Fix task def drift: Terraform owns revisions, deploy just restarts

.github/workflows/ecs-deploy.yml

@@ -4,9 +4,9 @@ on:
   workflow_call:
     inputs:
       image_tag:
-        description: "Container image tag to deploy"
+        description: "Container image tag (unused — kept for workflow_call compat)"
         type: string
-        required: true
+        default: ""
       service_name:
         description: "ECS service name (defaults to repo name)"
         type: string
@@ -59,8 +59,4 @@ jobs:
         env:
           SERVICE: ${{ inputs.service_name || github.event.repository.name }}
           CLUSTER: ${{ inputs.cluster_name }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          ECR_REPO: ${{ github.event.repository.name }}
-          ACCOUNT_ID: ${{ inputs.aws_account_id }}
-          REGION: ${{ inputs.aws_region }}
         run: sh .platform/scripts/ecs-deploy.sh

scripts/ecs-deploy.sh

@@ -1,30 +1,21 @@
 #!/bin/sh
 # Deploy a new container image to an ECS service.
 #
+# Forces a new deployment so ECS pulls the latest image for the current
+# task definition. Does NOT create new task definition revisions — that's
+# Terraform's job. This avoids drift between TF-managed task defs
+# (with security hardening, volumes, etc.) and deploy-time revisions.
+#
 # Usage: ecs-deploy.sh
 #
-# Env: CLUSTER, SERVICE, ECR_REPO, IMAGE_TAG, ACCOUNT_ID, REGION
+# Env: CLUSTER, SERVICE
 
 set -e
 
-SCRIPT_DIR=$(dirname "$0")
-export ECR_URI="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${ECR_REPO}:${IMAGE_TAG}"
-
-# Use the latest family revision (includes structural changes from Terraform)
-# rather than the revision currently running on the service.
-aws ecs describe-task-definition --task-definition "$SERVICE" \
-  --query 'taskDefinition' > task-def.json
-
-sh "$SCRIPT_DIR/update-task-def.sh" task-def.json task-def-new.json
-
-NEW_ARN=$(aws ecs register-task-definition \
-  --cli-input-json file://task-def-new.json \
-  --query 'taskDefinition.taskDefinitionArn' --output text)
-echo "New task definition: $NEW_ARN"
-
+echo "Forcing new deployment for ${SERVICE} on ${CLUSTER}..."
 aws ecs update-service \
   --cluster "$CLUSTER" --service "$SERVICE" \
-  --task-definition "$NEW_ARN" > /dev/null
+  --force-new-deployment > /dev/null
 
 echo "Waiting for service to stabilize..."
 aws ecs wait services-stable --cluster "$CLUSTER" --services "$SERVICE"

terraform/modules/ecs-service/main.tf

@@ -97,9 +97,5 @@ resource "aws_ecs_service" "this" {
     container_port   = var.port
   }
 
-  lifecycle {
-    ignore_changes = [task_definition]
-  }
-
   depends_on = [aws_ecs_task_definition.this]
 }