Add bridge network mode option to container module

[ale210]

For #252. Not "Fixes": the issue has a post-merge check that should stay open.

Adds network_mode (awsvpc default, or bridge) to modules/container. In bridge mode the task definition uses bridge with hostPort = 0, the target group is instance-type, and the service drops network_configuration. The security group and its two rules are created only in awsvpc mode, with moved blocks to their new [0] addresses. A header section explains the two modes.

Expected plan: no changes to any service. Only the 3 moved entries per service (security group and both rules → [0]), 30 in total. Nothing switches until a service sets network_mode = "bridge" (#253).

The root moved.tf already moves the people-depot service's security group and rules into this module without an index. That chains into the new [0] moves, so check that the plan accepts it cleanly.

What a switch does was checked in a scratch plan against people-depot-backend-dev: the ECS service updates in place. Summary on the issue: #252 (comment)

Validated locally with Terraform 1.16.0: init -backend=false and validate. fmt is clean on the new file; the other two files fail fmt on main already, on lines this PR does not touch.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 0 to add, 0 to change, 0 to destroy, 30 to move.

Terraform will perform the following actions:

  # module.civic-tech-index.module.backend_prod_service.aws_security_group.container has moved to module.civic-tech-index.module.backend_prod_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-0e6972339d4ee4d90"
        name                   = "ecs-container-civic-tech-index-backend-prod"
        tags                   = {
            "Name" = "ecs-container-civic-tech-index-backend-prod"
        }
#        (10 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.civic-tech-index.module.backend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-0404df748a0c52909"
#        (7 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.civic-tech-index.module.backend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-06e5550eec67b454f"
#        (9 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_stage_service.aws_security_group.container has moved to module.civic-tech-index.module.backend_stage_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-0bc827eede3aa095c"
        name                   = "ecs-container-civic-tech-index-backend-stage"
        tags                   = {
            "Name" = "ecs-container-civic-tech-index-backend-stage"
        }
#        (10 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_stage_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.civic-tech-index.module.backend_stage_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-0f89fce88e1743301"
#        (7 unchanged attributes hidden)
    }

  # module.civic-tech-index.module.backend_stage_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.civic-tech-index.module.backend_stage_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0425a0d13246f7599"
#        (9 unchanged attributes hidden)
    }

  # module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_security_group.container has moved to module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-0f80b7de645d296c6"
        name                   = "ecs-container-civic-tech-jobs-fullstack-stage"
        tags                   = {
            "Name" = "ecs-container-civic-tech-jobs-fullstack-stage"
        }
#        (10 unchanged attributes hidden)
    }

  # module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-08fc6e3c782184010"
#        (7 unchanged attributes hidden)
    }

  # module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.civic-tech-jobs.module.civic_tech_jobs_fullstack_stage_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0db9434e28bf57789"
#        (9 unchanged attributes hidden)
    }

  # module.home-unite-us.module.prod_service.aws_security_group.container has moved to module.home-unite-us.module.prod_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-0403172f79c4ff0a4"
        name                   = "ecs-container-home-unite-us-fullstack-prod"
        tags                   = {
            "Name" = "ecs-container-home-unite-us-fullstack-prod"
        }
#        (10 unchanged attributes hidden)
    }

  # module.home-unite-us.module.prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.home-unite-us.module.prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-0f7ebfb98d97c30a0"
#        (7 unchanged attributes hidden)
    }

  # module.home-unite-us.module.prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.home-unite-us.module.prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0a4d2431b929bd43b"
#        (9 unchanged attributes hidden)
    }

  # module.home-unite-us.module.qa_service.aws_security_group.container has moved to module.home-unite-us.module.qa_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-03ab99034c6209504"
        name                   = "ecs-container-home-unite-us-fullstack-qa"
        tags                   = {
            "Name" = "ecs-container-home-unite-us-fullstack-qa"
        }
#        (10 unchanged attributes hidden)
    }

  # module.home-unite-us.module.qa_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.home-unite-us.module.qa_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-01d4cc8411407108c"
#        (7 unchanged attributes hidden)
    }

  # module.home-unite-us.module.qa_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.home-unite-us.module.qa_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0171086766886d951"
#        (9 unchanged attributes hidden)
    }

  # module.people-depot.module.backend_dev_service.aws_security_group.container has moved to module.people-depot.module.backend_dev_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-02ea7fea37446badd"
        name                   = "ecs-container-people-depot-backend-dev"
        tags                   = {
            "Name" = "ecs-container-people-depot-backend-dev"
        }
#        (10 unchanged attributes hidden)
    }

  # module.people-depot.module.backend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.people-depot.module.backend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-03d942deb0807cc0f"
#        (7 unchanged attributes hidden)
    }

  # module.people-depot.module.backend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.people-depot.module.backend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-05275a0fabb94fbe3"
#        (9 unchanged attributes hidden)
    }

  # module.vrms.module.backend_dev_service.aws_security_group.container has moved to module.vrms.module.backend_dev_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-04cad03d0c2311bf9"
        name                   = "ecs-container-vrms-backend-dev"
        tags                   = {
            "Name" = "ecs-container-vrms-backend-dev"
        }
#        (10 unchanged attributes hidden)
    }

  # module.vrms.module.backend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.vrms.module.backend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-080396281203e7734"
#        (7 unchanged attributes hidden)
    }

  # module.vrms.module.backend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.vrms.module.backend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0b860d4c6902e23ab"
#        (9 unchanged attributes hidden)
    }

  # module.vrms.module.backend_prod_service.aws_security_group.container has moved to module.vrms.module.backend_prod_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-065702ded1faa664f"
        name                   = "ecs-container-vrms-backend-prod"
        tags                   = {
            "Name" = "ecs-container-vrms-backend-prod"
        }
#        (10 unchanged attributes hidden)
    }

  # module.vrms.module.backend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.vrms.module.backend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-0f14574928a2330b2"
#        (7 unchanged attributes hidden)
    }

  # module.vrms.module.backend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.vrms.module.backend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0829cd1da41497afe"
#        (9 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_dev_service.aws_security_group.container has moved to module.vrms.module.frontend_dev_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-05e59f77f2b57320b"
        name                   = "ecs-container-vrms-frontend-dev"
        tags                   = {
            "Name" = "ecs-container-vrms-frontend-dev"
        }
#        (10 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.vrms.module.frontend_dev_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-05db0dee76f5a3e3f"
#        (7 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.vrms.module.frontend_dev_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-0e0a24674dda4147e"
#        (9 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_prod_service.aws_security_group.container has moved to module.vrms.module.frontend_prod_service.aws_security_group.container[0]
    resource "aws_security_group" "container" {
        id                     = "sg-038eee26dd808e44f"
        name                   = "ecs-container-vrms-frontend-prod"
        tags                   = {
            "Name" = "ecs-container-vrms-frontend-prod"
        }
#        (10 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic has moved to module.vrms.module.frontend_prod_service.aws_vpc_security_group_egress_rule.allow_all_traffic[0]
    resource "aws_vpc_security_group_egress_rule" "allow_all_traffic" {
        id                     = "sgr-02ffae411eecc0420"
#        (7 unchanged attributes hidden)
    }

  # module.vrms.module.frontend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port has moved to module.vrms.module.frontend_prod_service.aws_vpc_security_group_ingress_rule.container_ingress_port[0]
    resource "aws_vpc_security_group_ingress_rule" "container_ingress_port" {
        id                     = "sgr-06b3ebc7567e027e3"
#        (9 unchanged attributes hidden)
    }

Plan: 0 to add, 0 to change, 0 to destroy.

✅ Plan applied in Terraform apply (OIDC) #100