Terraform → ECS deploy evidence

Legacy / optional. The v1 ECS exporter is EventBridge → ECS. Keep this module only if apply-time emit is still required. It is not a v1 catalog source.

Drop-in Terraform module that emits platform-agnostic deploy.* Evidence Events when an AWS ECS service's task definition (or image digest) changes. Designed to sit next to your existing aws_ecs_service — not a custom provider.

Source: Evitrus/exporter → terraform-ecs/.

Prerequisites

• Terraform ≥ 1.4
• Tenant ingest API key (evt_live_…)
• curl and python3 on the apply runner
• An ECS service managed (at least in part) by Terraform

Usage

module "evitrus_ecs" {
  source = "git::https://github.com/Evitrus/exporter.git//terraform-ecs/modules/ecs-deploy-evidence?ref=main"

  api_key     = var.evitrus_api_key
  ingest_url  = "https://api.evitrus.dev/ingest"
  service     = "payments-api"
  environment = "prod"

  task_definition_arn = aws_ecs_service.app.task_definition
  cluster_arn         = aws_ecs_cluster.main.arn
  ecs_service_name    = aws_ecs_service.app.name

  image        = "123456789012.dkr.ecr.eu-central-1.amazonaws.com/payments-api:a1b2c3d"
  image_digest = "sha256:9f2b…"
  commit_sha   = var.git_sha
}

On apply, when the task definition ARN or digest changes, the module POSTs one deploy.succeeded event (override with event_type).

What it emits

Signal	Event type
Task definition / image digest change on apply	deploy.succeeded (default)

Same vocabulary as Kubernetes / Actions: deploy.started, deploy.progressed, deploy.succeeded, deploy.failed, deploy.rolled_back, deploy.blocked.

Correlation fields:

• service / environment / commitSha from module inputs
• Container image (+ digest) as artifact
• ECS ARNs in metadata only (source: terraform, tags include platform:ecs)

What it does not cover

• ECS rollouts outside Terraform (Console, CodeDeploy, autoscaling) — use EventBridge → ECS, or emit via the Ingest API
• Non-ECS AWS targets (Lambda, ASG) — intentionally out of scope for this module

Verify

After apply, open Changes for the service/environment, or query recent ingest via the tenant API. Failed emits fail the apply by default (fail_on_error = true).