Skip to content

Commit fdf8e38

Browse files
author
rahul-infra
committed
Updated readme for same account and cross account examplefile.
1 parent f30f19b commit fdf8e38

File tree

3 files changed

+16
-0
lines changed

3 files changed

+16
-0
lines changed

README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22
# terraform-aws-ecs-deployment
33

44
Terraform module to deploy production-ready applications and services on an existing ECS infra.
5+
This module supports both same-account and cross-account ACM → Route53 validation workflows. For same-account usage, simply map the providers as providers = { aws = aws, aws.cross_account_provider = aws } without any assume role.
6+
For cross-account setups, you must have an IAM Role in the Route53 Hosted Zone account (Account B) that allows Account A (where ACM and application resources are created) to assume it. This role should grant permissions such as route53:ChangeResourceRecordSets, route53:ListHostedZonesByName, and route53:ListResourceRecordSets, along with a trust policy that permits Account A to assume the role.
7+
When using cross-account mode, configure an alias provider with assume_role and pass it to the module as:
8+
providers = { aws = aws, aws.cross_account_provider = aws.cross_account_provider }.
59

610
## Architecture Diagram
711

examples/cross-account/README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,20 @@
11
<!-- BEGIN_TF_DOCS -->
22
# ECS Deployment Complete
33

4+
5+
46
Configuration in this directory creates:
57

68
- ECS Service in a pre-configured ECS Cluster and corresponding ECS Capacity Providers
79
- Internet-facing Application Load Balancer to access the deployed services with S3 bucket for storing access and connection logs, and
810
- ACM to generate and validate an Amazon-issued certificate for a base domain
911

1012

13+
For cross-account Route53 validation, configure the alias provider with assume_role and pass it to the module as:
14+
providers = { aws = aws, aws.cross_account_provider = aws.cross_account_provider }.
15+
Ensure the cross_account_provider includes the assume_role block pointing to the Route53 account role.
16+
provider "aws" { alias = "cross_account_provider" ... assume_role { role_arn = "<role>" } }
17+
1118
## Prerequisites
1219

1320
**Create an IAM Role in the Hosted Zone Account (Account B)**

examples/same-account/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ Configuration in this directory creates:
77
- Internet-facing Application Load Balancer to access the deployed services with S3 bucket for storing access and connection logs, and
88
- ACM to generate and validate an Amazon-issued certificate for a base domain
99

10+
11+
For same-account Route53 validation, map the alias provider to the main provider as:
12+
providers = { aws = aws, aws.cross_account_provider = aws }.
13+
No assume_role block is required in same-account mode.
14+
1015
## Example `tfvars` Configuration
1116

1217
```tf

0 commit comments

Comments
 (0)