Skip to content

Commit cb7572e

Browse files
masl2masl2
authored
CCM-11869: route 53 is broken (#130)
* CCM-11869: route 53 is broken * CCM-11586: is it the dynamic names * CCM-11586: wasn't that * CCM-11586: re-enable default endpoint * CCM-11869: move to centrally managed truststore * CCM-11869: move to centrally managed truststore * CCM-11869: fix refs * CCM-11869: fix refs * CCM-11869: fix refs * CCM-11869: ssl module should be conditional
1 parent fe63c53 commit cb7572e

File tree

7 files changed

+24
-53
lines changed

7 files changed

+24
-53
lines changed

‎infrastructure/terraform/components/api/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ No requirements.
1010
| Name | Description | Type | Default | Required |
1111
|------|-------------|------|---------|:--------:|
1212
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
13+
| <a name="input_ca_pem_filename"></a> [ca\_pem\_filename](#input\_ca\_pem\_filename) | Filename for the CA truststore file within the s3 bucket | `string` | `null` | no |
1314
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"supapi"` | no |
1415
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1516
| <a name="input_enable_backups"></a> [enable\_backups](#input\_enable\_backups) | Enable backups | `bool` | `false` | no |

‎infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_api_gateway_base_path_mapping" "main" {
22
api_id = aws_api_gateway_rest_api.main.id
33
stage_name = aws_api_gateway_stage.main.stage_name
4-
domain_name = var.manually_configure_mtls_truststore ? aws_api_gateway_domain_name.main.0.domain_name : aws_api_gateway_domain_name.main_nonprod.0.domain_name
4+
domain_name = aws_api_gateway_domain_name.main.domain_name
55
}

‎infrastructure/terraform/components/api/api_gateway_domain.tf‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
resource "aws_api_gateway_domain_name" "main" {
2-
count = var.manually_configure_mtls_truststore ? 1 : 0
32
regional_certificate_arn = aws_acm_certificate_validation.main.certificate_arn
43
domain_name = local.root_domain_name
54
security_policy = "TLS_1_2"
@@ -8,40 +7,15 @@ resource "aws_api_gateway_domain_name" "main" {
87
types = ["REGIONAL"]
98
}
109

11-
depends_on = [
12-
module.domain_truststore,
13-
aws_s3_object.placeholder_truststore
14-
]
15-
1610
mutual_tls_authentication {
17-
truststore_uri = "s3://${module.domain_truststore.id}/${aws_s3_object.placeholder_truststore[0].key}"
18-
truststore_version = aws_s3_object.placeholder_truststore[0].version_id
19-
}
20-
21-
lifecycle {
22-
ignore_changes = [
23-
mutual_tls_authentication
24-
]
11+
truststore_uri = var.manually_configure_mtls_truststore ? "s3://${local.acct.s3_buckets["truststore"]["id"]}/${var.ca_pem_filename}" : "s3://${local.acct.s3_buckets["truststore"]["id"]}/${aws_s3_object.placeholder_truststore[0].key}"
12+
truststore_version = var.manually_configure_mtls_truststore ? data.aws_s3_object.external_ca_cert[0].version_id : aws_s3_object.placeholder_truststore[0].version_id
2513
}
2614
}
2715

28-
resource "aws_api_gateway_domain_name" "main_nonprod" {
29-
count = !var.manually_configure_mtls_truststore ? 1 : 0
30-
regional_certificate_arn = aws_acm_certificate_validation.main.certificate_arn
31-
domain_name = local.root_domain_name
32-
security_policy = "TLS_1_2"
16+
data "aws_s3_object" "external_ca_cert" {
17+
count = var.manually_configure_mtls_truststore ? 1 : 0
3318

34-
endpoint_configuration {
35-
types = ["REGIONAL"]
36-
}
37-
38-
depends_on = [
39-
module.domain_truststore,
40-
aws_s3_object.placeholder_truststore_nonprod
41-
]
42-
43-
mutual_tls_authentication {
44-
truststore_uri = "s3://${module.domain_truststore.id}/${aws_s3_object.placeholder_truststore_nonprod[0].key}"
45-
truststore_version = aws_s3_object.placeholder_truststore_nonprod[0].version_id
46-
}
19+
bucket = local.acct.s3_buckets["truststore"]["id"]
20+
key = "${local.csi}/${var.ca_pem_filename}"
4721
}

‎infrastructure/terraform/components/api/module_supplier_ssl.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
module "supplier_ssl" {
2+
count = var.manually_configure_mtls_truststore ? 0 : 1
3+
24
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/ssl?ref=v2.0.17"
35

46
name = "sapi_trust"

‎infrastructure/terraform/components/api/route53_record.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
resource "aws_route53_record" "main" {
2-
name = var.manually_configure_mtls_truststore ? aws_api_gateway_domain_name.main.0.regional_domain_name : aws_api_gateway_domain_name.main_nonprod.0.regional_domain_name
2+
name = aws_api_gateway_domain_name.main.domain_name
33
type = "A"
44
zone_id = local.root_domain_id
55

66
alias {
7-
name = var.manually_configure_mtls_truststore ? aws_api_gateway_domain_name.main.0.regional_domain_name : aws_api_gateway_domain_name.main_nonprod.0.regional_domain_name
8-
zone_id = var.manually_configure_mtls_truststore ? aws_api_gateway_domain_name.main.0.regional_zone_id : aws_api_gateway_domain_name.main_nonprod.0.regional_zone_id
7+
name = aws_api_gateway_domain_name.main.regional_domain_name
8+
zone_id = aws_api_gateway_domain_name.main.regional_zone_id
99

1010
evaluate_target_health = true
1111
}

‎infrastructure/terraform/components/api/s3_object_placeholder_truststore.tf‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,16 @@
11
# In manually configured (e.g. dev main, nonprod main, prod main) add lifecycle policy to permit manual management of cert
22
resource "aws_s3_object" "placeholder_truststore" {
3-
count = var.manually_configure_mtls_truststore ? 1 : 0
4-
bucket = module.domain_truststore.bucket
5-
key = "truststore.pem"
6-
content = module.supplier_ssl.cacert_pem
3+
count = var.manually_configure_mtls_truststore ? 0 : 1
74

8-
depends_on = [
9-
module.domain_truststore,
10-
module.supplier_ssl
11-
]
5+
bucket = local.acct.s3_buckets["truststore"]["id"]
6+
key = "${local.csi}/truststore.pem"
7+
content = module.supplier_ssl[0].cacert_pem
128

139
lifecycle {
1410
ignore_changes = [
1511
content
1612
]
1713
}
18-
}
19-
20-
# In non-manually configured env (e.g. PR) exclude lifecycle policy so resources are managed
21-
# Requires duplicate block as lifecycle policies cannot be dynamic
22-
resource "aws_s3_object" "placeholder_truststore_nonprod" {
23-
count = !var.manually_configure_mtls_truststore ? 1 : 0
24-
bucket = module.domain_truststore.bucket
25-
key = "truststore.pem"
26-
content = module.supplier_ssl.cacert_pem
2714

2815
depends_on = [
2916
module.domain_truststore,

‎infrastructure/terraform/components/api/variables.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,10 @@ variable "enable_backups" {
9898
description = "Enable backups"
9999
default = false
100100
}
101+
102+
103+
variable "ca_pem_filename" {
104+
type = string
105+
description = "Filename for the CA truststore file within the s3 bucket"
106+
default = null
107+
}

0 commit comments

Comments
 (0)