Cleanup tasks:

* Add conditions to hello-world ECS task exec policy to protect against confused deputy problem
* Remove name on target group and create_before_destroy to avoid issues when changing ports
* Renamespace Terraform resource name

terraform/ec2.tf

@@ -45,7 +45,8 @@ resource "aws_security_group_rule" "alb_egress_all" {
 # TODO: adopt "Encryption Everywhere" policy by protecting internal traffic
 #  between the ALB and the application service as well (#15)
 resource "aws_lb_target_group" "alb" {
-  name        = local.namespace
+  # name not specified as it creates conflicts when resource needs to be replaced. Depend
+  #  on tags to identify target groups in the console.
   port        = 80
   protocol    = "HTTP"
   target_type = "ip"
@@ -59,6 +60,11 @@ resource "aws_lb_target_group" "alb" {
   }
 
   vpc_id = aws_vpc.vpc.id
+
+  lifecycle {
+    # For if/when ports change
+    create_before_destroy = true
+  }
 }
 
 resource "aws_lb" "alb" {

terraform/ecs.tf

@@ -18,6 +18,16 @@ data "aws_iam_policy_document" "ecs_task_assume_role" {
       identifiers = ["ecs-tasks.amazonaws.com"]
       type        = "Service"
     }
+    condition {
+      test     = "ArnLike"
+      values   = ["arn:aws:ecs:${var.aws_region}:${local.account_id}:*"]
+      variable = "aws:SourceArn"
+    }
+    condition {
+      test     = "StringEquals"
+      values   = [local.account_id]
+      variable = "aws:SourceAccount"
+    }
   }
 }
 
@@ -27,7 +37,7 @@ resource "aws_iam_role" "ecs_task_execution" {
 }
 
 # Use the AWS-provided managed role for basic logging and ECR repository permissions
-resource "aws_iam_role_policy_attachment" "legacy_listener_aws_task_execution_role_policy" {
+resource "aws_iam_role_policy_attachment" "hello_world_aws_task_execution_role_policy" {
   role       = aws_iam_role.ecs_task_execution.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
 }