bitovi/Deploy an AWS ECS Cluster
Deploys an Amazon ECS Cluster with service, task and ALB definitions, even DNS with cert (If in Route53).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jan 30, 2026
- License
- MIT
Pinned Snippet
uses: bitovi/github-actions-deploy-ecs@ee23fb28540c1cc35196b7e053e52b6f8f38a4f3 # v1.0.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| aws_access_key_id | AWS access key ID | no | — |
| aws_secret_access_key | AWS secret access key | no | — |
| aws_session_token | AWS session token | no | — |
| aws_default_region | AWS default region | no | us-east-1 |
| aws_resource_identifier | Set to override the AWS resource identifier for the deployment. Defaults to `${org}-{repo}-{branch}`. Use with destroy to destroy specific resources. | no | — |
| aws_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| checkout | Specifies if this action should checkout the code | no | true |
| bitops_code_only | Will run only the generation phase of BitOps, where the Terraform and Ansible code is built. | no | — |
| bitops_code_store | Store BitOps code as a GitHub artifact | no | — |
| tf_stack_destroy | Set to "true" to Destroy the stack through Terraform. | no | — |
| tf_state_file_name | Change this to be anything you want to. Careful to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. | no | — |
| tf_state_file_name_append | Append a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. Can co-exist with the tf_state_file_name variable. | no | — |
| tf_state_bucket | AWS S3 bucket to use for Terraform state. Defaults to `${org}-${repo}-{branch}-tf-state` | no | — |
| tf_state_bucket_destroy | Force purge and deletion of S3 bucket defined. Any file contained there will be destroyed. `tf_stack_destroy` must also be `true` | no | — |
| aws_ecs_enable | Toggle ECS Creation | no | true |
| aws_ecs_service_name | Elastic Container Service name | no | — |
| aws_ecs_cluster_name | Elastic Container Service cluster name | no | — |
| aws_ecs_service_launch_type | Configuration type. Could be EC2, FARGATE or EXTERNAL | no | — |
| aws_ecs_task_type | Configuration type. Could be EC2, FARGATE or empty. Will default to aws_ecs_service_launch_type if none defined. (Blank if EXTERNAL) | no | — |
| aws_ecs_task_name | Elastic Container Service task name | no | — |
| aws_ecs_task_ignore_definition | Toggle to ignore task definition changes after first deployment. Useful when using external tools to manage the task definition. | no | — |
| aws_ecs_task_execution_role | Task execution role name that the Amazon ECS container agent and the Docker daemon can assume | no | — |
| aws_ecs_task_role | Name of the IAM role that allows your Amazon ECS container task to make calls to other AWS services | no | — |
| aws_ecs_task_reuse_role | Toggle reusing the task execution role as the task role. | no | — |
| aws_ecs_task_json_definition_file | Name of the json file containing task definition. Overrides every other input. | no | — |
| aws_ecs_task_network_mode | Network type to use in task definition | no | — |
| aws_ecs_task_cpu | Task CPU Amount | no | — |
| aws_ecs_task_mem | Task Mem Amount | no | — |
| aws_ecs_container_cpu | Container CPU Amount | no | — |
| aws_ecs_container_mem | Container Mem Amount | no | — |
| aws_ecs_container_user | User to run container as | no | — |
| aws_ecs_node_count | Node count for ECS Cluster | no | — |
| aws_ecs_app_image | Name of the image to be used | no | — |
| aws_ecs_security_group_name | ECS Security group name | no | — |
| aws_ecs_assign_public_ip | Assign public IP to node | no | — |
| aws_ecs_container_port | Comma separated list of container ports | no | — |
| aws_ecs_lb_port | Comma separated list of ports exposed by the load balancer | no | — |
| aws_ecs_lb_redirect_enable | Toggle redirect from HTTP and/or HTTPS to the main port. | no | — |
| aws_ecs_lb_container_path | Path for subsequent deployed images. eg. api. | no | — |
| aws_ecs_lb_ssl_policy | SSL Policy for HTTPS listener in ALB. Will default to ELBSecurityPolicy-TLS13-1-2-2021-06 if none provided. | no | — |
| aws_ecs_lb_www_to_apex_redirect | Toggle redirect from www to apex domain. aws_r53_domain_name must be set. | no | — |
| aws_ecs_autoscaling_enable | Toggle ecs autoscaling policy | no | — |
