Skip to content

Commit 30d068d

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
Merge pull request #107 from NHSDigital/feature/CCM-11701_SSL_Module
CCM-11701: SSL Module
2 parents 711505d + 8882955 commit 30d068d

16 files changed

Lines changed: 290 additions & 2 deletions

‎.github/actions/trivy/action.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,13 @@ runs:
88
components_exit_code=0
99
modules_exit_code=0
1010
11-
./scripts/terraform/trivy.sh ./infrastructure/terraform/components || components_exit_code=$?
12-
./scripts/terraform/trivy.sh ./infrastructure/terraform/modules || modules_exit_code=$?
11+
if [ -d ./infrastructure/terraform/components ]; then
12+
./scripts/terraform/trivy.sh ./infrastructure/terraform/components || components_exit_code=$?
13+
fi
14+
15+
if [ -d ./infrastructure/terraform/modules ]; then
16+
./scripts/terraform/trivy.sh ./infrastructure/terraform/modules || modules_exit_code=$?
17+
fi
1318
1419
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
1520
echo "Trivy misconfigurations detected."

‎infrastructure/modules/ssl/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
<!-- markdownlint-disable -->
3+
<!-- vale off -->
4+
5+
## Requirements
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.10.1 |
10+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | 4.1.0 |
11+
## Inputs
12+
13+
| Name | Description | Type | Default | Required |
14+
|------|-------------|------|---------|:--------:|
15+
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
16+
| <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |
17+
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
18+
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
19+
| <a name="input_name"></a> [name](#input\_name) | A unique name to distinguish this module invocation from others within the same CSI scope | `string` | n/a | yes |
20+
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
21+
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
22+
| <a name="input_subject_common_name"></a> [subject\_common\_name](#input\_subject\_common\_name) | Common name for certificate subject | `string` | n/a | yes |
23+
| <a name="input_subject_country"></a> [subject\_country](#input\_subject\_country) | Country for certificate subject | `string` | `"GB"` | no |
24+
| <a name="input_subject_locality"></a> [subject\_locality](#input\_subject\_locality) | Locality for certificate subject | `string` | `"Leeds"` | no |
25+
| <a name="input_subject_organization"></a> [subject\_organization](#input\_subject\_organization) | Organization for certificate subject | `string` | `"NHS England"` | no |
26+
| <a name="input_subject_organizational_unit"></a> [subject\_organizational\_unit](#input\_subject\_organizational\_unit) | Organizational unit for certificate subject | `string` | `"NHS Notify"` | no |
27+
| <a name="input_subject_province"></a> [subject\_province](#input\_subject\_province) | Province for certificate subject | `string` | `"West Yorkshire"` | no |
28+
## Modules
29+
30+
No modules.
31+
## Outputs
32+
33+
| Name | Description |
34+
|------|-------------|
35+
| <a name="output_cacert_pem"></a> [cacert\_pem](#output\_cacert\_pem) | Truststore |
36+
| <a name="output_server_crt"></a> [server\_crt](#output\_server\_crt) | Server Certificate |
37+
| <a name="output_server_key"></a> [server\_key](#output\_server\_key) | Server Key |
38+
<!-- vale on -->
39+
<!-- markdownlint-enable -->
40+
<!-- END_TF_DOCS -->

‎infrastructure/modules/ssl/locals.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
locals {
2+
module = "ssl"
3+
4+
# Compound Scope Identifier
5+
csi = replace(
6+
format(
7+
"%s-%s-%s-%s",
8+
var.project,
9+
var.environment,
10+
var.component,
11+
var.name
12+
),
13+
"_",
14+
"",
15+
)
16+
17+
default_tags = merge(
18+
var.default_tags,
19+
{
20+
Module = local.module
21+
Name = local.csi
22+
},
23+
)
24+
}

‎infrastructure/modules/ssl/outputs.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
output "server_crt" {
2+
description = "Server Certificate"
3+
value = tls_locally_signed_cert.integration_testing_client_cert.cert_pem
4+
sensitive = true
5+
}
6+
7+
output "server_key" {
8+
description = "Server Key"
9+
value = tls_private_key.integration_testing_client_key.private_key_pem
10+
sensitive = true
11+
}
12+
13+
output "cacert_pem" {
14+
description = "Truststore"
15+
value = tls_self_signed_cert.ca_cert.cert_pem
16+
sensitive = true
17+
}

‎infrastructure/modules/ssl/providers.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
}
6+
tls = {
7+
source = "hashicorp/tls"
8+
version = "4.1.0"
9+
}
10+
}
11+
}

‎infrastructure/modules/ssl/ssm_parameter_ca_crt.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_ssm_parameter" "ca_crt" {
2+
name = format("/%s/%s/${local.module}/ca-crt", var.project, var.environment)
3+
type = "SecureString"
4+
value = tls_self_signed_cert.ca_cert.cert_pem
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}

‎infrastructure/modules/ssl/ssm_parameter_ca_key.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_ssm_parameter" "ca_key" {
2+
name = format("/%s/%s/${local.module}/ca-key", var.project, var.environment)
3+
type = "SecureString"
4+
value = tls_private_key.ca_key.private_key_pem
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}

‎infrastructure/modules/ssl/ssm_parameter_server_crt.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_ssm_parameter" "server_crt" {
2+
name = format("/%s/%s/${local.module}/server-crt", var.project, var.environment)
3+
type = "SecureString"
4+
value = tls_locally_signed_cert.integration_testing_client_cert.cert_pem
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}

‎infrastructure/modules/ssl/ssm_parameter_server_key.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_ssm_parameter" "server_key" {
2+
name = format("/%s/%s/${local.module}/server-key", var.project, var.environment)
3+
type = "SecureString"
4+
value = tls_private_key.integration_testing_client_key.private_key_pem
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}

‎infrastructure/modules/ssl/tls_cert_request_server_csr.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "tls_cert_request" "server_csr" {
2+
3+
private_key_pem = tls_private_key.integration_testing_client_key.private_key_pem
4+
5+
dns_names = [var.subject_common_name]
6+
7+
subject {
8+
country = var.subject_country
9+
province = var.subject_province
10+
locality = var.subject_locality
11+
common_name = var.subject_common_name
12+
organization = var.subject_organization
13+
organizational_unit = var.subject_organizational_unit
14+
}
15+
16+
depends_on = [
17+
tls_private_key.integration_testing_client_key,
18+
]
19+
}

0 commit comments

Comments
 (0)