Update Health check

[dylanratcliffe]

No description provided.

[github-actions]

Risks

Potential Service Disruption Due to Health Check Port Mismatch [High]

The ECS task definition for the 'facial-recognition-terraform-example' service has updated its health check command to use port 8080, while the container port mapping remains on port 1234. This discrepancy can lead to the health check failing, causing tasks to be marked as unhealthy and potentially replaced. Furthermore, the ELB target group is set to route traffic on port 1234, which does not align with the new health check configuration, potentially disrupting load balancing and traffic routing.

To mitigate these risks, it's crucial to ensure the container application listens on port 8080 and update the ELB target group to align with the new health check settings.

Validation Steps:

1. Confirm that the application inside the container is configured to listen on port 8080.
2. Ensure that all security groups and network ACLs allow traffic on port 8080.
3. Update the ELB target group to route traffic on port 8080 to match the new health check configuration.
4. Test the health check command locally within the same network environment to ensure it returns a successful response. Open Risk

Expected Changes

ecs-task-definition › facial-recognition-terraform-example

--- current
+++ planned
@@ -1,27 +1,27 @@
-arn: arn:aws:ecs:eu-west-2:540044833068:task-definition/facial-recognition-terraform-example:7
-arn_without_revision: arn:aws:ecs:eu-west-2:540044833068:task-definition/facial-recognition-terraform-example
-container_definitions: '[{"cpu":1024,"environment":[{"name":"DATABASE_URL","value":"tf-20240827194315707700000013.cnx7xf6hwmba.eu-west-2.rds.amazonaws.com"}],"essential":true,"healthCheck":{"command":["CMD-SHELL","wget -q --spider localhost:1234"],"interval":30,"retries":3,"timeout":5},"image":"harshmanvar/face-detection-tensorjs:slim-amd","memory":2048,"mountPoints":[],"name":"facial-recognition","portMappings":[{"appProtocol":"http","containerPort":1234,"hostPort":1234,"protocol":"tcp"}],"systemControls":[],"volumesFrom":[]}]'
+arn: (known after apply)
+arn_without_revision: (known after apply)
+container_definitions: '[{"cpu":1024,"environment":[{"name":"DATABASE_URL","value":"tf-20240827194315707700000013.cnx7xf6hwmba.eu-west-2.rds.amazonaws.com"}],"essential":true,"healthCheck":{"command":["CMD-SHELL","wget -q --spider localhost:8080"],"interval":30,"retries":3,"timeout":5},"image":"harshmanvar/face-detection-tensorjs:slim-amd","memory":2048,"mountPoints":[],"name":"facial-recognition","portMappings":[{"appProtocol":"http","containerPort":1234}],"volumesFrom":[]}]'
 cpu: "1024"
-enable_fault_injection: false
+enable_fault_injection: (known after apply)
 ephemeral_storage: []
-execution_role_arn: ""
+execution_role_arn: null
 family: facial-recognition-terraform-example
-id: facial-recognition-terraform-example
+id: (known after apply)
 inference_accelerator: []
-ipc_mode: ""
+ipc_mode: null
 memory: "2048"
 network_mode: awsvpc
-pid_mode: ""
+pid_mode: null
 placement_constraints: []
 proxy_configuration: []
 requires_compatibilities:
     - FARGATE
-revision: 7
+revision: (known after apply)
 runtime_platform: []
 skip_destroy: false
-tags: {}
-tags_all: {}
-task_role_arn: ""
+tags: null
+tags_all: (known after apply)
+task_role_arn: null
 terraform_address: module.scenarios[0].aws_ecs_task_definition.face
 terraform_name: module.scenarios[0].aws_ecs_task_definition.face
 track_latest: false

