Skip to content

Commit 18196ea

Browse files
mattdean3-nhsmattdean3-nhs
authored
Merge pull request #1069 from NHSDigital/feature/made14-NRL-1700-versioned-truststore
[NRL-1700] Use S3 versioning for truststore file
2 parents 4aa2401 + e0297b7 commit 18196ea

File tree

8 files changed

+67
-34
lines changed

8 files changed

+67
-34
lines changed

‎terraform/account-wide-infrastructure/dev/domain.tf‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11

22
module "dev-custom-domain-name" {
3-
source = "../modules/env-custom-domain-name"
4-
domain_name = var.dev_api_domain_name
5-
domain_zone = aws_route53_zone.dev-ns.name
6-
mtls_certificate_file = "s3://${module.dev-truststore-bucket.bucket_name}/${module.dev-truststore-bucket.certificates_object_key}"
3+
source = "../modules/env-custom-domain-name"
4+
domain_name = var.dev_api_domain_name
5+
domain_zone = aws_route53_zone.dev-ns.name
6+
mtls_certificate_file = "s3://${module.dev-truststore-bucket.bucket_name}/${module.dev-truststore-bucket.certificates_object_key}"
7+
mtls_certificate_file_version = module.dev-truststore-bucket.certificates_object_version
78
}
89

910
module "devsandbox-custom-domain-name" {
10-
source = "../modules/env-custom-domain-name"
11-
domain_name = var.devsandbox_api_domain_name
12-
domain_zone = aws_route53_zone.dev-ns.name
13-
mtls_certificate_file = "s3://${module.dev-truststore-bucket.bucket_name}/${module.dev-truststore-bucket.certificates_object_key}"
11+
source = "../modules/env-custom-domain-name"
12+
domain_name = var.devsandbox_api_domain_name
13+
domain_zone = aws_route53_zone.dev-ns.name
14+
mtls_certificate_file = "s3://${module.dev-truststore-bucket.bucket_name}/${module.dev-truststore-bucket.certificates_object_key}"
15+
mtls_certificate_file_version = module.dev-truststore-bucket.certificates_object_version
1416
}

‎terraform/account-wide-infrastructure/mgmt/iam__developer-role.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,19 @@ module "developer_policy" {
9999
"${data.aws_s3_bucket.ci_logging.arn}/*"
100100
]
101101
},
102+
{
103+
Action = [
104+
"s3:PutObject",
105+
"s3:GetObject",
106+
"s3:DeleteObject"
107+
]
108+
Effect = "Deny"
109+
Resource = [
110+
"${data.aws_s3_bucket.truststore.arn}/ca/prod*",
111+
"${data.aws_s3_bucket.truststore.arn}/client/prod*",
112+
"${data.aws_s3_bucket.truststore.arn}/server/prod*"
113+
]
114+
},
102115
{
103116
Action = [
104117
"s3:GetObject"

‎terraform/account-wide-infrastructure/modules/env-custom-domain-name/apigateway.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ resource "aws_api_gateway_domain_name" "domain" {
77
}
88

99
mutual_tls_authentication {
10-
truststore_uri = var.mtls_certificate_file
10+
truststore_uri = var.mtls_certificate_file
11+
truststore_version = var.mtls_certificate_file_version
1112
}
1213

1314
depends_on = [

‎terraform/account-wide-infrastructure/modules/env-custom-domain-name/vars.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,8 @@ variable "mtls_certificate_file" {
1919
description = "The path to the mtls certificate file"
2020
type = string
2121
}
22+
23+
variable "mtls_certificate_file_version" {
24+
description = "The S3 version of the mtls certificate file"
25+
type = string
26+
}

‎terraform/account-wide-infrastructure/modules/truststore-bucket/output.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,8 @@ output "certificates_object_key" {
77
description = "Key of the truststore certificates object"
88
value = aws_s3_object.api_truststore_certificate.key
99
}
10+
11+
output "certificates_object_version" {
12+
description = "Version of the truststore certificates object"
13+
value = aws_s3_object.api_truststore_certificate.version_id
14+
}

‎terraform/account-wide-infrastructure/prod/domain.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11

22

33
module "dev-custom-domain-name" {
4-
source = "../modules/env-custom-domain-name"
5-
domain_name = var.prod_api_domain_name
6-
domain_zone = aws_route53_zone.prod-ns.name
7-
mtls_certificate_file = "s3://${module.prod-truststore-bucket.bucket_name}/${module.prod-truststore-bucket.certificates_object_key}"
4+
source = "../modules/env-custom-domain-name"
5+
domain_name = var.prod_api_domain_name
6+
domain_zone = aws_route53_zone.prod-ns.name
7+
mtls_certificate_file = "s3://${module.prod-truststore-bucket.bucket_name}/${module.prod-truststore-bucket.certificates_object_key}"
8+
mtls_certificate_file_version = module.prod-truststore-bucket.certificates_object_version
89
}

