Skip to content

Commit cf02093

Browse files
patheardpatheard
authored
fix: properly create conditional SSM parameters (#8)
SSM parameters do not allow blank values so this fix conditionally creates them as needed.
1 parent eba3f96 commit cf02093

File tree

7 files changed

+107
-37
lines changed

7 files changed

+107
-37
lines changed

‎terraform/aws/ecs.tf‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,27 @@ data "template_file" "valentine" {
1111
template = file("./templates/valentine.json.tpl")
1212

1313
vars = {
14-
awslogs-group = aws_cloudwatch_log_group.valentine_group.name
15-
awslogs-region = var.region
16-
awslogs-stream-prefix = "ecs-valentine"
17-
image = "public.ecr.aws/cds-snc/valentine:latest"
18-
fargate_cpu = var.fargate_cpu
19-
fargate_memory = var.fargate_memory
20-
aws_region = var.region
21-
AZURE_OPENAI_ENDPOINT = aws_ssm_parameter.azure_openai_endpoint.arn
22-
AZURE_OPENAI_KEY = aws_ssm_parameter.azure_openai_key.arn
23-
COGNITO_DOMAIN = aws_ssm_parameter.cognito_domain.arn
24-
COGNITO_CLIENT_ID = aws_ssm_parameter.cognito_client_id.arn
25-
COGNITO_CLIENT_SECRET = aws_ssm_parameter.cognito_client_secret.arn
26-
COGNITO_USER_POOL_ID = aws_ssm_parameter.cognito_user_pool_id.arn
27-
COGNITO_AWS_REGION = aws_ssm_parameter.cognito_aws_region.arn
28-
DATABASE_URL = aws_ssm_parameter.database_url.arn
29-
GOOGLE_CLIENT_ID = aws_ssm_parameter.google_client_id.arn
30-
GOOGLE_CLIENT_SECRET = aws_ssm_parameter.google_client_secret.arn
31-
PHX_HOST = aws_acm_certificate.valentine.domain_name
32-
SECRET_KEY_BASE = aws_ssm_parameter.secret_key_base.arn
14+
awslogs-group = aws_cloudwatch_log_group.valentine_group.name
15+
awslogs-region = var.region
16+
awslogs-stream-prefix = "ecs-valentine"
17+
image = "public.ecr.aws/cds-snc/valentine:latest"
18+
fargate_cpu = var.fargate_cpu
19+
fargate_memory = var.fargate_memory
20+
aws_region = var.region
21+
AZURE_OPENAI_ENDPOINT = aws_ssm_parameter.azure_openai_endpoint.arn
22+
AZURE_OPENAI_KEY = aws_ssm_parameter.azure_openai_key.arn
23+
COGNITO_DOMAIN = var.create_cognito_user_pool ? aws_ssm_parameter.cognito_domain[0].arn : ""
24+
COGNITO_CLIENT_ID = var.create_cognito_user_pool ? aws_ssm_parameter.cognito_client_id[0].arn : ""
25+
COGNITO_CLIENT_SECRET = var.create_cognito_user_pool ? aws_ssm_parameter.cognito_client_secret[0].arn : ""
26+
COGNITO_USER_POOL_ID = var.create_cognito_user_pool ? aws_ssm_parameter.cognito_user_pool_id[0].arn : ""
27+
COGNITO_AWS_REGION = var.create_cognito_user_pool ? aws_ssm_parameter.cognito_aws_region[0].arn : ""
28+
CREATE_COGNITO_USER_POOL = var.create_cognito_user_pool
29+
CREATE_GOOGLE_AUTH = var.create_google_auth
30+
DATABASE_URL = aws_ssm_parameter.database_url.arn
31+
GOOGLE_CLIENT_ID = var.create_google_auth ? aws_ssm_parameter.google_client_id[0].arn : ""
32+
GOOGLE_CLIENT_SECRET = var.create_google_auth ? aws_ssm_parameter.google_client_secret[0].arn : ""
33+
PHX_HOST = aws_acm_certificate.valentine.domain_name
34+
SECRET_KEY_BASE = aws_ssm_parameter.secret_key_base.arn
3335
}
3436
}
3537

