Sync Develop with main

infrastructure/environments/dev/main.tf

@@ -216,7 +216,8 @@ module "ecs" {
   desired_count = 1
 
   # IAM - use the standalone application task role
-  task_role_arn = module.iam.task_role_arn
+  create_task_role = false
+  task_role_arn    = module.iam.task_role_arn
 
   # Environment and secrets
   environment_variables = local.environment_variables

infrastructure/environments/prod/main.tf

@@ -214,7 +214,8 @@ module "ecs" {
   desired_count = 2    # Multi-AZ
 
   # IAM - use the standalone application task role
-  task_role_arn = module.iam.task_role_arn
+  create_task_role = false
+  task_role_arn    = module.iam.task_role_arn
 
   # Environment and secrets
   environment_variables = local.environment_variables

infrastructure/modules/ecs/main.tf

@@ -1,4 +1,4 @@
 # =============================================================================
 # ECS Module
 # Creates ECS Fargate cluster, service, and task definition
 # =============================================================================
@@ -151,9 +151,9 @@
 }
 
 # Task Role (used by the application container)
-# Only created if no external task_role_arn is provided
+# Only created if create_task_role is true (no external role provided)
 resource "aws_iam_role" "ecs_task" {
-  count = var.task_role_arn == "" ? 1 : 0
+  count = var.create_task_role ? 1 : 0
   name  = "${var.project_name}-${var.environment}-ecs-task-role"
 
   assume_role_policy = jsonencode({
@@ -173,14 +173,13 @@
 }
 
 locals {
-  task_role_arn = var.task_role_arn != "" ? var.task_role_arn : aws_iam_role.ecs_task[0].arn
-  task_role_id  = var.task_role_arn != "" ? null : aws_iam_role.ecs_task[0].id
+  task_role_arn = var.create_task_role ? aws_iam_role.ecs_task[0].arn : var.task_role_arn
 }
 
 # Policy for AWS API access (EC2, RDS read-only)
 # Only created when no external task role is provided
 resource "aws_iam_role_policy" "ecs_task_aws_access" {
-  count = var.task_role_arn == "" ? 1 : 0
+  count = var.create_task_role ? 1 : 0
   name  = "aws-api-access"
   role  = aws_iam_role.ecs_task[0].id
 
@@ -222,7 +221,7 @@
 # scoped to the current AWS account rather than a single pre-configured bucket.
 # Only created when no external task role is provided.
 resource "aws_iam_role_policy" "ecs_task_s3_access" {
-  count = var.task_role_arn == "" ? 1 : 0
+  count = var.create_task_role ? 1 : 0
   name  = "s3-terraform-state-access"
   role  = aws_iam_role.ecs_task[0].id
 
@@ -410,7 +409,7 @@
   }
 }
 
 resource "aws_appautoscaling_policy" "memory" {
   count = var.enable_autoscaling ? 1 : 0
 
   name               = "${var.project_name}-${var.environment}-memory-scaling"

infrastructure/modules/ecs/variables.tf

@@ -200,9 +200,15 @@ variable "memory_target_value" {
 # -----------------------------------------------------------------------------
 
 variable "task_role_arn" {
-  description = "ARN of an external task role. If provided, the module will use it instead of creating its own task role with AWS API policies."
+  description = "ARN of an external task role. When create_task_role is false, this role is used for the ECS task definition."
   type        = string
-  default     = ""
+  default     = null
+}
+
+variable "create_task_role" {
+  description = "Whether to create a task role inside this module. Set to false when providing an external task_role_arn."
+  type        = bool
+  default     = true
 }
 
 # -----------------------------------------------------------------------------