acm Upstream (cloudposse/terraform-aws-components#756)

Co-authored-by: Dan Miller <[email protected]>
Co-authored-by: cloudpossebot <[email protected]>

src/README.md

@@ -6,7 +6,6 @@ The ACM component is to manage an unlimited number of certificates, predominantl
 
 We have, as a convenience, the ability to create an ACM certificate as part of creating a DNS zone, whether primary or delegated. That convenience is limited to creating `example.com` and `*.example.com` when creating a zone for `example.com`. For example, Acme has delegated `acct.acme.com` and in addition to `*.acct.acme.com` needed an ACM certificate for `*.usw2.acct.acme.com`, so we use the ACM component to provision that, rather than extend the DNS primary or delegated components to take a list of additional certificates. Both are different views on the Single Responsibility Principle.
 
-
 ## Usage
 
 **Stack Level**: Global or Regional
@@ -70,8 +69,9 @@ components:
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_acm"></a> [acm](#module\_acm) | cloudposse/acm-request-certificate/aws | 0.16.0 |
+| <a name="module_dns_delegated"></a> [dns\_delegated](#module\_dns\_delegated) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.3 |
 | <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a |
-| <a name="module_private_ca"></a> [private\_ca](#module\_private\_ca) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.1 |
+| <a name="module_private_ca"></a> [private\_ca](#module\_private\_ca) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.3 |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
 ## Resources
@@ -95,9 +95,12 @@ components:
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
+| <a name="input_dns_delegated_component_name"></a> [dns\_delegated\_component\_name](#input\_dns\_delegated\_component\_name) | Use this component name to read from the remote state to get the dns\_delegated zone ID | `string` | `"dns-delegated"` | no |
+| <a name="input_dns_delegated_environment_name"></a> [dns\_delegated\_environment\_name](#input\_dns\_delegated\_environment\_name) | Use this environment name to read from the remote state to get the dns\_delegated zone ID | `string` | `"gbl"` | no |
+| <a name="input_dns_delegated_stage_name"></a> [dns\_delegated\_stage\_name](#input\_dns\_delegated\_stage\_name) | Use this stage name to read from the remote state to get the dns\_delegated zone ID | `string` | `null` | no |
 | <a name="input_dns_private_zone_enabled"></a> [dns\_private\_zone\_enabled](#input\_dns\_private\_zone\_enabled) | Whether to set the zone to public or private | `bool` | `false` | no |
-| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | Root domain name | `string` | n/a | yes |
-| <a name="input_enable_asterisk_subject_alternative_name"></a> [enable\_asterisk\_subject\_alternative\_name](#input\_enable\_asterisk\_subject\_alternative\_name) | Enable or disable the use of a wildcard domain in the subject alternative names | `bool` | `true` | no |
+| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | Root domain name | `string` | `""` | no |
+| <a name="input_domain_name_prefix"></a> [domain\_name\_prefix](#input\_domain\_name\_prefix) | Root domain name prefix to use with DNS delegated remote state | `string` | `""` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
@@ -112,6 +115,7 @@ components:
 | <a name="input_region"></a> [region](#input\_region) | AWS Region | `string` | n/a | yes |
 | <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
 | <a name="input_subject_alternative_names"></a> [subject\_alternative\_names](#input\_subject\_alternative\_names) | A list of domains that should be SANs in the issued certificate | `list(string)` | `[]` | no |
+| <a name="input_subject_alternative_names_prefixes"></a> [subject\_alternative\_names\_prefixes](#input\_subject\_alternative\_names\_prefixes) | A list of domain prefixes to use with DNS delegated remote state that should be SANs in the issued certificate | `list(string)` | `[]` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
 | <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
 | <a name="input_validation_method"></a> [validation\_method](#input\_validation\_method) | Method to use for validation, DNS or EMAIL | `string` | `"DNS"` | no |

src/main.tf

@@ -1,14 +1,21 @@
 locals {
   enabled = module.this.enabled
 
+  domain_suffix = format("%s.%s", var.environment, module.dns_delegated.outputs.default_domain_name)
+
+  domain_name = length(var.domain_name) > 0 ? var.domain_name : format("%s.%s", var.domain_name_prefix, local.domain_suffix)
+
+  subject_alternative_names = concat(var.subject_alternative_names, formatlist("%s.${local.domain_suffix}", var.subject_alternative_names_prefixes))
+  all_sans                  = distinct(concat([format("*.%s", local.domain_name)], local.subject_alternative_names))
+
   private_enabled = local.enabled && var.dns_private_zone_enabled
 
   private_ca_enabled = local.private_enabled && var.certificate_authority_enabled
 }
 
 data "aws_route53_zone" "default" {
   count        = local.enabled ? 1 : 0
-  name         = var.zone_name
+  name         = length(var.zone_name) > 0 ? var.zone_name : module.dns_delegated.outputs.default_domain_name
   private_zone = local.private_enabled
 }
 