| aws_ecs_autoscaling_max_nodes | Max amount of nodes to scale up to. | no | — |
| aws_ecs_autoscaling_min_nodes | Min amount of nodes to scale down to. | no | — |
| aws_ecs_autoscaling_max_mem | Max amount of mem to scale up to. | no | — |
| aws_ecs_autoscaling_max_cpu | Max amount of cpu to scale up to. | no | — |
| aws_ecs_cloudwatch_enable | Toggle cloudwatch for ECS. Defaults to false | no | — |
| aws_ecs_cloudwatch_lg_name | Log group name. Will default to aws_identifier if none. | no | — |
| aws_ecs_cloudwatch_skip_destroy | Toggle deletion or not when destroying the stack. | no | — |
| aws_ecs_cloudwatch_retention_days | Number of days to retain logs. 0 to never expire. Default 14 | no | — |
| aws_ecs_efs_fs_id | ID of the EFS File System | no | — |
| aws_ecs_efs_root_directory | Directory within the FS to mount as the root directory. Defaults to /, ignored if access_point_id defined | no | — |
| aws_ecs_efs_transit_encryption | EFS Volume Transit Encryption. Defaults to true (ENABLED) | no | — |
| aws_ecs_efs_transit_encryption_port | EFS Volume Transit Encryption Port | no | — |
| aws_ecs_efs_access_point_id | EFS Volume Access Point ID to use | no | — |
| aws_ecs_efs_container_path | Directory path within container to mount the EFS volume to | no | — |
| aws_ecs_efs_readonly | Whether the EFS volume is mounted as read-only | no | — |
| aws_ecs_efs_iam | Whether or not to use the ECS task IAM role defined in a task definition when mounting the FS. Defaults to false. (DISABLED) | no | — |
| aws_ecs_additional_tags | A list of strings that will be added to created resources | no | — |
| env_aws_secret | Secret name to pull env variables from AWS Secret Manager | no | — |
| env_repo | File containing environment variables to be used with the app | no | — |
| env_ghs | `.env` file to be used with the app from Github secrets | no | — |
| env_ghv | `.env` file to be used with the app from Github variables | no | — |
| aws_waf_enable | Enable WAF for load balancer. | no | — |
| aws_waf_logging_enable | Enable WAF logging to CloudWatch. | no | — |
| aws_waf_log_retention_days | CloudWatch log retention period for WAF logs. | no | — |
| aws_waf_rule_rate_limit | Rate limit for WAF rules. | no | — |
| aws_waf_rule_rate_limit_priority | Priority for rate limit rule. | no | — |
| aws_waf_rule_managed_rules | Enable common managed rule groups to use. | no | — |
| aws_waf_rule_managed_rules_priority | Priority for managed rules group. | no | — |
| aws_waf_rule_managed_bad_inputs | Enable managed rule for bad inputs. | no | — |
| aws_waf_rule_managed_bad_inputs_priority | Priority for bad inputs managed rule. | no | — |
| aws_waf_rule_ip_reputation | Enable managed rule for IP reputation. | no | — |
| aws_waf_rule_ip_reputation_priority | Priority for IP reputation managed rule. | no | — |
| aws_waf_rule_anonymous_ip | Enable managed rule for anonymous IP. | no | — |
| aws_waf_rule_anonymous_ip_priority | Priority for anonymous IP managed rule. | no | — |
| aws_waf_rule_bot_control | Enable managed rule for bot control (costs extra). | no | — |
| aws_waf_rule_bot_control_priority | Priority for bot control managed rule. | no | — |
| aws_waf_rule_geo_block_countries | Comma separated list of countries to block. | no | — |
| aws_waf_rule_geo_block_countries_priority | Priority for geo block countries managed rule. | no | — |
| aws_waf_rule_geo_allow_only_countries | Comma separated list of countries to allow. | no | — |
| aws_waf_rule_geo_allow_only_countries_priority | Priority for geo allow only countries managed rule. | no | — |
| aws_waf_rule_sqli | Enable managed rule for SQL injection. | no | — |
| aws_waf_rule_sqli_priority | Priority for SQL injection managed rule. | no | — |
| aws_waf_rule_linux | Enable managed rule for Linux. | no | — |
| aws_waf_rule_linux_priority | Priority for Linux managed rule. | no | — |
| aws_waf_rule_unix | Enable managed rule for Unix. | no | — |
| aws_waf_rule_unix_priority | Priority for Unix managed rule. | no | — |
| aws_waf_rule_admin_protection | Enable managed rule for admin protection. | no | — |
| aws_waf_rule_admin_protection_priority | Priority for admin protection managed rule. | no | — |
| aws_waf_rule_user_arn | ARN of the user rule. | no | — |
| aws_waf_rule_user_arn_priority | Priority for user defined rule. | no | — |