‎terraform/aws/iam.tf‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,27 @@ data "aws_iam_policy_document" "valentine_secrets_manager" {
1515
actions = [
1616
"ssm:GetParameters",
1717
]
18-
resources = [
19-
aws_ssm_parameter.azure_openai_endpoint.arn,
20-
aws_ssm_parameter.azure_openai_key.arn,
21-
aws_ssm_parameter.cognito_domain.arn,
22-
aws_ssm_parameter.cognito_client_id.arn,
23-
aws_ssm_parameter.cognito_client_secret.arn,
24-
aws_ssm_parameter.cognito_user_pool_id.arn,
25-
aws_ssm_parameter.cognito_aws_region.arn,
26-
aws_ssm_parameter.database_url.arn,
27-
aws_ssm_parameter.google_client_id.arn,
28-
aws_ssm_parameter.google_client_secret.arn,
29-
aws_ssm_parameter.secret_key_base.arn
30-
]
18+
resources = concat(
19+
[
20+
aws_ssm_parameter.azure_openai_endpoint.arn,
21+
aws_ssm_parameter.azure_openai_key.arn,
22+
aws_ssm_parameter.database_url.arn,
23+
aws_ssm_parameter.secret_key_base.arn
24+
],
25+
(var.create_cognito_user_pool ?
26+
[
27+
aws_ssm_parameter.cognito_domain[0].arn,
28+
aws_ssm_parameter.cognito_client_id[0].arn,
29+
aws_ssm_parameter.cognito_client_secret[0].arn,
30+
aws_ssm_parameter.cognito_user_pool_id[0].arn,
31+
aws_ssm_parameter.cognito_aws_region[0].arn,
32+
] : []),
33+
(var.create_google_auth ?
34+
[
35+
aws_ssm_parameter.google_client_id[0].arn,
36+
aws_ssm_parameter.google_client_secret[0].arn,
37+
] : [])
38+
)
3139
}
3240
}
3341

‎terraform/aws/ssm.tf‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,11 @@ resource "aws_ssm_parameter" "azure_openai_key" {
2222
}
2323

2424
resource "aws_ssm_parameter" "cognito_domain" {
25+
count = var.create_cognito_user_pool ? 1 : 0
26+
2527
name = "cognito_domain"
2628
type = "SecureString"
27-
value = var.create_cognito_user_pool ? "${aws_cognito_user_pool_domain.domain[0].domain}.auth.${var.region}.amazoncognito.com" : ""
29+
value = "${aws_cognito_user_pool_domain.domain[0].domain}.auth.${var.region}.amazoncognito.com"
2830

2931
tags = {
3032
CostCentre = var.billing_code
@@ -33,9 +35,11 @@ resource "aws_ssm_parameter" "cognito_domain" {
3335
}
3436

3537
resource "aws_ssm_parameter" "cognito_client_id" {
38+
count = var.create_cognito_user_pool ? 1 : 0
39+
3640
name = "cognito_client_id"
3741
type = "SecureString"
38-
value = var.create_cognito_user_pool ? aws_cognito_user_pool_client.client[0].id : ""
42+
value = aws_cognito_user_pool_client.client[0].id
3943

4044
tags = {
4145
CostCentre = var.billing_code
@@ -44,9 +48,11 @@ resource "aws_ssm_parameter" "cognito_client_id" {
4448
}
4549

4650
resource "aws_ssm_parameter" "cognito_client_secret" {
51+
count = var.create_cognito_user_pool ? 1 : 0
52+
4753
name = "cognito_client_secret"
4854
type = "SecureString"
49-
value = var.create_cognito_user_pool ? aws_cognito_user_pool_client.client[0].client_secret : ""
55+
value = aws_cognito_user_pool_client.client[0].client_secret
5056

5157
tags = {
5258
CostCentre = var.billing_code
@@ -55,9 +61,11 @@ resource "aws_ssm_parameter" "cognito_client_secret" {
5561
}
5662

5763
resource "aws_ssm_parameter" "cognito_user_pool_id" {
64+
count = var.create_cognito_user_pool ? 1 : 0
65+
5866
name = "cognito_user_pool_id"
5967
type = "SecureString"
60-
value = var.create_cognito_user_pool ? aws_cognito_user_pool.valentine_user_pool[0].id : ""
68+
value = aws_cognito_user_pool.valentine_user_pool[0].id
6169

6270
tags = {
6371
CostCentre = var.billing_code
@@ -66,9 +74,11 @@ resource "aws_ssm_parameter" "cognito_user_pool_id" {
6674
}
6775

6876
resource "aws_ssm_parameter" "cognito_aws_region" {
77+
count = var.create_cognito_user_pool ? 1 : 0
78+
6979
name = "cognito_aws_region"
7080
type = "SecureString"
71-
value = var.create_cognito_user_pool ? var.region : ""
81+
value = var.region
7282

