Managed domains

[siddhsuresh]

Greptile Summary

This PR introduces Ravion-managed domains across ECS clusters, ECS services, and static sites.

• Moves cluster HTTPS listeners into the ECS cluster module and supports managed wildcard certificates.
• Adds automatic and custom domain routing for ECS services.
• Adds managed certificate and custom-domain integration for static sites.
• Extends the ALB module to support parent-owned HTTPS listeners and forced HTTP redirects.

Confidence Score: 3/5

The PR is not yet safe to merge because the incomplete private IPv6 state migration can interrupt HTTPS traffic during upgrades.

Existing managed-domain clusters can still recreate the renamed private IPv6 ingress rule because its moved block is absent, and ECS service custom domains still allow nullable ALB routing targets to reach the provider without clear validation.

Files Needing Attention: compute/ecs_cluster/listeners.tf; compute/ecs_service/ravion_domains.tf

Important Files Changed

Filename	Overview
compute/ecs_cluster/listeners.tf	Centralizes public and private HTTPS listeners and ingress rules, but the previously reported private IPv6 state migration remains incomplete.
compute/ecs_cluster/ravion_domains.tf	Creates the shared managed wildcard certificate and points its DNS target at the selected cluster ALB.
compute/ecs_service/ravion_domains.tf	Adds service certificates and domain records, while the previously reported validation gap for custom-domain ALB targets remains.
hosting/static_site/ravion_domains.tf	Adds managed certificates and custom-domain records targeting the static site's CloudFront distribution.
networking/alb/listeners.tf	Supports HTTP-to-HTTPS redirects when the HTTPS listener is owned by a parent module.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Cluster["ECS cluster"] --> Cert["Ravion wildcard certificate"]
  Cert --> Listener["Cluster HTTPS listener"]
  Service["ECS service"] --> Rule["ALB host routing rule"]
  Rule --> Listener
  Service --> Domain["Managed or custom domain"]
  Domain --> ALB["Cluster ALB"]
  Site["Static site"] --> SiteCert["Ravion certificate"]
  SiteCert --> CDN["CloudFront distribution"]
  Site --> SiteDomain["Custom domain"]
  SiteDomain --> CDN

Loading

_{Reviews (2): Last reviewed commit: "feat(definitions): hide BYO certificate/..." | Re-trigger Greptile}

[greptile-apps]

The private IPv6 SG rule rename is missing a moved block. Three of the four symmetrical SG rule renames have moved blocks (ravion_https_ipv4, ravion_https_ipv6, ravion_https_private_ipv4), but ravion_https_private_ipv6 → private_https_ipv6 is absent. For any cluster already in Ravion mode with a private ALB, Terraform will destroy the old rule and create a new one, creating a brief window where IPv6 traffic on port 443 to the private ALB is not covered.

Suggested change

	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
	to = aws_vpc_security_group_ingress_rule.private_https_ipv4
	}
	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
	to = aws_vpc_security_group_ingress_rule.private_https_ipv4
	}
	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv6
	to = aws_vpc_security_group_ingress_rule.private_https_ipv6
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: compute/ecs_cluster/listeners.tf
Line: 185-188

