We're getting application errors rather than networking errors and that's great

Author: acme-cms-challenge

infrastructure/nonprod/etl/main.tf

@@ -39,10 +39,12 @@ resource "aws_iam_policy" "dagster_can_access_etl_database_secret" {
     Version = "2012-10-17"
     Statement = [
       {
-        Action = "secretsmanager:GetSecretValue",
+        # Action = "secretsmanager:GetSecretValue",
+        Action = "secretsmanager:*",
         Effect = "Allow"
         Resource = [
-          var.db.db_instance_master_user_secret_arn
+          # var.db.db_instance_master_user_secret_arn
+          "*"
         ]
       }
     ]
@@ -66,12 +68,18 @@ resource "aws_iam_policy" "dagster_can_emit_logs" {
           "logs:PutLogsEvents"
         ]
         Effect   = "Allow"
-        Resource = "arn:${data.aws_partition.current.partition}:logs:*:${data.aws_caller_identity.current.account_id}:log-group:/ecs/${var.account_name}*:*"
+        # Resource = "arn:${data.aws_partition.current.partition}:logs:*:${data.aws_caller_identity.current.account_id}:log-group:/ecs/${var.account_name}-dagster-ui-logs"
+        Resource = "*"
       }
     ]
   })
 }
 
+resource "aws_iam_role_policy_attachment" "dagster_can_emit_logs_attachment" {
+  role       = aws_iam_role.dagster_execution_role.name
+  policy_arn = aws_iam_policy.dagster_can_emit_logs.arn
+}
+
 resource "aws_iam_role" "dagster_task_role" {
   name = "${var.account_name}-etl-service-task-role"
   description = "Describes actions the ETL tasks can make"
@@ -102,9 +110,9 @@ resource "aws_ecs_task_definition" "dagster_daemon" {
       logConfiguration = {
         logDriver = "awslogs"
         options = {
-          "awslogs-group"         = "/ecs/${var.account_name}-dagster-daemon-logs"
+          "awslogs-group"         = "/ecs/${var.account_name}"
           "awslogs-region"        = data.aws_region.current.name
-          "awslogs-stream-prefix" = "${var.account_name}-dagster-daemon-logs"
+          "awslogs-stream-prefix" = var.account_name
         }
       }
       command = ["dagster-daemon", "run", "-w", "${local.dagster_home}/workspace.yaml"]
@@ -116,7 +124,7 @@ resource "aws_ecs_task_definition" "dagster_daemon" {
       secrets = [
         {
           name = "DAGSTER_POSTGRES_USER",
-          valueFrom = "${var.db.db_instance_master_user_secret_arn}:user::"
+          valueFrom = "${var.db.db_instance_master_user_secret_arn}:username::"
         },
         {
           name      = "DAGSTER_POSTGRES_PASSWORD",
@@ -133,6 +141,7 @@ resource "aws_ecs_service" "dagster_daemon" {
   desired_count   = 1
   launch_type     = "FARGATE"
   task_definition = aws_ecs_task_definition.dagster_daemon.arn
+  enable_execute_command = true
 
   network_configuration {
     subnets         = var.networking.etl_subnet_ids
@@ -159,9 +168,9 @@ resource "aws_ecs_task_definition" "dagster_ui" {
       logConfiguration = {
         logDriver = "awslogs"
         options = {
-          "awslogs-group"         = "/ecs/${var.account_name}-dagster-ui-logs"
+          "awslogs-group"         = "/ecs/${var.account_name}"
           "awslogs-region"        = data.aws_region.current.name
-          "awslogs-stream-prefix" = "${var.account_name}-dagster-ui-logs"
+          "awslogs-stream-prefix" = var.account_name
         }
       }
       portMappings = [
@@ -181,7 +190,7 @@ resource "aws_ecs_task_definition" "dagster_ui" {
       secrets = [
         {
           name = "DAGSTER_POSTGRES_USER",
-          valueFrom = "${var.db.db_instance_master_user_secret_arn}:user::"
+          valueFrom = "${var.db.db_instance_master_user_secret_arn}:username::"
         },
         {
           name      = "DAGSTER_POSTGRES_PASSWORD",
@@ -198,6 +207,7 @@ resource "aws_ecs_service" "dagster-ui" {
   desired_count   = 1
   launch_type     = "FARGATE"
   task_definition = aws_ecs_task_definition.dagster_ui.arn
+  enable_execute_command = true
 
   network_configuration {
     subnets         = var.networking.etl_subnet_ids

infrastructure/nonprod/networking/main.tf

@@ -174,9 +174,9 @@ resource "aws_vpc_security_group_ingress_rule" "etl_sg_allow_grpc" {
 resource "aws_vpc_security_group_egress_rule" "etl_sg_allow_outbound_requests" {
   description       = "Allows containers within the security group to make outbound (HTTP, PG, etc) requests"
   security_group_id = aws_security_group.fhir_etl_sg.id
-  ip_protocol       = "tcp"
-  from_port         = 0
-  to_port           = 0
+  ip_protocol       = -1
+  from_port         = -1
+  to_port           = -1
   cidr_ipv4         = "0.0.0.0/0" # any external IP
 }
 
@@ -205,7 +205,7 @@ resource "aws_instance" "jumpbox" {
   instance_type = "t2.micro"
   key_name      = aws_key_pair.jumpbox_key.key_name
   subnet_id     = "subnet-0f0b5004f3280c894" # npd-east-dev-private-subnet-c
-  vpc_security_group_ids = [aws_security_group.jumpbox.id]
+  vpc_security_group_ids = ["sg-08ba74ed28ed4353c"]
 
   tags = {
     Name = "Jumpbox"