Skip to content

Commit cf2ca70

Browse files
jamesthompson26-nhsjamesthompson26-nhs
committed
CCM-11701: SSL Module
1 parent 711505d commit cf2ca70

12 files changed

Lines changed: 239 additions & 0 deletions

‎infrastructure/modules/ssl/README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
<!-- markdownlint-disable -->
3+
<!-- vale off -->
4+
5+
## Requirements
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.10.1 |
10+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | 4.0.5 |
11+
## Inputs
12+
13+
| Name | Description | Type | Default | Required |
14+
|------|-------------|------|---------|:--------:|
15+
| <a name="input_module"></a> [module](#input\_module) | The variable encapsulating the name of this module | `string` | `"fe"` | no |
16+
| <a name="input_parameter_bundle"></a> [parameter\_bundle](#input\_parameter\_bundle) | Contains all of the default parameters needed by any module in this project | <pre>object(<br/> {<br/> project = string<br/> environment = string<br/> component = string<br/> group = string<br/> region = string<br/> account_ids = map(string)<br/> account_name = string<br/> default_kms_deletion_window_in_days = number<br/> default_tags = map(string)<br/> iam_resource_arns = map(string)<br/> target_env = map(any)<br/> cicd_bucket_name = string<br/> pipeline_overrides = map(any)<br/> cloudwatch_options = map(bool)<br/> cloudwatch_metric_thresholds = map(map(string))<br/> terraform_root_dir = string<br/> }<br/> )</pre> | n/a | yes |
17+
| <a name="input_truststore_s3_bucket"></a> [truststore\_s3\_bucket](#input\_truststore\_s3\_bucket) | The id of the mgmt truststore s3 bucket | `string` | n/a | yes |
18+
## Modules
19+
20+
No modules.
21+
## Outputs
22+
23+
| Name | Description |
24+
|------|-------------|
25+
| <a name="output_cacert_pem"></a> [cacert\_pem](#output\_cacert\_pem) | Truststore |
26+
| <a name="output_server_crt"></a> [server\_crt](#output\_server\_crt) | Server Certificate |
27+
| <a name="output_server_key"></a> [server\_key](#output\_server\_key) | Server Key |
28+
<!-- vale on -->
29+
<!-- markdownlint-enable -->
30+
<!-- END_TF_DOCS -->

‎infrastructure/modules/ssl/locals.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
locals {
2+
# Compound Scope Identifier
3+
csi = replace(
4+
format(
5+
"%s-%s-%s-%s",
6+
var.parameter_bundle.project,
7+
var.parameter_bundle.environment,
8+
var.parameter_bundle.component,
9+
var.module,
10+
),
11+
"_",
12+
"",
13+
)
14+
15+
# CSI for use in resources with a global namespace, i.e. S3 Buckets
16+
csi_global = replace(
17+
format(
18+
"%s-%s-%s-%s-%s-%s",
19+
var.parameter_bundle.project,
20+
local.this_account,
21+
var.parameter_bundle.region,
22+
var.parameter_bundle.environment,
23+
var.parameter_bundle.component,
24+
var.module,
25+
),
26+
"_",
27+
"",
28+
)
29+
30+
default_tags = {
31+
Module = var.module,
32+
}
33+
34+
this_account = var.parameter_bundle.account_ids[var.parameter_bundle.account_name]
35+
}

‎infrastructure/modules/ssl/module_ssm_parameters.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
resource "aws_ssm_parameter" "server_key" {
2+
name = format("/%s/%s/${var.module}/server-key", var.parameter_bundle.project, var.parameter_bundle.environment)
3+
type = "SecureString"
4+
value = tls_private_key.integration_testing_client_key.private_key_pem
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}
10+
11+
resource "aws_ssm_parameter" "server_crt" {
12+
name = format("/%s/%s/${var.module}/server-crt", var.parameter_bundle.project, var.parameter_bundle.environment)
13+
type = "SecureString"
14+
value = tls_locally_signed_cert.integration_testing_client_cert.cert_pem
15+
16+
lifecycle {
17+
create_before_destroy = true
18+
}
19+
}
20+
21+
resource "aws_ssm_parameter" "ca_crt" {
22+
name = format("/%s/%s/${var.module}/ca-crt", var.parameter_bundle.project, var.parameter_bundle.environment)
23+
type = "SecureString"
24+
value = tls_self_signed_cert.ca_cert.cert_pem
25+
26+
lifecycle {
27+
create_before_destroy = true
28+
}
29+
}
30+
31+
resource "aws_ssm_parameter" "ca_key" {
32+
name = format("/%s/%s/${var.module}/ca-key", var.parameter_bundle.project, var.parameter_bundle.environment)
33+
type = "SecureString"
34+
value = tls_private_key.ca_key.private_key_pem
35+
36+
lifecycle {
37+
create_before_destroy = true
38+
}
39+
}