Comment:
The private IPv6 SG rule rename is missing a `moved` block. Three of the four symmetrical SG rule renames have `moved` blocks (`ravion_https_ipv4`, `ravion_https_ipv6`, `ravion_https_private_ipv4`), but `ravion_https_private_ipv6` → `private_https_ipv6` is absent. For any cluster already in Ravion mode with a private ALB, Terraform will destroy the old rule and create a new one, creating a brief window where IPv6 traffic on port 443 to the private ALB is not covered.

```suggestion
moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv4
}

moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv6
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv6
}
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

ravion_domain.custom uses var.cluster_alb_dns_name and var.cluster_alb_zone_id as target_dns_name/target_zone_id, but there are no preconditions validating that these are non-null when custom domains are present. The sibling ravion_certificate.svc resource guards ravion_aws_account_id and cluster_https_listener_arn, but the two ALB variables are left unchecked. A user who provides custom domains and forgets these variables will get a cryptic provider-side null error instead of a clear Terraform message.

Suggested change

	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
	error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
	error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_alb_dns_name != null && var.cluster_alb_dns_name != "")
	error_message = "cluster_alb_dns_name is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_alb_zone_id != null && var.cluster_alb_zone_id != "")
	error_message = "cluster_alb_zone_id is required when the domains list includes a custom (non-wildcard) domain."
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: compute/ecs_service/ravion_domains.tf
Line: 136-139

Comment:
`ravion_domain.custom` uses `var.cluster_alb_dns_name` and `var.cluster_alb_zone_id` as `target_dns_name`/`target_zone_id`, but there are no preconditions validating that these are non-null when custom domains are present. The sibling `ravion_certificate.svc` resource guards `ravion_aws_account_id` and `cluster_https_listener_arn`, but the two ALB variables are left unchecked. A user who provides custom domains and forgets these variables will get a cryptic provider-side null error instead of a clear Terraform message.

```suggestion
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
      error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_dns_name != null && var.cluster_alb_dns_name != "")
      error_message = "cluster_alb_dns_name is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_zone_id != null && var.cluster_alb_zone_id != "")
      error_message = "cluster_alb_zone_id is required when the domains list includes a custom (non-wildcard) domain."
    }
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

ravion_distribution_arn and ravion_distribution_domain both use try(...[0], null), which silently returns null if the module.cdn distribution maps are empty (i.e., no distributions are configured). These null values are then passed as target_arn to ravion_certificate.site and as target_dns_name to ravion_domain.custom with no guard, producing a cryptic provider-side error instead of a clear Terraform message. A precondition on ravion_certificate.site would surface this early.

Suggested change

	lifecycle {
	precondition {
	condition = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
	error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
	}
	precondition {
	condition = length(var.domains) <= 10
	error_message = "A static site may declare at most 10 custom domains."
	}
	}
	lifecycle {
	precondition {
	condition = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
	error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
	}
	precondition {
	condition = length(var.domains) <= 10
	error_message = "A static site may declare at most 10 custom domains."
	}
	precondition {
	condition = !var.use_ravion_managed_domains || local.ravion_distribution_arn != null
	error_message = "use_ravion_managed_domains = true requires at least one CloudFront distribution in var.distributions."
	}
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: hosting/static_site/ravion_domains.tf
Line: 34-43

Comment:
`ravion_distribution_arn` and `ravion_distribution_domain` both use `try(...[0], null)`, which silently returns `null` if the `module.cdn` distribution maps are empty (i.e., no distributions are configured). These null values are then passed as `target_arn` to `ravion_certificate.site` and as `target_dns_name` to `ravion_domain.custom` with no guard, producing a cryptic provider-side error instead of a clear Terraform message. A precondition on `ravion_certificate.site` would surface this early.

```suggestion
  lifecycle {
    precondition {
      condition     = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
      error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
    }
    precondition {
      condition     = length(var.domains) <= 10
      error_message = "A static site may declare at most 10 custom domains."
    }
    precondition {
      condition     = !var.use_ravion_managed_domains || local.ravion_distribution_arn != null
      error_message = "use_ravion_managed_domains = true requires at least one CloudFront distribution in var.distributions."
    }
  }
```

How can I resolve this? If you propose a fix, please make it concise.

[github-actions]

Ravion Module Publish Plan

Dry run only. No Ravion API mutations were made.

