[ale210]

Part 2 of 3 for #201: switches vrms-frontend-dev alone to its own execution role, ecs-execution-vrms-frontend-dev, which #238 created.

Expected plan: the vrms-frontend-dev task definition is replaced and its service updated in place. Nothing else changes.

Before this, all 10 new roles were checked with the IAM policy simulator. ECR and SSM are allowed for the role's own project only; logs are allowed for its own log group only. The simulator can't evaluate log ARNs whose group name contains /, so this canary is what proves the logs permission.

After apply:

• The service is running 1/1 on the new task definition revision.
• The target group reports the task healthy.
• A fresh log stream appears in /ecs/vrms-frontend-dev.
• No stopped-task reason shows ResourceInitializationError.

Refs #201

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 1 to add, 1 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.vrms.module.frontend_dev_service.aws_ecs_service.fargate[0] will be updated in-place
!~  resource "aws_ecs_service" "fargate" {
        id                                 = "arn:aws:ecs:us-west-2:035866691871:service/incubator-prod/vrms-frontend-dev"
        name                               = "vrms-frontend-dev"
        tags                               = {
            "project" = "vrms"
        }
!~      task_definition                    = "arn:aws:ecs:us-west-2:035866691871:task-definition/vrms-frontend-dev:8" -> (known after apply)
#        (18 unchanged attributes hidden)

#        (7 unchanged blocks hidden)
    }

  # module.vrms.module.frontend_dev_service.aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
!~      arn                      = "arn:aws:ecs:us-west-2:035866691871:task-definition/vrms-frontend-dev:8" -> (known after apply)
!~      arn_without_revision     = "arn:aws:ecs:us-west-2:035866691871:task-definition/vrms-frontend-dev" -> (known after apply)
!~      container_definitions    = jsonencode(
!~          [
!~              {
-                   mountPoints            = []
                    name                   = "vrms-frontend-dev"
!~                  portMappings           = [
!~                      {
-                           protocol      = "tcp"
#                            (2 unchanged attributes hidden)
                        },
                    ]
-                   systemControls         = []
-                   volumesFrom            = []
#                    (8 unchanged attributes hidden)
                },
            ]
        )
!~      enable_fault_injection   = false -> (known after apply)
!~      execution_role_arn       = "arn:aws:iam::035866691871:role/incubator-prod-ecs-task-role" -> "arn:aws:iam::035866691871:role/ecs-execution-vrms-frontend-dev" # forces replacement
!~      id                       = "*****************" -> (known after apply)
!~      revision                 = 8 -> (known after apply)
        tags                     = {
            "project" = "vrms"
        }
#        (12 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

✅ Plan applied in Terraform apply (OIDC) #91