Skip to content

Commit 4fed600

Browse files
jamesthompson26-nhsjamesthompson26-nhs
committed
CCM-11701: SSL Module
1 parent cf2ca70 commit 4fed600

6 files changed

Lines changed: 124 additions & 71 deletions

File tree

‎infrastructure/modules/ssl/README.md‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,19 @@
1212

1313
| Name | Description | Type | Default | Required |
1414
|------|-------------|------|---------|:--------:|
15-
| <a name="input_module"></a> [module](#input\_module) | The variable encapsulating the name of this module | `string` | `"fe"` | no |
16-
| <a name="input_parameter_bundle"></a> [parameter\_bundle](#input\_parameter\_bundle) | Contains all of the default parameters needed by any module in this project | <pre>object(<br/> {<br/> project = string<br/> environment = string<br/> component = string<br/> group = string<br/> region = string<br/> account_ids = map(string)<br/> account_name = string<br/> default_kms_deletion_window_in_days = number<br/> default_tags = map(string)<br/> iam_resource_arns = map(string)<br/> target_env = map(any)<br/> cicd_bucket_name = string<br/> pipeline_overrides = map(any)<br/> cloudwatch_options = map(bool)<br/> cloudwatch_metric_thresholds = map(map(string))<br/> terraform_root_dir = string<br/> }<br/> )</pre> | n/a | yes |
15+
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
16+
| <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |
17+
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
18+
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
19+
| <a name="input_name"></a> [name](#input\_name) | A unique name to distinguish this module invocation from others within the same CSI scope | `string` | n/a | yes |
20+
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
21+
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
22+
| <a name="input_subject_common_name"></a> [subject\_common\_name](#input\_subject\_common\_name) | Common name for certificate subject | `string` | n/a | yes |
23+
| <a name="input_subject_country"></a> [subject\_country](#input\_subject\_country) | Country for certificate subject | `string` | `"GB"` | no |
24+
| <a name="input_subject_locality"></a> [subject\_locality](#input\_subject\_locality) | Locality for certificate subject | `string` | `"Leeds"` | no |
25+
| <a name="input_subject_organization"></a> [subject\_organization](#input\_subject\_organization) | Organization for certificate subject | `string` | `"NHS England"` | no |
26+
| <a name="input_subject_organizational_unit"></a> [subject\_organizational\_unit](#input\_subject\_organizational\_unit) | Organizational unit for certificate subject | `string` | `"NHS Notify"` | no |
27+
| <a name="input_subject_province"></a> [subject\_province](#input\_subject\_province) | Province for certificate subject | `string` | `"West Yorkshire"` | no |
1728
| <a name="input_truststore_s3_bucket"></a> [truststore\_s3\_bucket](#input\_truststore\_s3\_bucket) | The id of the mgmt truststore s3 bucket | `string` | n/a | yes |
1829
## Modules
1930

@@ -27,4 +38,4 @@ No modules.
2738
| <a name="output_server_key"></a> [server\_key](#output\_server\_key) | Server Key |
2839
<!-- vale on -->
2940
<!-- markdownlint-enable -->
30-
<!-- END_TF_DOCS -->
41+
<!-- END_TF_DOCS -->

‎infrastructure/modules/ssl/locals.tf‎

Lines changed: 12 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,24 @@
11
locals {
2+
module = "ssl"
3+
24
# Compound Scope Identifier
35
csi = replace(
46
format(
57
"%s-%s-%s-%s",
6-
var.parameter_bundle.project,
7-
var.parameter_bundle.environment,
8-
var.parameter_bundle.component,
9-
var.module,
8+
var.project,
9+
var.environment,
10+
var.component,
11+
var.name
1012
),
1113
"_",
1214
"",
1315
)
1416

15-
# CSI for use in resources with a global namespace, i.e. S3 Buckets
16-
csi_global = replace(
17-
format(
18-
"%s-%s-%s-%s-%s-%s",
19-
var.parameter_bundle.project,
20-
local.this_account,
21-
var.parameter_bundle.region,
22-
var.parameter_bundle.environment,
23-
var.parameter_bundle.component,
24-
var.module,
25-
),
26-
"_",
27-
"",
17+
default_tags = merge(
18+
var.default_tags,
19+
{
20+
Module = local.module
21+
Name = local.csi
22+
},
2823
)
29-
30-
default_tags = {
31-
Module = var.module,
32-
}
33-
34-
this_account = var.parameter_bundle.account_ids[var.parameter_bundle.account_name]
3524
}

‎infrastructure/modules/ssl/module_ssm_parameters.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_ssm_parameter" "server_key" {
2-
name = format("/%s/%s/${var.module}/server-key", var.parameter_bundle.project, var.parameter_bundle.environment)
2+
name = format("/%s/%s/${local.module}/server-key", var.project, var.environment)
33
type = "SecureString"
44
value = tls_private_key.integration_testing_client_key.private_key_pem
55

@@ -9,7 +9,7 @@ resource "aws_ssm_parameter" "server_key" {
99
}
1010

1111
resource "aws_ssm_parameter" "server_crt" {
12-
name = format("/%s/%s/${var.module}/server-crt", var.parameter_bundle.project, var.parameter_bundle.environment)
12+
name = format("/%s/%s/${local.module}/server-crt", var.project, var.environment)
1313
type = "SecureString"
1414
value = tls_locally_signed_cert.integration_testing_client_cert.cert_pem
1515

