_infrastructure_type · string · required

Builder instance type. Use on-demand EC2 for predictable availability or EC2 Spot for lower cost with possible capacity delays or interruption.

• Default: ec2
• Allowed values: ec2 (EC2), ec2-spot (EC2 spot)
• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

build_instance_size · string · required

Builder instance size. EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds.

• Default: c7a.4xlarge
• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

build_execution_environment_id · string

Builder execution environment. Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment.

• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

build_ami · string

Builder AMI. Optional AMI ID for build runners. Leave empty to use the default runner image.

• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

Image registry lifecycle

ecr_scan_on_push_enabled · boolean

Scan images on push. Ask ECR to run its basic vulnerability scan whenever a new image is pushed. Keep this on for early dependency and OS package findings; disable only if another scanner owns image scanning or duplicate findings are noisy.

• Default: true
• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

ecr_force_deletion_enabled · boolean

Force delete image repository. Allow the ECR repository to be deleted even when it contains images. Use with care.

• Default: false
• Shown when: {"build_source":["dockerfile","railpack","nixpacks"]}

Misc

new_deployment_forcing_enabled · boolean

Force new deployment. Force ECS to start a new deployment when applying service configuration, even if the task definition did not change.

• Default: true

tags · keyvalue

Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

Terraform settings

opentofu_version · string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace · string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

• Immutable after creation

advanced_terraform_variables · object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

• Default: {}