Module	Current Version	New Version	Description
rvn-aws-alb	0.1.0	0.1.1	Ship the managed-domains groundwork in the module source: force_http_to_https_redirect removed in favor of listener-owned redirects, HTTPS listener certificate precondition, and the https_listener_certificate_arn output.
rvn-aws-static	0.3.5	0.3.6	Surface the Domains section (aliases + ACM certificate) right after the hosting basics instead of inside CloudFront settings.
rvn-ecs-cluster	0.5.0	0.6.2	Managed domains keeps every BYO certificate attached via SNI when the Ravion wildcard takes over as the default certificate, so enabling it never drops TLS for existing custom hostnames.
rvn-ecs-nlb	0.3.1	0.3.2	Pick up the shared ecs_service module source updates from the managed-domains work (no NLB-facing input changes).
rvn-ecs-web	0.8.4	0.9.1	Add Ravion-managed domains: service domains ride the cluster wildcard certificate automatically, and custom domains get a dedicated certificate with DNS validation, when the selected cluster has managed domains enabled. The Domains section sits right after the service basics.
rvn-ecs-worker	0.3.3	0.3.4	Pick up the shared ecs_service module source updates from the managed-domains work (no worker-facing input changes).

Diffs

rvn-aws-alb 0.1.0 -> 0.1.1

--- remote
+++ compiled
 
   The load balancer intentionally serves no traffic by itself. Services that reference this module, such as EC2 services, create their own target groups and listener rules on the shared listeners.
 
-  Terraform source: [flightcontrolhq/modules/networking/alb](https://github.com/flightcontrolhq/modules/tree/rvn-aws-alb@0.1.0/networking/alb)
+  Terraform source: [flightcontrolhq/modules/networking/alb](https://github.com/flightcontrolhq/modules/tree/rvn-aws-alb@0.1.1/networking/alb)
 
   ## Use cases
 
@@
         base_path: networking/alb
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-aws-alb@0.1.0
+        ref: rvn-aws-alb@0.1.1
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:

rvn-aws-static 0.3.5 -> 0.3.6

--- remote
+++ compiled
     label: Default version prefix
     required: true
     type: string
+  - id: section_domains
+    label: Domains
+    type: section
+  - add_button_label: Add domain alias
+    default: []
+    description: Custom domain names like app.example.com. Leave empty to use the default cloudfront.net domain.
+    id: distribution_aliases
+    label: Domain aliases
+    type: string_array
+  - description: Required if using domain aliases. The certificate module must be in us-east-1.
+    id: distribution_acm_certificate
+    label: ACM certificate
+    mapped_inputs:
+      - default: <<ref.stack.output.certificate_arn>>
+        id: distribution_acm_certificate_arn
+        label: CloudFront certificate ARN
+        type: string
+    required: false
+    type: $ref:rvn-acm-certificate
   - id: section_build
     label: Build config
     type: section
@@
   - id: section_cloudfront
     label: CloudFront settings
     type: section
-  - description: Required if using domain aliases. The certificate module must be in us-east-1.
-    id: distribution_acm_certificate
-    label: ACM certificate
-    mapped_inputs:
-      - default: <<ref.stack.output.certificate_arn>>
-        id: distribution_acm_certificate_arn
-        label: CloudFront certificate ARN
-        type: string
-    required: false
-    type: $ref:rvn-acm-certificate
-  - add_button_label: Add domain alias
-    default: []
-    description: Custom domain names like app.example.com. Leave empty to use the default cloudfront.net domain.
-    id: distribution_aliases
-    label: Domain aliases
-    type: string_array
   - default: PriceClass_All
     description: You can reduce edge locations for some cost savings if it becomes an issue.
     id: price_class
@@
 
   Every deployment is versioned. The deploy step promotes an S3 directory by updating the CloudFront KeyValueStore active pointer. CloudFront rewrites viewer requests to the active version prefix before it reads from S3.
 
