diff --git a/src/README.md b/src/README.md index 82d3527..88c7297 100644 --- a/src/README.md +++ b/src/README.md @@ -6,7 +6,6 @@ The ACM component is to manage an unlimited number of certificates, predominantl We have, as a convenience, the ability to create an ACM certificate as part of creating a DNS zone, whether primary or delegated. That convenience is limited to creating `example.com` and `*.example.com` when creating a zone for `example.com`. For example, Acme has delegated `acct.acme.com` and in addition to `*.acct.acme.com` needed an ACM certificate for `*.usw2.acct.acme.com`, so we use the ACM component to provision that, rather than extend the DNS primary or delegated components to take a list of additional certificates. Both are different views on the Single Responsibility Principle. - ## Usage **Stack Level**: Global or Regional @@ -70,8 +69,9 @@ components: | Name | Source | Version | |------|--------|---------| | [acm](#module\_acm) | cloudposse/acm-request-certificate/aws | 0.16.0 | +| [dns\_delegated](#module\_dns\_delegated) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.3 | | [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a | -| [private\_ca](#module\_private\_ca) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.1 | +| [private\_ca](#module\_private\_ca) | cloudposse/stack-config/yaml//modules/remote-state | 1.4.3 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 | ## Resources @@ -95,9 +95,12 @@ components: | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | +| [dns\_delegated\_component\_name](#input\_dns\_delegated\_component\_name) | Use this component name to read from the remote state to get the dns\_delegated zone ID | `string` | `"dns-delegated"` | no | +| [dns\_delegated\_environment\_name](#input\_dns\_delegated\_environment\_name) | Use this environment name to read from the remote state to get the dns\_delegated zone ID | `string` | `"gbl"` | no | +| [dns\_delegated\_stage\_name](#input\_dns\_delegated\_stage\_name) | Use this stage name to read from the remote state to get the dns\_delegated zone ID | `string` | `null` | no | | [dns\_private\_zone\_enabled](#input\_dns\_private\_zone\_enabled) | Whether to set the zone to public or private | `bool` | `false` | no | -| [domain\_name](#input\_domain\_name) | Root domain name | `string` | n/a | yes | -| [enable\_asterisk\_subject\_alternative\_name](#input\_enable\_asterisk\_subject\_alternative\_name) | Enable or disable the use of a wildcard domain in the subject alternative names | `bool` | `true` | no | +| [domain\_name](#input\_domain\_name) | Root domain name | `string` | `""` | no | +| [domain\_name\_prefix](#input\_domain\_name\_prefix) | Root domain name prefix to use with DNS delegated remote state | `string` | `""` | no | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | @@ -112,6 +115,7 @@ components: | [region](#input\_region) | AWS Region | `string` | n/a | yes | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [subject\_alternative\_names](#input\_subject\_alternative\_names) | A list of domains that should be SANs in the issued certificate | `list(string)` | `[]` | no | +| [subject\_alternative\_names\_prefixes](#input\_subject\_alternative\_names\_prefixes) | A list of domain prefixes to use with DNS delegated remote state that should be SANs in the issued certificate | `list(string)` | `[]` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | | [validation\_method](#input\_validation\_method) | Method to use for validation, DNS or EMAIL | `string` | `"DNS"` | no | diff --git a/src/main.tf b/src/main.tf index f7d57b2..7683e90 100644 --- a/src/main.tf +++ b/src/main.tf @@ -1,6 +1,13 @@ locals { enabled = module.this.enabled + domain_suffix = format("%s.%s", var.environment, module.dns_delegated.outputs.default_domain_name) + + domain_name = length(var.domain_name) > 0 ? var.domain_name : format("%s.%s", var.domain_name_prefix, local.domain_suffix) + + subject_alternative_names = concat(var.subject_alternative_names, formatlist("%s.${local.domain_suffix}", var.subject_alternative_names_prefixes)) + all_sans = distinct(concat([format("*.%s", local.domain_name)], local.subject_alternative_names)) + private_enabled = local.enabled && var.dns_private_zone_enabled private_ca_enabled = local.private_enabled && var.certificate_authority_enabled @@ -8,7 +15,7 @@ locals { data "aws_route53_zone" "default" { count = local.enabled ? 