@@ -19,7 +19,7 @@ resource "aws_ssm_parameter" "server_crt" {
1919
}
2020

2121
resource "aws_ssm_parameter" "ca_crt" {
22-
name = format("/%s/%s/${var.module}/ca-crt", var.parameter_bundle.project, var.parameter_bundle.environment)
22+
name = format("/%s/%s/${local.module}/ca-crt", var.project, var.environment)
2323
type = "SecureString"
2424
value = tls_self_signed_cert.ca_cert.cert_pem
2525

@@ -29,7 +29,7 @@ resource "aws_ssm_parameter" "ca_crt" {
2929
}
3030

3131
resource "aws_ssm_parameter" "ca_key" {
32-
name = format("/%s/%s/${var.module}/ca-key", var.parameter_bundle.project, var.parameter_bundle.environment)
32+
name = format("/%s/%s/${local.module}/ca-key", var.project, var.environment)
3333
type = "SecureString"
3434
value = tls_private_key.ca_key.private_key_pem
3535

‎infrastructure/modules/ssl/tls_cert_request_server_csr.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ resource "tls_cert_request" "server_csr" {
22

33
private_key_pem = tls_private_key.integration_testing_client_key.private_key_pem
44

5-
dns_names = ["${var.module}.${var.parameter_bundle.environment}.communications.national.nhs.uk"]
5+
dns_names = [var.subject_common_name]
66

77
subject {
8-
country = "GB"
9-
province = "West Yorkshire"
10-
locality = "Leeds"
11-
common_name = "${var.module}.${var.parameter_bundle.environment}.communications.national.nhs.uk"
12-
organization = "NHS England"
13-
organizational_unit = "NHS Notify"
8+
country = var.subject_country
9+
province = var.subject_province
10+
locality = var.subject_locality
11+
common_name = var.subject_common_name
12+
organization = var.subject_organization
13+
organizational_unit = var.subject_organizational_unit
1414
}
1515

1616
depends_on = [

‎infrastructure/modules/ssl/tls_self_signed_cert_ca_cert.tf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ resource "tls_self_signed_cert" "ca_cert" {
44
is_ca_certificate = true
55

66
subject {
7-
country = "GB"
8-
province = "West Yorkshire"
9-
locality = "Leeds"
10-
common_name = "${var.module}.${var.parameter_bundle.environment}-ca.communications.national.nhs.uk"
11-
organization = "NHS England"
12-
organizational_unit = "NHS Notify"
7+
country = var.subject_country
8+
province = var.subject_province
9+
locality = var.subject_locality
10+
common_name = var.subject_common_name
11+
organization = var.subject_organization
12+
organizational_unit = var.subject_organizational_unit
1313
}
1414

1515
validity_period_hours = 17520

‎infrastructure/modules/ssl/variables.tf‎

Lines changed: 81 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,87 @@
1-
variable "module" {
2-
type = string
3-
description = "The variable encapsulating the name of this module"
4-
default = "fe"
5-
}
6-
7-
variable "parameter_bundle" {
8-
type = object(
9-
{
10-
project = string
11-
environment = string
12-
component = string
13-
group = string
14-
region = string
15-
account_ids = map(string)
16-
account_name = string
17-
default_kms_deletion_window_in_days = number
18-
default_tags = map(string)
19-
iam_resource_arns = map(string)
20-
target_env = map(any)
21-
cicd_bucket_name = string
22-
pipeline_overrides = map(any)
23-
cloudwatch_options = map(bool)
24-
cloudwatch_metric_thresholds = map(map(string))
25-
terraform_root_dir = string
26-
}
27-
)
28-
description = "Contains all of the default parameters needed by any module in this project"
1+
##
2+
# Basic Required Variables for tfscaffold Modules
3+
##
4+
5+
variable "project" {
6+
type = string
7+
description = "The name of the tfscaffold project"
8+
}
9+
10+
variable "environment" {
11+
type = string
12+
description = "The name of the tfscaffold environment"
13+
}
14+
15+
variable "component" {
16+
type = string
17+
description = "The name of the tfscaffold component"
18+
}
19+
20+
variable "aws_account_id" {
21+
type = string
22+
description = "The AWS Account ID (numeric)"
23+
}
24+
25+
variable "region" {
26+
type = string
27+
description = "The AWS Region"
28+
}
29+
30+
##
31+
# tfscaffold variables specific to this module
32+
##
33+
34+
variable "default_tags" {
35+
type = map(string)
36+
description = "A map of default tags to apply to all taggable resources within the component"
37+
default = {}
2938
}
3039

40+
##
41+
# Variables specific to this module
42+
##
43+
3144
variable "truststore_s3_bucket" {
3245
type = string
3346
description = "The id of the mgmt truststore s3 bucket"
3447
}
48+
49+
variable "name" {
50+
type = string
51+
description = "A unique name to distinguish this module invocation from others within the same CSI scope"
52+
}
53+
54+
variable "subject_country" {
55+
type = string
56+
description = "Country for certificate subject"
57+
default = "GB"
58+
}
59+
60+
variable "subject_province" {
61+
type = string
62+
description = "Province for certificate subject"
63+
default = "West Yorkshire"
64+
}
65+
66+
variable "subject_locality" {
67+
type = string
68+
description = "Locality for certificate subject"
69+
default = "Leeds"
70+
}
71+
72+
variable "subject_common_name" {
73+
type = string
74+
description = "Common name for certificate subject"
75+
}
76+
77+
variable "subject_organization" {
78+
type = string
79+
description = "Organization for certificate subject"
80+
default = "NHS England"
81+
}
82+
83+
variable "subject_organizational_unit" {
84+
type = string
85+
description = "Organizational unit for certificate subject"
86+
default = "NHS Notify"
87+
}

0 commit comments

Comments
 (0)