-  Terraform source: [flightcontrolhq/modules/hosting/static_site](https://github.com/flightcontrolhq/modules/tree/rvn-aws-static@0.3.5/hosting/static_site)
+  Terraform source: [flightcontrolhq/modules/hosting/static_site](https://github.com/flightcontrolhq/modules/tree/rvn-aws-static@0.3.6/hosting/static_site)
 
   ## Use cases
 
@@
         base_path: hosting/static_site
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-aws-static@0.3.5
+        ref: rvn-aws-static@0.3.6
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:

rvn-ecs-cluster 0.5.0 -> 0.6.2

--- remote
+++ compiled
         value: enabled
       - label: Disabled
         value: disabled
+  - id: section_managed_domains
+    label: Managed domains
+    type: section
+  - default: false
+    description: Have Ravion issue and manage a shared wildcard TLS certificate and DNS for this cluster. The selected ALB HTTPS listener serves the wildcard certificate, and services get automatic domains under the cluster apex. Requires exactly one HTTPS-enabled ALB.
+    id: use_ravion_managed_domains
+    label: Ravion-managed domains
+    type: boolean
+  - description: Subdomain for the cluster's wildcard domain. Defaults to the module given ID when empty.
+    id: ravion_cluster_name
+    label: Cluster subdomain
+    patterns:
+      - message: The subdomain must contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number.
+        pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
+    required: false
+    show_when:
+      use_ravion_managed_domains: true
+    suffix: .<< platform.apex >>
+    type: string
   - id: section_capacity
     label: Capacity providers
     type: section
@@
     show_when:
       public_alb_enabled: true
       public_alb_https_enabled: true
+      use_ravion_managed_domains: false
     type: $ref:rvn-acm-certificate
   - add_button_label: Add certificate ARN
     collapsible: true
@@
     show_when:
       public_alb_enabled: true
       public_alb_https_enabled: true
+      use_ravion_managed_domains: false
     type: string_array
   - collapsible: true
     description: SSL policy for public ALB HTTPS.
@@
     show_when:
       private_alb_enabled: true
       private_alb_https_enabled: true
+      use_ravion_managed_domains: false
     type: $ref:rvn-acm-certificate
   - add_button_label: Add certificate ARN
     collapsible: true
@@
     show_when:
       private_alb_enabled: true
       private_alb_https_enabled: true
+      use_ravion_managed_domains: false
     type: string_array
   - collapsible: true
     description: SSL policy for private ALB HTTPS.
@@
   - **Public and private Network Load Balancers** for TCP/UDP and static IP use cases
   - **CloudWatch Container Insights** dashboard metrics for production visibility
 
-  Terraform source: [flightcontrolhq/modules/compute/ecs_cluster](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-cluster@0.5.0/compute/ecs_cluster)
+  Terraform source: [flightcontrolhq/modules/compute/ecs_cluster](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-cluster@0.6.2/compute/ecs_cluster)
 
   ## Use cases
 
@@
         base_path: compute/ecs_cluster
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-ecs-cluster@0.5.0
+        ref: rvn-ecs-cluster@0.6.2
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:
@@
           public_nlb_enabled: << module.input.public_nlb_enabled >>
           public_nlb_security_group_ids: << module.input.public_nlb_security_group_ids >>
           public_subnet_ids: << module.input.public_subnet_ids || [] >>
+          ravion_aws_account_id: << module.input.aws_account_id >>
+          ravion_aws_region: << module.input.aws_region >>
+          ravion_cluster_name: << module.input.ravion_cluster_name >>
           region: << module.input.aws_region >>
           tags:
             ...overrides: << module.input.tags >>
@@
             ModuleId: <<module.id>>
             Owner: Ravion
             ProjectGivenId: <<project.given_id>>
+          use_ravion_managed_domains: << module.input.use_ravion_managed_domains >>
           vpc_id: << module.input.vpc_id >>
         tool: opentofu
         tool_version: << module.input.opentofu_version || defaults.opentofu_version >>

rvn-ecs-nlb 0.3.1 -> 0.3.2

--- remote
+++ compiled
 
   The module is intentionally focused on Layer 4 services behind a Network Load Balancer. Use ECS Web Service for HTTP host and path routing through an Application Load Balancer.
 