| aws_waf_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_efs_create | Toggle to indicate whether to create an EFS volume as a part of the provisioning. Note: The EFS will be managed by the stack and will be destroyed along with the stack. | no | — |
| aws_efs_create_mount_target | Toggle to indicate whether we should create a mount target for the EFS volume. Accepts incoming FS ID with no mount targets too. | no | false |
| aws_efs_create_ha | Toggle to indicate whether the EFS resource should be highly available (mount points in all available zones within region). | no | — |
| aws_efs_vol_encrypted | Toggle encryption of the EFS volume. | no | — |
| aws_efs_kms_key_id | The ARN for the KMS encryption key. Default key will be used if none defined. | no | — |
| aws_efs_performance_mode | Toggle performance mode. Options are: generalPurpose or maxIO. | no | — |
| aws_efs_throughput_mode | Throughput mode for the file system. Defaults to bursting. Valid values: bursting, provisioned, or elastic. When using provisioned, also set provisioned_throughput_in_mibps. | no | — |
| aws_efs_throughput_speed | The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with throughput_mode set to provisioned. | no | — |
| aws_efs_security_group_name | The name of the EFS security group. Defaults to SG for aws_resource_identifier - EFS. | no | — |
| aws_efs_allowed_security_groups | Comma separated list of security groups to be added to the EFS SG. | no | — |
| aws_efs_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | false |
| aws_efs_create_replica | Toggle to indicate whether a read-only replica should be created for the EFS primary file system | no | — |
| aws_efs_replication_destination | AWS Region to target for replication | no | — |
| aws_efs_enable_backup_policy | Toggle to indicate whether the EFS should have a backup policy, default is `false` | no | — |
| aws_efs_transition_to_inactive | https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system#transition_to_ia | no | — |
| aws_efs_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_vpc_create | Define if a VPC should be created | no | — |
| aws_vpc_name | Set a specific name for the VPC | no | — |
| aws_vpc_cidr_block | Define Base CIDR block which is divided into subnet CIDR blocks. Defaults to 10.0.0.0/16. | no | — |
| aws_vpc_public_subnets | Comma separated list of public subnets. Defaults to 10.10.110.0/24 | no | — |
| aws_vpc_private_subnets | Comma separated list of private subnets. If none, none will be created. | no | — |
| aws_vpc_availability_zones | Comma separated list of availability zones. Defaults to `aws_default_region. | no | — |
| aws_vpc_id | AWS VPC ID. Accepts `vpc-###` values. | no | — |
| aws_vpc_subnet_id | Specify a Subnet to be used with the instance. If none provided, will pick one. | no | — |
| aws_vpc_enable_nat_gateway | Enables NAT gateway | no | — |
| aws_vpc_single_nat_gateway | Creates only one NAT gateway | no | — |
| aws_vpc_external_nat_ip_ids | Comma separated list of IP IDS to reuse in the NAT gateways | no | — |
| aws_vpc_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_r53_enable | Enables the usage of Route53 to manage DNS records. | no | — |
| aws_r53_domain_name | Define the root domain name for the application. e.g. app.com | no | — |
| aws_r53_sub_domain_name | Define the sub-domain part of the URL. Defaults to `${org}-${repo}-{branch}` | — | — |
| aws_r53_root_domain_deploy | Deploy to root domain. Will generate two DNS records, one for root, another for www | no | — |
| aws_r53_enable_cert | Makes the application use a certificate by enabling a certificate lookup. | no | — |
| aws_r53_cert_arn | Define the certificate ARN to use for the application | no | — |
| aws_r53_create_root_cert | Generates and manage the root cert for the application | no | — |
| aws_r53_create_sub_cert | Generates and manage the sub-domain certificate for the application | no | — |
| aws_r53_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
Outputs
| name | description |
|---|---|
| aws_vpc_id | The selected VPC ID used. |
| ecs_load_balancer_dns | ECS ALB DNS Record |
| ecs_dns_record | ECS DNS URL |
| ecs_sg_id | ECS SG ID |
| ecs_lb_sg_id | ECS LB SG ID |
| aws_efs_fs_id | EFS FS ID |
| aws_efs_replica_fs_id | EFS FS Replica ID |
| aws_efs_sg_id | EFS FS SG ID |