‎infrastructure/modules/ssl/outputs.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
output "server_crt" {
2+
description = "Server Certificate"
3+
value = tls_locally_signed_cert.integration_testing_client_cert.cert_pem
4+
sensitive = true
5+
}
6+
7+
output "server_key" {
8+
description = "Server Key"
9+
value = tls_private_key.integration_testing_client_key.private_key_pem
10+
sensitive = true
11+
}
12+
13+
output "cacert_pem" {
14+
description = "Truststore"
15+
value = tls_self_signed_cert.ca_cert.cert_pem
16+
sensitive = true
17+
}

‎infrastructure/modules/ssl/providers.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
}
6+
tls = {
7+
source = "hashicorp/tls"
8+
version = "4.0.5"
9+
}
10+
}
11+
}

‎infrastructure/modules/ssl/tls_cert_request_server_csr.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "tls_cert_request" "server_csr" {
2+
3+
private_key_pem = tls_private_key.integration_testing_client_key.private_key_pem
4+
5+
dns_names = ["${var.module}.${var.parameter_bundle.environment}.communications.national.nhs.uk"]
6+
7+
subject {
8+
country = "GB"
9+
province = "West Yorkshire"
10+
locality = "Leeds"
11+
common_name = "${var.module}.${var.parameter_bundle.environment}.communications.national.nhs.uk"
12+
organization = "NHS England"
13+
organizational_unit = "NHS Notify"
14+
}
15+
16+
depends_on = [
17+
tls_private_key.integration_testing_client_key,
18+
]
19+
}

‎infrastructure/modules/ssl/tls_locally_signed_cert_server_cert.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "tls_locally_signed_cert" "integration_testing_client_cert" {
2+
cert_request_pem = tls_cert_request.server_csr.cert_request_pem
3+
ca_private_key_pem = tls_private_key.ca_key.private_key_pem
4+
ca_cert_pem = tls_self_signed_cert.ca_cert.cert_pem
5+
6+
validity_period_hours = 8760
7+
8+
allowed_uses = [
9+
"digital_signature",
10+
"key_encipherment",
11+
"server_auth",
12+
"client_auth",
13+
]
14+
15+
depends_on = [
16+
tls_private_key.ca_key,
17+
tls_self_signed_cert.ca_cert,
18+
tls_private_key.integration_testing_client_key,
19+
tls_cert_request.server_csr
20+
]
21+
}

‎infrastructure/modules/ssl/tls_private_key_ca_key.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
resource "tls_private_key" "ca_key" {
2+
algorithm = "RSA"
3+
rsa_bits = 4096
4+
}

‎infrastructure/modules/ssl/tls_private_key_server_key.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
resource "tls_private_key" "integration_testing_client_key" {
2+
algorithm = "RSA"
3+
rsa_bits = 4096
4+
}

‎infrastructure/modules/ssl/tls_self_signed_cert_ca_cert.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
resource "tls_self_signed_cert" "ca_cert" {
2+
private_key_pem = tls_private_key.ca_key.private_key_pem
3+
4+
is_ca_certificate = true
5+
6+
subject {
7+
country = "GB"
8+
province = "West Yorkshire"
9+
locality = "Leeds"
10+
common_name = "${var.module}.${var.parameter_bundle.environment}-ca.communications.national.nhs.uk"
11+
organization = "NHS England"
12+
organizational_unit = "NHS Notify"
13+
}
14+
15+
validity_period_hours = 17520
16+
17+
allowed_uses = [
18+
"digital_signature",
19+
"cert_signing",
20+
"crl_signing",
21+
]
22+
}

0 commit comments

Comments
 (0)