volcengin-ecs

name

volcengin-ecs

description

Discover existing Volcengine network resources and provision, initialize, review, or migrate a secure ECS host with parameterized Terraform. Use when Codex needs to list or reuse VPCs, subnets, and security groups; create a Volcengine virtual machine with optional network/security-group/EIP resources; bootstrap an ECS instance with cloud-init; configure private-only access or a local SOCKS5 tunnel; remove hard-coded infrastructure values; or audit an ECS deployment for credential and network exposure.

Volcengine ECS

Create one independently managed ECS host from the bundled Terraform template. Keep credentials out of files and Terraform state, restrict ingress, and use cloud-init exactly once.

Workflow

1. Inspect the destination and preserve existing user files. Scaffold only into a new or empty directory:

python3 scripts/scaffold.py /absolute/path/to/ecs-infrastructure

2. Decide whether to create or reuse the VPC, subnet, and security groups. Obtain these non-secret inputs before planning:
   • region and availability zone
   • image ID and instance type
   • existing Volcengine key-pair name
   • new-security-group SSH CIDRs, or existing security group IDs
   • desired system disk, optional data disk/mount point, EIP, and bootstrap package settings
3. Create the SSH key locally if necessary. Import only the .pub key into Volcengine and keep the private key outside the project. Never upload, copy, print, or commit a private key.
4. Copy terraform.tfvars.example to terraform.tfvars and replace every placeholder. Do not add AK/SK, passwords, tokens, or private-key contents.
5. Read credentials only from the process environment:

export TF_VAR_volcengine_access_key="..."
export TF_VAR_volcengine_secret_key="..."

The corresponding Terraform variables are both sensitive and ephemeral, so their values are omitted from plans and state. Never put credential values in a prompt, command argument, .tfvars, backend file, Terraform output, log, or response. Disable shell tracing before credential setup. If a credential has appeared in source control or chat, require rotation before use. 6. When reusing infrastructure, discover candidates with read-only data sources. First list VPCs, then narrow subnets and security groups by the confirmed VPC ID:

python3 scripts/discover_resources.py --region REGION
python3 scripts/discover_resources.py \
  --region REGION \
  --vpc-id VPC_ID \
  --zone-id AVAILABILITY_ZONE

Never select a candidate silently when multiple resources match. Present names, IDs, CIDRs/zones, and status; obtain the user's choice; then write the chosen IDs to terraform.tfvars. Discovery uses a temporary data-only Terraform plan and creates no cloud resources. 7. Use local state by default. For a TOS S3-compatible backend, copy backend.tf.example to backend.tf, copy backend.hcl.example to backend.hcl, and set backend credentials through AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY; never add credentials to backend.hcl. 8. Run the static preflight before Terraform:

python3 scripts/preflight.py /absolute/path/to/ecs-infrastructure

9. Format, initialize, validate, and save a reviewable plan:

terraform -chdir=/absolute/path/to/ecs-infrastructure fmt -recursive
terraform -chdir=/absolute/path/to/ecs-infrastructure init
terraform -chdir=/absolute/path/to/ecs-infrastructure validate
terraform -chdir=/absolute/path/to/ecs-infrastructure plan -out=ecs.tfplan
terraform -chdir=/absolute/path/to/ecs-infrastructure show ecs.tfplan

When using the remote backend, initialize with terraform init -backend-config=backend.hcl.

10. Inspect the plan for unexpected replacements, broad ingress, public IP creation, and cost-bearing resources. When reusing infrastructure, verify that the plan creates no VPC, subnet, security group, security-group rule, or EIP. Run terraform apply ecs.tfplan only when the user explicitly requested provisioning and has accepted the reviewed plan. Never run destroy without an explicit request.
11. Verify cloud-init without exposing data:

ssh -i /absolute/path/to/private-key root@PUBLIC_IP \
  'sudo test -f /var/lib/volcengin-ecs/initialized && sudo cloud-init status --wait'

Secure bastion and SOCKS5 access

Do not install a password-authenticated proxy or expose port 1080. Create a local-only SOCKS5 listener over SSH:

ssh -i /absolute/path/to/private-key \
  -o ExitOnForwardFailure=yes \
  -N -D 127.0.0.1:1080 root@PUBLIC_IP

Point local clients at socks5://127.0.0.1:1080. This keeps authentication on the SSH key and leaves only TCP/22 exposed to the explicitly allowed CIDRs.

Required security invariants

• Reject 0.0.0.0/0 and ::/0 for SSH ingress. Require the user's current trusted /32 or a controlled corporate CIDR.
• Keep AK/SK exclusively in TF_VAR_volcengine_access_key and TF_VAR_volcengine_secret_key. Preserve the template's Terraform 1.10+ ephemeral and sensitive declarations so provider credentials stay out of plans and state.
• Keep backend credentials out of backend configuration and CLI flags.
• Use user_data as the only bootstrap path. Do not add a second SSH remote-exec copy of the same initialization script.
• Pin the provider version and commit .terraform.lock.hcl after initialization.
• Treat Terraform state as sensitive even though this template stores no credentials.
• Download no executable during bootstrap without an HTTPS source and checksum verification. Prefer a pre-baked image for organization-specific agents.
• Parameterize deploy-specific values. Do not place account IDs, IP allowlists, regions, zones, image IDs, instance types, key-pair names, passwords, or endpoints directly in active resources.
• Prefer an existing VPC when integrating with an established environment. Confirm CIDR overlap before creating a new network.
• Attach reused security groups unchanged. Verify their current ingress and egress rules before apply; do not assume that selecting a group grants SSH or outbound access.
• Format a data disk only when the user explicitly requests a mount point and the instance exposes exactly one blank, unpartitioned, non-root disk. Refuse ambiguous disk layouts.

Template behavior

The template creates an ECS instance; optionally creates its VPC/subnet, security group/SSH rule, EIP, and one data disk; or reuses supplied VPC, subnet, and security group IDs without modifying them. It validates that reused security groups belong to the selected VPC, disables SSH password authentication, safely formats and mounts a uniquely identifiable blank data disk when requested, optionally installs validated package names, and writes an initialization marker. It does not create or import a key pair, store secrets, expose a proxy port, or manage unrelated VKE/database resources.

Edit the generated Terraform only when the requested behavior is outside these capabilities. Preserve the security invariants when extending it.