@@ -19,10 +26,10 @@ module "acm" {
 
   certificate_authority_arn         = local.private_ca_enabled ? module.private_ca[0].outputs.private_ca[var.certificate_authority_component_key].certificate_authority.arn : null
   validation_method                 = local.private_ca_enabled ? null : var.validation_method
-  domain_name                       = var.domain_name
+  domain_name                       = local.domain_name
   process_domain_validation_options = var.process_domain_validation_options
   ttl                               = 300
-  subject_alternative_names         = concat(var.enable_asterisk_subject_alternative_name ? [format("*.%s", var.domain_name)] : [], var.subject_alternative_names)
+  subject_alternative_names         = local.all_sans
   zone_id                           = join("", data.aws_route53_zone.default.*.zone_id)
 
   context = module.this.context
@@ -31,9 +38,9 @@ module "acm" {
 resource "aws_ssm_parameter" "acm_arn" {
   count = local.enabled ? 1 : 0
 
-  name        = "/acm/${var.domain_name}"
+  name        = "/acm/${local.domain_name}"
   value       = module.acm.arn
-  description = format("ACM certificate ARN for '%s' domain", var.domain_name)
+  description = format("ACM certificate ARN for '%s' domain", local.domain_name)
   type        = "String"
   overwrite   = true
 

src/outputs.tf

@@ -14,6 +14,6 @@ output "domain_validation_options" {
 }
 
 output "domain_name" {
-  value       = local.enabled ? var.domain_name : null
+  value       = local.enabled ? local.domain_name : null
   description = "Certificate domain name"
 }

src/remote-state.tf

@@ -1,6 +1,6 @@
 module "private_ca" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.4.1"
+  version = "1.4.3"
 
   count = local.private_ca_enabled ? 1 : 0
 
@@ -10,3 +10,14 @@ module "private_ca" {
 
   context = module.this.context
 }
+
+module "dns_delegated" {
+  source  = "cloudposse/stack-config/yaml//modules/remote-state"
+  version = "1.4.3"
+
+  component   = var.dns_delegated_component_name
+  stage       = var.dns_delegated_stage_name
+  environment = var.dns_delegated_environment_name
+
+  context = module.this.context
+}

src/variables.tf

@@ -6,6 +6,13 @@ variable "region" {
 variable "domain_name" {
   type        = string
   description = "Root domain name"
+  default     = ""
+}
+
+variable "domain_name_prefix" {
+  type        = string
+  description = "Root domain name prefix to use with DNS delegated remote state"
+  default     = ""
 }
 
 variable "zone_name" {
@@ -35,6 +42,12 @@ variable "subject_alternative_names" {
   description = "A list of domains that should be SANs in the issued certificate"
 }
 
+variable "subject_alternative_names_prefixes" {
+  type        = list(string)
+  default     = []
+  description = "A list of domain prefixes to use with DNS delegated remote state that should be SANs in the issued certificate"
+}
+
 variable "dns_private_zone_enabled" {
   type        = bool
   description = "Whether to set the zone to public or private"
@@ -71,8 +84,20 @@ variable "certificate_authority_component_key" {
   description = "Use this component key e.g. `root` or `mgmt` to read from the remote state to get the certificate_authority_arn if using an authority type of SUBORDINATE"
 }
 
-variable "enable_asterisk_subject_alternative_name" {
-  type        = bool
-  default     = true
-  description = "Enable or disable the use of a wildcard domain in the subject alternative names"
+variable "dns_delegated_stage_name" {
+  type        = string
+  default     = null
+  description = "Use this stage name to read from the remote state to get the dns_delegated zone ID"
+}
+
+variable "dns_delegated_environment_name" {
+  type        = string
+  default     = "gbl"
+  description = "Use this environment name to read from the remote state to get the dns_delegated zone ID"
+}
+
+variable "dns_delegated_component_name" {
+  type        = string
+  default     = "dns-delegated"
+  description = "Use this component name to read from the remote state to get the dns_delegated zone ID"
 }