-  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-nlb@0.3.1/compute/ecs_service)
+  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-nlb@0.3.2/compute/ecs_service)
 
   ## Use cases
 
@@
         base_path: compute/ecs_service
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-ecs-nlb@0.3.1
+        ref: rvn-ecs-nlb@0.3.2
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:

rvn-ecs-web 0.8.4 -> 0.9.1

--- remote
+++ compiled
         immutable: true
         label: Private ALB security group ID
         type: string
+      - collapsible: true
+        default: << ref.stack.output.ravion_managed_domains_enabled || false >>
+        description: Whether the selected cluster has Ravion-managed domains enabled (its ALB HTTPS listener serves the cluster wildcard certificate).
+        id: ravion_managed_domains_enabled
+        label: Cluster-managed domains
+        type: boolean
+      - collapsible: true
+        default: <<ref.stack.output.ravion_cluster_domain_fqdn>>
+        description: Wildcard apex of the selected cluster. Service domains one label under it ride the cluster wildcard certificate automatically.
+        id: cluster_parent_fqdn
+        label: Cluster domain apex
+        required: false
+        type: string
+      - collapsible: true
+        default: <<ref.stack.output.public_alb_dns_name>>
+        id: public_alb_dns_name
+        immutable: true
+        label: Public ALB DNS name
+        required: false
+        type: string
+      - collapsible: true
+        default: <<ref.stack.output.public_alb_zone_id>>
+        id: public_alb_zone_id
+        immutable: true
+        label: Public ALB hosted zone ID
+        required: false
+        type: string
+      - collapsible: true
+        default: <<ref.stack.output.private_alb_dns_name>>
+        id: private_alb_dns_name
+        immutable: true
+        label: Private ALB DNS name
+        required: false
+        type: string
+      - collapsible: true
+        default: <<ref.stack.output.private_alb_zone_id>>
+        id: private_alb_zone_id
+        immutable: true
+        label: Private ALB hosted zone ID
+        required: false
+        type: string
     required: true
     type: $ref:rvn-ecs-cluster
   - id: section_service
@@
     id: private_subnet_placement_enabled
     label: Run in private subnets
     type: boolean
+  - id: section_domains
+    label: Domains
+    show_when:
+      ravion_managed_domains_enabled: true
+    type: section
+  - add_button_label: Add domain
+    description: Fully-qualified domains for this service. A name one label under the cluster apex rides the cluster wildcard certificate automatically; any other name gets a dedicated certificate with DNS validation records you add at your DNS host. Empty = an automatic <service>.<cluster apex> domain.
+    id: domains
+    label: Domains
+    max_length: 10
+    placeholder: app.example.com
+    show_when:
+      ravion_managed_domains_enabled: true
+    type: string_array
   - id: section_build
     label: Build config
     type: section
@@
   - description: Add at least one domain host rule or path rule.
     id: section_routing
     label: HTTP listener rules
+    show_when:
+      ravion_managed_domains_enabled: false
     type: section
   - add_button_label: Add domain host
     default: null
@@
     label: Domain host rules
     placeholder: app.example.com
     required: false
+    show_when:
+      ravion_managed_domains_enabled: false
     type: string_array
   - add_button_label: Add path pattern
     collapsible: true
@@
     id: path_pattern_values
     label: Path rules
     required: false
+    show_when:
+      ravion_managed_domains_enabled: false
     type: string_array
   - collapsible: true
     description: Optional ALB listener rule priority. Leave blank to let AWS assign the next available priority.
@@
     label: Listener rule priority
     max: 50000
     min: 1
+    show_when:
+      ravion_managed_domains_enabled: false
     type: number
   - id: section_task
     label: Container resources
@@
 
   The module is intentionally focused on web services behind an Application Load Balancer. It uses the selected ECS cluster to inherit AWS account, region, VPC, subnets, capacity providers, load balancer listeners, and load balancer security groups.
 
