-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
84 lines (66 loc) · 3.8 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
locals {
enabled = module.this.enabled
create_private_key = local.enabled && try(length(var.private_key_contents), 0) == 0
certificate_backends_enabled = local.enabled && var.certificate_backends_enabled
certificate_backend_kms_key_id = try(length(var.certificate_backend_kms_key_id), 0) > 0 ? var.certificate_backend_kms_key_id : null
ssm_enabled = local.certificate_backends_enabled && contains(var.certificate_backends, "SSM")
acm_enabled = local.certificate_backends_enabled && contains(var.certificate_backends, "ACM")
asm_enabled = local.certificate_backends_enabled && contains(var.certificate_backends, "ASM")
tls_certificate = try(tls_self_signed_cert.default[0].cert_pem, tls_locally_signed_cert.default[0].cert_pem, null)
tls_key = try(tls_private_key.default[0].private_key_pem, var.private_key_contents)
}
resource "tls_private_key" "default" {
count = local.create_private_key ? 1 : 0
algorithm = var.private_key_algorithm
ecdsa_curve = var.private_key_algorithm == "ECDSA" ? var.private_key_ecdsa_curve : null
rsa_bits = var.private_key_algorithm == "RSA" ? var.private_key_rsa_bits : null
}
resource "tls_cert_request" "default" {
count = local.enabled && var.use_locally_signed ? 1 : 0
private_key_pem = coalesce(join("", tls_private_key.default.*.private_key_pem), var.private_key_contents)
subject {
common_name = lookup(var.subject, "common_name", module.this.id)
organization = lookup(var.subject, "organization", null)
organizational_unit = lookup(var.subject, "organizational_unit", null)
street_address = lookup(var.subject, "street_address", null)
locality = lookup(var.subject, "locality", null)
province = lookup(var.subject, "province", null)
country = lookup(var.subject, "country", null)
postal_code = lookup(var.subject, "postal_code", null)
serial_number = lookup(var.subject, "serial_number", null)
}
}
resource "tls_locally_signed_cert" "default" {
count = local.enabled && var.use_locally_signed ? 1 : 0
is_ca_certificate = var.basic_constraints.ca
cert_request_pem = join("", tls_cert_request.default.*.cert_request_pem)
ca_private_key_pem = var.certificate_chain.private_key_pem
ca_cert_pem = var.certificate_chain.cert_pem
validity_period_hours = var.validity.duration_hours
early_renewal_hours = var.validity.early_renewal_hours
allowed_uses = var.allowed_uses
set_subject_key_id = var.skid_enabled
}
resource "tls_self_signed_cert" "default" {
count = local.enabled && ! var.use_locally_signed ? 1 : 0
is_ca_certificate = var.basic_constraints.ca
private_key_pem = coalesce(join("", tls_private_key.default.*.private_key_pem), var.private_key_contents)
validity_period_hours = var.validity.duration_hours
early_renewal_hours = var.validity.early_renewal_hours
allowed_uses = var.allowed_uses
subject {
common_name = lookup(var.subject, "common_name", module.this.id)
organization = lookup(var.subject, "organization", null)
organizational_unit = lookup(var.subject, "organizational_unit", null)
street_address = lookup(var.subject, "street_address", null)
locality = lookup(var.subject, "locality", null)
province = lookup(var.subject, "province", null)
country = lookup(var.subject, "country", null)
postal_code = lookup(var.subject, "postal_code", null)
serial_number = lookup(var.subject, "serial_number", null)
}
dns_names = var.subject_alt_names.dns_names
ip_addresses = var.subject_alt_names.ip_addresses
uris = var.subject_alt_names.uris
set_subject_key_id = var.skid_enabled
}