‎terraform/account-wide-infrastructure/test/domain.tf‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,40 @@
11

22
module "qa-custom-domain-name" {
3-
source = "../modules/env-custom-domain-name"
4-
domain_name = var.qa_api_domain_name
5-
domain_zone = aws_route53_zone.test-qa-ns.name
6-
mtls_certificate_file = "s3://${module.qa-truststore-bucket.bucket_name}/${module.qa-truststore-bucket.certificates_object_key}"
3+
source = "../modules/env-custom-domain-name"
4+
domain_name = var.qa_api_domain_name
5+
domain_zone = aws_route53_zone.test-qa-ns.name
6+
mtls_certificate_file = "s3://${module.qa-truststore-bucket.bucket_name}/${module.qa-truststore-bucket.certificates_object_key}"
7+
mtls_certificate_file_version = module.qa-truststore-bucket.certificates_object_version
78
}
89

910
module "qasandbox-custom-domain-name" {
10-
source = "../modules/env-custom-domain-name"
11-
domain_name = var.qasandbox_api_domain_name
12-
domain_zone = aws_route53_zone.test-qa-ns.name
13-
mtls_certificate_file = "s3://${module.qa-truststore-bucket.bucket_name}/${module.qa-truststore-bucket.certificates_object_key}"
11+
source = "../modules/env-custom-domain-name"
12+
domain_name = var.qasandbox_api_domain_name
13+
domain_zone = aws_route53_zone.test-qa-ns.name
14+
mtls_certificate_file = "s3://${module.qa-truststore-bucket.bucket_name}/${module.qa-truststore-bucket.certificates_object_key}"
15+
mtls_certificate_file_version = module.qa-truststore-bucket.certificates_object_version
1416
}
1517

1618
module "int-custom-domain-name" {
17-
source = "../modules/env-custom-domain-name"
18-
domain_name = var.int_api_domain_name
19-
domain_zone = aws_route53_zone.test-int-ns.name
20-
mtls_certificate_file = "s3://${module.int-truststore-bucket.bucket_name}/${module.int-truststore-bucket.certificates_object_key}"
19+
source = "../modules/env-custom-domain-name"
20+
domain_name = var.int_api_domain_name
21+
domain_zone = aws_route53_zone.test-int-ns.name
22+
mtls_certificate_file = "s3://${module.int-truststore-bucket.bucket_name}/${module.int-truststore-bucket.certificates_object_key}"
23+
mtls_certificate_file_version = module.int-truststore-bucket.certificates_object_version
2124
}
2225

2326
module "intsandbox-custom-domain-name" {
24-
source = "../modules/env-custom-domain-name"
25-
domain_name = var.intsandbox_api_domain_name
26-
domain_zone = aws_route53_zone.test-int-ns.name
27-
mtls_certificate_file = "s3://${module.int-truststore-bucket.bucket_name}/${module.int-truststore-bucket.certificates_object_key}"
27+
source = "../modules/env-custom-domain-name"
28+
domain_name = var.intsandbox_api_domain_name
29+
domain_zone = aws_route53_zone.test-int-ns.name
30+
mtls_certificate_file = "s3://${module.int-truststore-bucket.bucket_name}/${module.int-truststore-bucket.certificates_object_key}"
31+
mtls_certificate_file_version = module.int-truststore-bucket.certificates_object_version
2832
}
2933

3034
module "ref-custom-domain-name" {
31-
source = "../modules/env-custom-domain-name"
32-
domain_name = var.ref_api_domain_name
33-
domain_zone = aws_route53_zone.test-ref-ns.name
34-
mtls_certificate_file = "s3://${module.ref-truststore-bucket.bucket_name}/${module.ref-truststore-bucket.certificates_object_key}"
35+
source = "../modules/env-custom-domain-name"
36+
domain_name = var.ref_api_domain_name
37+
domain_zone = aws_route53_zone.test-ref-ns.name
38+
mtls_certificate_file = "s3://${module.ref-truststore-bucket.bucket_name}/${module.ref-truststore-bucket.certificates_object_key}"
39+
mtls_certificate_file_version = module.ref-truststore-bucket.certificates_object_version
3540
}

‎terraform/infrastructure/domain.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ resource "aws_api_gateway_domain_name" "domain" {
4646
}
4747

4848
mutual_tls_authentication {
49-
truststore_uri = "s3://${data.aws_s3_object.api-truststore-certificate.bucket}/${data.aws_s3_object.api-truststore-certificate.key}"
49+
truststore_uri = "s3://${data.aws_s3_object.api-truststore-certificate.bucket}/${data.aws_s3_object.api-truststore-certificate.key}"
50+
truststore_version = data.aws_s3_object.api-truststore-certificate.version_id
5051
}
5152

5253
depends_on = [

0 commit comments

Comments
 (0)