7383
tags = {
7484
CostCentre = var.billing_code
@@ -88,6 +98,8 @@ resource "aws_ssm_parameter" "database_url" {
8898
}
8999

90100
resource "aws_ssm_parameter" "google_client_id" {
101+
count = var.create_google_auth ? 1 : 0
102+
91103
name = "google_client_id"
92104
type = "SecureString"
93105
value = var.google_client_id
@@ -99,6 +111,8 @@ resource "aws_ssm_parameter" "google_client_id" {
99111
}
100112

101113
resource "aws_ssm_parameter" "google_client_secret" {
114+
count = var.create_google_auth ? 1 : 0
115+
102116
name = "google_client_secret"
103117
type = "SecureString"
104118
value = var.google_client_secret
@@ -119,3 +133,38 @@ resource "aws_ssm_parameter" "secret_key_base" {
119133
Terraform = true
120134
}
121135
}
136+
137+
moved {
138+
from = aws_ssm_parameter.cognito_aws_region
139+
to = aws_ssm_parameter.cognito_aws_region[0]
140+
}
141+
142+
moved {
143+
from = aws_ssm_parameter.cognito_client_id
144+
to = aws_ssm_parameter.cognito_client_id[0]
145+
}
146+
147+
moved {
148+
from = aws_ssm_parameter.cognito_client_secret
149+
to = aws_ssm_parameter.cognito_client_secret[0]
150+
}
151+
152+
moved {
153+
from = aws_ssm_parameter.cognito_domain
154+
to = aws_ssm_parameter.cognito_domain[0]
155+
}
156+
157+
moved {
158+
from = aws_ssm_parameter.cognito_user_pool_id
159+
to = aws_ssm_parameter.cognito_user_pool_id[0]
160+
}
161+
162+
moved {
163+
from = aws_ssm_parameter.google_client_id
164+
to = aws_ssm_parameter.google_client_id[0]
165+
}
166+
167+
moved {
168+
from = aws_ssm_parameter.google_client_secret
169+
to = aws_ssm_parameter.google_client_secret[0]
170+
}

‎terraform/aws/templates/valentine.json.tpl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
"name": "AZURE_OPENAI_KEY",
4141
"valueFrom": "${AZURE_OPENAI_KEY}"
4242
},
43+
%{ if CREATE_COGNITO_USER_POOL == "true" }
4344
{
4445
"name": "COGNITO_DOMAIN",
4546
"valueFrom": "${COGNITO_DOMAIN}"
@@ -60,10 +61,12 @@
6061
"name": "COGNITO_AWS_REGION",
6162
"valueFrom": "${COGNITO_AWS_REGION}"
6263
},
64+
%{ endif }
6365
{
6466
"name": "DATABASE_URL",
6567
"valueFrom": "${DATABASE_URL}"
6668
},
69+
%{ if CREATE_GOOGLE_AUTH == "true" }
6770
{
6871
"name": "GOOGLE_CLIENT_ID",
6972
"valueFrom": "${GOOGLE_CLIENT_ID}"
@@ -72,6 +75,7 @@
7275
"name": "GOOGLE_CLIENT_SECRET",
7376
"valueFrom": "${GOOGLE_CLIENT_SECRET}"
7477
},
78+
%{ endif }
7579
{
7680
"name": "SECRET_KEY_BASE",
7781
"valueFrom": "${SECRET_KEY_BASE}"

‎terraform/aws/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ variable "create_gh_oidc_roles" {
3030
type = bool
3131
}
3232

33+
variable "create_google_auth" {
34+
description = "Whether to create Google authentication resources"
35+
type = bool
36+
}
37+
3338
variable "domain" {
3439
description = "The domain for the application"
3540
type = string

‎terraform/env/production/terragrunt.hcl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ inputs = {
1414
billing_code = local.billing_code
1515
create_cognito_user_pool = false
1616
create_gh_oidc_roles = false
17+
create_google_auth = true
1718
domain = "valentine.cds-snc.ca"
1819
region = local.region
1920
}

‎terraform/env/user-testing/terragrunt.hcl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ inputs = {
1414
billing_code = local.billing_code
1515
create_cognito_user_pool = true
1616
create_gh_oidc_roles = true
17+
create_google_auth = false
1718
domain = "valentine-dev.cdssandbox.xyz"
1819
region = local.region
1920
}

0 commit comments

Comments
 (0)