Provisioning Java Spring Boot App Infrastructure with Terraform

Provisioning production infrastructure for a Spring Boot application with Terraform means declaring the compute, database, networking, and load balancing resources that the application needs, then managing them as versioned, reviewable code.

Compute and networking

• For ECS Fargate: declare a aws_ecs_cluster, aws_ecs_task_definition (with CPU, memory, container image, environment variables, and log driver configuration), and aws_ecs_service (with desired count, load balancer attachment, and network configuration referencing the VPC and private subnets)
• The task definition references the ECR repository URL for the container image — aws_ecr_repository.payment_service.repository_url creates a dependency between the repository and the task definition; Terraform creates the ECR repository before the task definition
• Use private subnets for the ECS tasks and public subnets only for the ALB — the tasks should not be directly reachable from the internet; traffic enters through the ALB, which terminates HTTPS and forwards to tasks on port 8080

Database

• aws_db_instance declares an RDS instance with engine, instance_class, allocated_storage, db_name, username, and password; the password should come from AWS Secrets Manager or be a sensitive variable — never hardcoded in the HCL
• The RDS instance goes in a separate security group that only accepts connections from the ECS task's security group — aws_security_group_rule "allow_from_ecs" with source_security_group_id = aws_security_group.ecs_tasks.id enforces this at the network layer
• Use aws_db_subnet_group with private subnets and publicly_accessible = false — the database should be unreachable from outside the VPC under any circumstances

Spring Boot environment variables

• Pass database URL and credentials to the ECS task via AWS Secrets Manager references in the task definition — valueFrom = aws_secretsmanager_secret_version.db_password.arn injects the secret value at task startup without hardcoding it in the task definition or state file
• Terraform outputs the ALB DNS name and RDS endpoint so application configuration (DNS records, other Terraform configurations) can reference them without hardcoding: output "alb_dns" { value = aws_lb.main.dns_name }