Skip to content

Commit 9f03c7a

Browse files
magreenbaummagreenbaum
authored
feat: Added support for ALB trust store (#344)
1 parent eb1a918 commit 9f03c7a

File tree

24 files changed

+935
-9
lines changed

24 files changed

+935
-9
lines changed

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,9 @@ terraform.rc
3030

3131
# Zip archive
3232
*.zip
33+
34+
# Ignore cert generation files
35+
*.pem
36+
*.key
37+
*.csr
38+
**/cert_files/*

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,13 @@ See [patterns.md](https://github.com/terraform-aws-modules/terraform-aws-alb/blo
349349
| Name | Version |
350350
|------|---------|
351351
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
352-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.31 |
352+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.33 |
353353

354354
## Providers
355355

356356
| Name | Version |
357357
|------|---------|
358-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.31 |
358+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.33 |
359359

360360
## Modules
361361

‎examples/complete-alb/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.31 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.33 |
2424
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
2525

2626
## Providers
2727

2828
| Name | Version |
2929
|------|---------|
30-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.31 |
30+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.33 |
3131
| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
3232

3333
## Modules

‎examples/complete-alb/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.31"
7+
version = ">= 5.33"
88
}
99
null = {
1010
source = "hashicorp/null"

‎examples/complete-nlb/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ Note that this example may create resources which cost money. Run `terraform des
2020
| Name | Version |
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.31 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.33 |
2424

2525
## Providers
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.31 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.33 |
3030

3131
## Modules
3232

‎examples/complete-nlb/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.31"
7+
version = ">= 5.33"
88
}
99
}
1010
}

‎examples/mutual-auth-alb/README.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Mutual Authentication ALB Example
2+
3+
Configuration in this directory creates an Application Load Balancer, a self-signed CA bundle, and load balancer trust store for mutual authentication.
4+
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/mutual-authentication.html
5+
6+
## Usage
7+
8+
To run this example you need to execute:
9+
10+
```bash
11+
$ terraform init
12+
$ terraform plan
13+
$ terraform apply
14+
```
15+
16+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
17+
18+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
19+
## Requirements
20+
21+
| Name | Version |
22+
|------|---------|
23+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
24+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.33 |
25+
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
26+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4.0 |
27+
28+
## Providers
29+
30+
| Name | Version |
31+
|------|---------|
32+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.33 |
33+
| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
34+
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 4.0 |
35+
36+
## Modules
37+
38+
| Name | Source | Version |
39+
|------|--------|---------|
40+
| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | ~> 4.0 |
41+
| <a name="module_alb"></a> [alb](#module\_alb) | ../../ | n/a |
42+
| <a name="module_ca_cert_object"></a> [ca\_cert\_object](#module\_ca\_cert\_object) | terraform-aws-modules/s3-bucket/aws//modules/object | n/a |
43+
| <a name="module_certificate_bucket"></a> [certificate\_bucket](#module\_certificate\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
44+
| <a name="module_crl_object"></a> [crl\_object](#module\_crl\_object) | terraform-aws-modules/s3-bucket/aws//modules/object | n/a |
45+
| <a name="module_log_bucket"></a> [log\_bucket](#module\_log\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
46+
| <a name="module_trust_store"></a> [trust\_store](#module\_trust\_store) | ../../modules/lb_trust_store | n/a |
47+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
48+
49+
## Resources
50+
51+
| Name | Type |
52+
|------|------|
53+
| [aws_instance.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
54+
| [null_resource.generate_crl](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
55+
| [tls_cert_request.my_client](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/cert_request) | resource |
56+
| [tls_cert_request.my_client_revoked](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/cert_request) | resource |
57+
| [tls_locally_signed_cert.my_client](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/locally_signed_cert) | resource |
58+
| [tls_locally_signed_cert.my_client_revoked](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/locally_signed_cert) | resource |
59+
| [tls_private_key.my_client](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
60+
| [tls_private_key.my_client_revoked](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
61+
| [tls_private_key.root_ca](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
62+
| [tls_self_signed_cert.root_ca](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |
63+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
64+
| [aws_route53_zone.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
65+
| [aws_ssm_parameter.al2](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
66+
67+
## Inputs
68+
69+
| Name | Description | Type | Default | Required |
70+
|------|-------------|------|---------|:--------:|
71+
| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | The domain name for which the certificate should be issued | `string` | `"terraform-aws-modules.modules.tf"` | no |
72+
73+
## Outputs
74+
75+
| Name | Description |
76+
|------|-------------|
77+
| <a name="output_arn"></a> [arn](#output\_arn) | The ID and ARN of the load balancer we created |
78+
| <a name="output_arn_suffix"></a> [arn\_suffix](#output\_arn\_suffix) | ARN suffix of our load balancer - can be used with CloudWatch |
79+
| <a name="output_dns_name"></a> [dns\_name](#output\_dns\_name) | The DNS name of the load balancer |
80+
| <a name="output_id"></a> [id](#output\_id) | The ID and ARN of the load balancer we created |
81+
| <a name="output_listener_rules"></a> [listener\_rules](#output\_listener\_rules) | Map of listeners rules created and their attributes |
82+
| <a name="output_listeners"></a> [listeners](#output\_listeners) | Map of listeners created and their attributes |
83+
| <a name="output_route53_records"></a> [route53\_records](#output\_route53\_records) | The Route53 records created and attached to the load balancer |
84+
| <a name="output_security_group_arn"></a> [security\_group\_arn](#output\_security\_group\_arn) | Amazon Resource Name (ARN) of the security group |
85+
| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | ID of the security group |
86+
| <a name="output_target_groups"></a> [target\_groups](#output\_target\_groups) | Map of target groups created and their attributes |
87+
| <a name="output_trust_store"></a> [trust\_store](#output\_trust\_store) | Map of trust store attributes |
88+
| <a name="output_zone_id"></a> [zone\_id](#output\_zone\_id) | The zone\_id of the load balancer to assist with creating DNS records |
89+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/mutual-auth-alb/ca.conf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# This file is for example purposes only
2+
[ca]
3+
default_ca = root_ca
4+
5+
[root_ca]
6+
dir = ./cert_files/
7+
new_certs_dir = $dir
8+
database = $dir/crl_index
9+
serial = $dir/cert_serial
10+
default_md = sha256
11+
crlnumber = $dir/crl_number
12+
default_crl_days = 365
13+
14+
[crl_ext]
15+
authorityKeyIdentifier = keyid:always

0 commit comments

Comments
 (0)