1 : 0 - name = var.zone_name + name = length(var.zone_name) > 0 ? var.zone_name : module.dns_delegated.outputs.default_domain_name private_zone = local.private_enabled } @@ -19,10 +26,10 @@ module "acm" { certificate_authority_arn = local.private_ca_enabled ? module.private_ca[0].outputs.private_ca[var.certificate_authority_component_key].certificate_authority.arn : null validation_method = local.private_ca_enabled ? null : var.validation_method - domain_name = var.domain_name + domain_name = local.domain_name process_domain_validation_options = var.process_domain_validation_options ttl = 300 - subject_alternative_names = concat(var.enable_asterisk_subject_alternative_name ? [format("*.%s", var.domain_name)] : [], var.subject_alternative_names) + subject_alternative_names = local.all_sans zone_id = join("", data.aws_route53_zone.default.*.zone_id) context = module.this.context @@ -31,9 +38,9 @@ module "acm" { resource "aws_ssm_parameter" "acm_arn" { count = local.enabled ? 1 : 0 - name = "/acm/${var.domain_name}" + name = "/acm/${local.domain_name}" value = module.acm.arn - description = format("ACM certificate ARN for '%s' domain", var.domain_name) + description = format("ACM certificate ARN for '%s' domain", local.domain_name) type = "String" overwrite = true diff --git a/src/outputs.tf b/src/outputs.tf index 875f235..3a64575 100644 --- a/src/outputs.tf +++ b/src/outputs.tf @@ -14,6 +14,6 @@ output "domain_validation_options" { } output "domain_name" { - value = local.enabled ? var.domain_name : null + value = local.enabled ? local.domain_name : null description = "Certificate domain name" } diff --git a/src/remote-state.tf b/src/remote-state.tf index f6e7dc3..888007f 100644 --- a/src/remote-state.tf +++ b/src/remote-state.tf @@ -1,6 +1,6 @@ module "private_ca" { source = "cloudposse/stack-config/yaml//modules/remote-state" - version = "1.4.1" + version = "1.4.3" count = local.private_ca_enabled ? 1 : 0 @@ -10,3 +10,14 @@ module "private_ca" { context = module.this.context } + +module "dns_delegated" { + source = "cloudposse/stack-config/yaml//modules/remote-state" + version = "1.4.3" + + component = var.dns_delegated_component_name + stage = var.dns_delegated_stage_name + environment = var.dns_delegated_environment_name + + context = module.this.context +} diff --git a/src/variables.tf b/src/variables.tf index cb082d7..9a37ae7 100644 --- a/src/variables.tf +++ b/src/variables.tf @@ -6,6 +6,13 @@ variable "region" { variable "domain_name" { type = string description = "Root domain name" + default = "" +} + +variable "domain_name_prefix" { + type = string + description = "Root domain name prefix to use with DNS delegated remote state" + default = "" } variable "zone_name" { @@ -35,6 +42,12 @@ variable "subject_alternative_names" { description = "A list of domains that should be SANs in the issued certificate" } +variable "subject_alternative_names_prefixes" { + type = list(string) + default = [] + description = "A list of domain prefixes to use with DNS delegated remote state that should be SANs in the issued certificate" +} + variable "dns_private_zone_enabled" { type = bool description = "Whether to set the zone to public or private" @@ -71,8 +84,20 @@ variable "certificate_authority_component_key" { description = "Use this component key e.g. `root` or `mgmt` to read from the remote state to get the certificate_authority_arn if using an authority type of SUBORDINATE" } -variable "enable_asterisk_subject_alternative_name" { - type = bool - default = true - description = "Enable or disable the use of a wildcard domain in the subject alternative names" +variable "dns_delegated_stage_name" { + type = string + default = null + description = "Use this stage name to read from the remote state to get the dns_delegated zone ID" +} + +variable "dns_delegated_environment_name" { + type = string + default = "gbl" + description = "Use this environment name to read from the remote state to get the dns_delegated zone ID" +} + +variable "dns_delegated_component_name" { + type = string + default = "dns-delegated" + description = "Use this component name to read from the remote state to get the dns_delegated zone ID" }