Skip to content

Commit f6843de

Browse files
bmonkmanbmonkman
authored
Added support for allow domain aliases (#106)
Updated to new versions of certificates and hosting modules, changed args correspondingly. Use alternate provider instead of providing region to cert, to match Aaron's change.
1 parent 03957e3 commit f6843de

6 files changed

Lines changed: 43 additions & 32 deletions

File tree

‎templates/terraform/environments/prod/main.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ module "prod" {
3838
# https://<% index .Params `region` %>.console.aws.amazon.com/systems-manager/parameters/%252Faws%252Fservice%252Feks%252Foptimized-ami%252F1.17%252Famazon-linux-2%252Frecommended%252Fimage_id/description?region=<% index .Params `region` %>
3939
eks_worker_ami = "<% index .Params `eksWorkerAMI` %>"
4040

41-
# Hosting configuration
42-
s3_hosting_buckets = [
43-
"<% index .Params `productionHostRoot` %>",
44-
"<% index .Params `productionFrontendSubdomain` %><% index .Params `productionHostRoot` %>",
41+
# Hosting configuration. Each domain will have a bucket created for it, but may have mulitple aliases pointing to the same bucket.
42+
hosted_domains = [
43+
{ domain : "<% index .Params `productionHostRoot` %>", aliases : [] },
44+
{ domain : "<% index .Params `productionFrontendSubdomain` %><% index .Params `productionHostRoot` %>", aliases : [] },
4545
]
4646
domain_name = "<% index .Params `productionHostRoot` %>"
4747
cf_signed_downloads = <% if eq (index .Params `fileUploads`) "yes" %>true<% else %>false<% end %>

‎templates/terraform/environments/stage/main.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ module "stage" {
3838
# https://<% index .Params `region` %>.console.aws.amazon.com/systems-manager/parameters/%252Faws%252Fservice%252Feks%252Foptimized-ami%252F1.17%252Famazon-linux-2%252Frecommended%252Fimage_id/description?region=<% index .Params `region` %>
3939
eks_worker_ami = "<% index .Params `eksWorkerAMI` %>"
4040

41-
# Hosting configuration
42-
s3_hosting_buckets = [
43-
"<% index .Params `stagingHostRoot` %>",
44-
"<% index .Params `stagingFrontendSubdomain` %><% index .Params `stagingHostRoot` %>",
41+
# Hosting configuration. Each domain will have a bucket created for it, but may have mulitple aliases pointing to the same bucket.
42+
hosted_domains = [
43+
{ domain : "<% index .Params `stagingHostRoot` %>", aliases : [] },
44+
{ domain : "<% index .Params `stagingFrontendSubdomain` %><% index .Params `stagingHostRoot` %>", aliases : [] },
4545
]
4646
domain_name = "<% index .Params `stagingHostRoot` %>"
4747
cf_signed_downloads = <% if eq (index .Params `fileUploads`) "yes" %>true<% else %>false<% end %>

‎templates/terraform/modules/environment/iam.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ data "aws_iam_policy_document" "deploy_assets_policy" {
7272
"s3:ListBucket",
7373
]
7474

75-
resources = formatlist("arn:aws:s3:::%s", var.s3_hosting_buckets)
75+
resources = module.s3_hosting[*].bucket_arn
7676
}
7777

7878
statement {
@@ -81,7 +81,7 @@ data "aws_iam_policy_document" "deploy_assets_policy" {
8181
"s3:GetBucketLocation",
8282
]
8383

84-
resources = formatlist("arn:aws:s3:::%s/*", var.s3_hosting_buckets)
84+
resources = formatlist("%s/*", module.s3_hosting[*].bucket_arn)
8585
}
8686

8787
statement {

‎templates/terraform/modules/environment/main.tf‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -52,35 +52,38 @@ module "eks" {
5252

5353
module "wildcard_domain" {
5454
source = "commitdev/zero/aws//modules/certificate"
55-
version = "0.0.1"
55+
version = "0.1.0"
5656

57-
region = var.region
5857
zone_name = var.domain_name
59-
domain_names = ["*.${var.domain_name}"]
58+
domain_name = "*.${var.domain_name}"
6059
}
6160

6261
module "assets_domains" {
63-
source = "commitdev/zero/aws//modules/certificate"
64-
version = "0.0.1"
62+
source = "commitdev/zero/aws//modules/certificate"
63+
version = "0.1.0"
64+
count = length(var.hosted_domains)
65+
providers = {
66+
aws = aws.for_cloudfront
67+
}
6568

66-
region = "us-east-1" # For CF, the cert must be in us-east-1
67-
zone_name = var.domain_name
68-
domain_names = var.s3_hosting_buckets
69+
zone_name = var.domain_name
70+
domain_name = var.hosted_domains[count.index].domain
71+
alternative_names = var.hosted_domains[count.index].aliases
6972
}
7073

7174
module "s3_hosting" {
7275
source = "commitdev/zero/aws//modules/s3_hosting"
73-
version = "0.0.3"
74-
75-
# We need to wait for certificate validation to complete before using the certs
76-
depends_on = [module.assets_domains.certificate_validations]
77-
78-
cf_signed_downloads = var.cf_signed_downloads
79-
buckets = var.s3_hosting_buckets
80-
project = var.project
81-
environment = var.environment
82-
certificate_arns = module.assets_domains.certificate_arns
83-
route53_zone_id = module.assets_domains.route53_zone_id
76+
version = "0.1.0"
77+
count = length(var.hosted_domains)
78+
79+
cf_signed_downloads = var.cf_signed_downloads
80+
domain = var.hosted_domains[count.index].domain
81+
aliases = var.hosted_domains[count.index].aliases
82+
project = var.project
83+
environment = var.environment
84+
certificate_arn = module.assets_domains[count.index].certificate_arn
85+
certificate_validation = module.assets_domains[count.index].certificate_validation
86+
route53_zone_id = module.assets_domains[count.index].route53_zone_id
8487
}
8588

8689
module "db" {

‎templates/terraform/modules/environment/provider.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ data "aws_iam_role" "eks_cluster_creator" {
33
name = "${var.project}-eks-cluster-creator"
44
}
55

6+
provider "aws" {
7+
alias = "for_cloudfront"
8+
region = "us-east-1"
9+
}
10+
611
# Used only for EKS creation to tie "cluster creator" to a role instead of the user who runs terraform
712
# This allows us to rely on credentials pulled from the EKS cluster instead of the user's local kube config
813
provider "aws" {

‎templates/terraform/modules/environment/variables.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,12 @@ variable "eks_worker_ami" {
4444
description = "The (EKS-optimized) AMI for EKS worker instances"
4545
}
4646

47-
variable "s3_hosting_buckets" {
48-
description = "S3 hosting buckets"
49-
type = set(string)
47+
variable "hosted_domains" {
48+
description = "Domains to host content for using S3 and Cloudfront. Requires a domain which will be the bucket name and the domain for the certificate, and optional aliases which will have records created for them and will be SubjectAltNames for the certificate. Only a single bucket and CF Distribution will be created per domain."
49+
type = list( object( {
50+
domain = string
51+
aliases = list(string)
52+
} ) )
5053
}
5154

5255
variable "domain_name" {

0 commit comments

Comments
 (0)