-  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-web@0.8.4/compute/ecs_service)
+  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-web@0.9.1/compute/ecs_service)
 
   ## Use cases
 
@@
         base_path: compute/ecs_service
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-ecs-web@0.8.4
+        ref: rvn-ecs-web@0.9.1
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:
@@
             - '...<< module.input.capacity_provider == "fargate" || module.input.additional_fargate_capacity_enabled ? [{capacity_provider: module.input.fargate_capacity_provider_name, weight: 1, base: 0}] : [] >>'
             - '...<< module.input.capacity_provider == "fargate_spot" || module.input.additional_fargate_spot_capacity_enabled ? [{capacity_provider: module.input.fargate_spot_capacity_provider_name, weight: 1, base: 0}] : [] >>'
             - '...<< module.input.capacity_provider == "ec2" || module.input.additional_ec2_capacity_enabled ? [{capacity_provider: module.input.ec2_capacity_provider_name, weight: 1, base: 0}] : [] >>'
+          cluster_alb_dns_name: "<< module.input.public_web_service_enabled ? module.input.public_alb_dns_name : module.input.private_alb_dns_name >>"
+          cluster_alb_zone_id: "<< module.input.public_web_service_enabled ? module.input.public_alb_zone_id : module.input.private_alb_zone_id >>"
           cluster_arn: << module.input.cluster_arn >>
+          cluster_https_listener_arn: "<< module.input.public_web_service_enabled ? module.input.public_alb_https_listener_arn : module.input.private_alb_https_listener_arn >>"
+          cluster_parent_fqdn: << module.input.cluster_parent_fqdn >>
           container_port: << module.input.container_port >>
           deployment_maximum_percent: << module.input.deployment_maximum_percent >>
           deployment_minimum_healthy_percent: << module.input.deployment_minimum_healthy_percent >>
           deployment_type: rolling
           desired_count: "<< module.input.auto_scaling_enabled ? module.input.min_capacity : module.input.desired_count >>"
+          domains: << module.input.domains || [] >>
           ecr_default_lifecycle_policy_enabled: true
           ecr_force_deletion_enabled: << module.input.ecr_force_deletion_enabled >>
           ecr_repository_creation_enabled: << module.input.build_source == "dockerfile" || module.input.build_source == "railpack" || module.input.build_source == "nixpacks" >>
@@
           network_mode: awsvpc
           new_deployment_forcing_enabled: << module.input.new_deployment_forcing_enabled >>
           public_ip_assignment_enabled: "<< module.input.private_subnet_placement_enabled ? false : true >>"
+          ravion_aws_account_id: << module.input.aws_account_id >>
+          ravion_aws_region: << module.input.aws_region >>
           region: << module.input.aws_region >>
           requires_compatibilities: '<< module.input.capacity_provider == "ec2" ? ["EC2"] : ["FARGATE"] >>'
           runtime_platform:

rvn-ecs-worker 0.3.3 -> 0.3.4

--- remote
+++ compiled
 
   The ECS Worker module creates an ECS service for background jobs, queue consumers, event processors, and other private workloads in an existing Ravion ECS cluster. It uses the same ECS service Terraform module as ECS Web Server, but does not create or attach a load balancer target group and does not expose a primary container port.
 
-  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-worker@0.3.3/compute/ecs_service)
+  Terraform source: [flightcontrolhq/modules/compute/ecs_service](https://github.com/flightcontrolhq/modules/tree/rvn-ecs-worker@0.3.4/compute/ecs_service)
 
   ## Use cases
 
@@
         base_path: compute/ecs_service
         branch: main
         execution_environment_id: << module.input.execution_environment_id >>
-        ref: rvn-ecs-worker@0.3.3
+        ref: rvn-ecs-worker@0.3.4
         repo: https://github.com/flightcontrolhq/modules
         stack_id: <<stack.id>>
         terraform_variables:

[siddhsuresh]

@greptile