ec2-instance › i-0b87d583d65ba5d35

--- current
+++ planned
@@ -1,91 +1,64 @@
-ami: ami-08ce32fd876ad5a89
-arn: arn:aws:ec2:eu-west-2:540044833068:instance/i-0b87d583d65ba5d35
+ami: ami-0772e16812cdb1d83
+arn: (known after apply)
 associate_public_ip_address: true
-availability_zone: eu-west-2b
-capacity_reservation_specification:
-    - capacity_reservation_preference: open
-      capacity_reservation_target: []
-cpu_core_count: 1
-cpu_options:
-    - amd_sev_snp: ""
-      core_count: 1
-      threads_per_core: 2
-cpu_threads_per_core: 2
-credit_specification:
-    - cpu_credits: unlimited
-disable_api_stop: false
-disable_api_termination: false
-ebs_block_device: []
-ebs_optimized: false
-enable_primary_ipv6: null
-enclave_options:
-    - enabled: false
-ephemeral_block_device: []
+availability_zone: (known after apply)
+capacity_reservation_specification: (known after apply)
+cpu_core_count: (known after apply)
+cpu_options: (known after apply)
+cpu_threads_per_core: (known after apply)
+credit_specification: []
+disable_api_stop: (known after apply)
+disable_api_termination: (known after apply)
+ebs_block_device: (known after apply)
+ebs_optimized: (known after apply)
+enable_primary_ipv6: (known after apply)
+enclave_options: (known after apply)
+ephemeral_block_device: (known after apply)
 get_password_data: false
-hibernation: false
-host_id: ""
-host_resource_group_arn: null
-iam_instance_profile: ""
-id: i-0b87d583d65ba5d35
-instance_initiated_shutdown_behavior: stop
-instance_lifecycle: ""
-instance_market_options: []
-instance_state: running
+hibernation: null
+host_id: (known after apply)
+host_resource_group_arn: (known after apply)
+iam_instance_profile: (known after apply)
+id: (known after apply)
+instance_initiated_shutdown_behavior: (known after apply)
+instance_lifecycle: (known after apply)
+instance_market_options: (known after apply)
+instance_state: (known after apply)
 instance_type: t3.micro
-ipv6_address_count: 0
-ipv6_addresses: []
+ipv6_address_count: (known after apply)
+ipv6_addresses: (known after apply)
 key_name: Demo Key Pair
 launch_template: []
-maintenance_options:
-    - auto_recovery: default
-metadata_options:
-    - http_endpoint: enabled
-      http_protocol_ipv6: disabled
-      http_put_response_hop_limit: 1
-      http_tokens: optional
-      instance_metadata_tags: disabled
-monitoring: false
-network_interface: []
-outpost_arn: ""
-password_data: ""
-placement_group: ""
-placement_partition_number: 0
-primary_network_interface_id: eni-0fb95e80ee4485992
-private_dns: ip-10-0-10-187.eu-west-2.compute.internal
-private_dns_name_options:
-    - enable_resource_name_dns_a_record: false
-      enable_resource_name_dns_aaaa_record: false
-      hostname_type: ip-name
-private_ip: 10.0.10.187
-public_dns: ec2-18-134-209-150.eu-west-2.compute.amazonaws.com
-public_ip: 18.134.209.150
-root_block_device:
-    - delete_on_termination: true
-      device_name: /dev/xvda
-      encrypted: false
-      iops: 0
-      kms_key_id: ""
-      tags: {}
-      tags_all: {}
-      throughput: 0
-      volume_id: vol-0dcba3872a097a866
-      volume_size: 8
-      volume_type: standard
-secondary_private_ips: []
-security_groups: []
+maintenance_options: (known after apply)
+metadata_options: (known after apply)
+monitoring: (known after apply)
+network_interface: (known after apply)
+outpost_arn: (known after apply)
+password_data: (known after apply)
+placement_group: (known after apply)
+placement_partition_number: (known after apply)
+primary_network_interface_id: (known after apply)
+private_dns: (known after apply)
+private_dns_name_options: (known after apply)
+private_ip: (known after apply)
+public_dns: (known after apply)
+public_ip: (known after apply)
+root_block_device: (known after apply)
+secondary_private_ips: (known after apply)
+security_groups: (known after apply)
 source_dest_check: true
-spot_instance_request_id: ""
+spot_instance_request_id: (known after apply)
 subnet_id: subnet-036704734045071f9
 tags:
     Name: App Server
 tags_all:
     Name: App Server
-tenancy: default
+tenancy: (known after apply)
 terraform_address: module.scenarios[0].aws_instance.app_server
 terraform_name: module.scenarios[0].aws_instance.app_server
 timeouts: null
-user_data: null
-user_data_base64: null
+user_data: (known after apply)
+user_data_base64: (known after apply)
 user_data_replace_on_change: false
 volume_tags: null
 vpc_security_group_ids:

ec2-instance › i-05ce754d6bb8dcfd0

--- current
+++ planned
@@ -1,91 +1,64 @@
-ami: ami-08ce32fd876ad5a89
-arn: arn:aws:ec2:eu-west-2:540044833068:instance/i-05ce754d6bb8dcfd0
+ami: ami-0772e16812cdb1d83
+arn: (known after apply)
 associate_public_ip_address: true
-availability_zone: eu-west-2a
-capacity_reservation_specification:
-    - capacity_reservation_preference: open
-      capacity_reservation_target: []
-cpu_core_count: 1
-cpu_options:
-    - amd_sev_snp: ""
-      core_count: 1
-      threads_per_core: 2
-cpu_threads_per_core: 2
-credit_specification:
-    - cpu_credits: unlimited
-disable_api_stop: false
-disable_api_termination: false
-ebs_block_device: []
-ebs_optimized: false
-enable_primary_ipv6: null
-enclave_options:
-    - enabled: false
-ephemeral_block_device: []
+availability_zone: (known after apply)
+capacity_reservation_specification: (known after apply)
+cpu_core_count: (known after apply)
+cpu_options: (known after apply)
+cpu_threads_per_core: (known after apply)
+credit_specification: []
+disable_api_stop: (known after apply)
+disable_api_termination: (known after apply)
+ebs_block_device: (known after apply)
+ebs_optimized: (known after apply)
+enable_primary_ipv6: (known after apply)
+enclave_options: (known after apply)
+ephemeral_block_device: (known after apply)
 get_password_data: false
-hibernation: false
-host_id: ""
-host_resource_group_arn: null
-iam_instance_profile: ""
-id: i-05ce754d6bb8dcfd0
-instance_initiated_shutdown_behavior: stop
-instance_lifecycle: ""
-instance_market_options: []
-instance_state: running
+hibernation: null
+host_id: (known after apply)
+host_resource_group_arn: (known after apply)
+iam_instance_profile: (known after apply)
+id: (known after apply)
+instance_initiated_shutdown_behavior: (known after apply)
+instance_lifecycle: (known after apply)
+instance_market_options: (known after apply)
+instance_state: (known after apply)
 instance_type: t3.micro
-ipv6_address_count: 0
-ipv6_addresses: []
+ipv6_address_count: (known after apply)
+ipv6_addresses: (known after apply)
 key_name: Demo Key Pair
 launch_template: []
-maintenance_options:
-    - auto_recovery: default
-metadata_options:
-    - http_endpoint: enabled
-      http_protocol_ipv6: disabled
-      http_put_response_hop_limit: 1
-      http_tokens: optional
-      instance_metadata_tags: disabled
-monitoring: false
-network_interface: []
-outpost_arn: ""
-password_data: ""
-placement_group: ""
-placement_partition_number: 0
-primary_network_interface_id: eni-0f251e56209ba9f38
-private_dns: ip-10-0-9-201.eu-west-2.compute.internal
-private_dns_name_options:
-    - enable_resource_name_dns_a_record: false
-      enable_resource_name_dns_aaaa_record: false
-      hostname_type: ip-name
-private_ip: 10.0.9.201
-public_dns: ec2-18-170-78-77.eu-west-2.compute.amazonaws.com
-public_ip: 18.170.78.77
-root_block_device:
-    - delete_on_termination: true
-      device_name: /dev/xvda
-      encrypted: false
-      iops: 0
-      kms_key_id: ""
-      tags: {}
-      tags_all: {}
-      throughput: 0
-      volume_id: vol-009fbdc3b1a4d5eb6
-      volume_size: 8
-      volume_type: standard
-secondary_private_ips: []
-security_groups: []
+maintenance_options: (known after apply)
+metadata_options: (known after apply)
+monitoring: (known after apply)
+network_interface: (known after apply)
+outpost_arn: (known after apply)
+password_data: (known after apply)
+placement_group: (known after apply)
+placement_partition_number: (known after apply)
+primary_network_interface_id: (known after apply)
+private_dns: (known after apply)
+private_dns_name_options: (known after apply)
+private_ip: (known after apply)
+public_dns: (known after apply)
+public_ip: (known after apply)
+root_block_device: (known after apply)
+secondary_private_ips: (known after apply)
+security_groups: (known after apply)
 source_dest_check: true
-spot_instance_request_id: ""
+spot_instance_request_id: (known after apply)
 subnet_id: subnet-06302fc5a50644cd9
 tags:
     Name: Webserver
 tags_all:
     Name: Webserver
-tenancy: default
+tenancy: (known after apply)
 terraform_address: module.scenarios[0].aws_instance.webserver
 terraform_name: module.scenarios[0].aws_instance.webserver
 timeouts: null
-user_data: null
-user_data_base64: null
+user_data: (known after apply)
+user_data_base64: (known after apply)
 user_data_replace_on_change: false
 volume_tags: null
 vpc_security_group_ids:

ec2-launch-template › lt-0731f767e6be2ab94

--- current
+++ planned
@@ -14,14 +14,14 @@
 hibernation_options: []
 iam_instance_profile: []
 id: lt-0731f767e6be2ab94
-image_id: ami-08ce32fd876ad5a89
+image_id: ami-0772e16812cdb1d83
 instance_initiated_shutdown_behavior: ""
 instance_market_options: []
 instance_requirements: []
 instance_type: t3.micro
 kernel_id: ""
 key_name: ""
-latest_version: 11
+latest_version: (known after apply)
 license_specification: []
 maintenance_options: []
 metadata_options: []

Unmapped Changes

Note

These changes couldn't be mapped to a discoverable cloud resource and therefore won't be included in the blast radius calculation.

aws_ecs_service › module.scenarios[0].aws_ecs_service.face

--- current
+++ planned
@@ -43,7 +43,7 @@
 service_registries: []
 tags: {}
 tags_all: {}
-task_definition: arn:aws:ecs:eu-west-2:540044833068:task-definition/facial-recognition-terraform-example:7
+task_definition: (known after apply)
 terraform_address: module.scenarios[0].aws_ecs_service.face
 terraform_name: module.scenarios[0].aws_ecs_service.face
 timeouts: null

Blast Radius

Items	Edges
43	64

Open Blast Radius