terraform-tls-signed-certificate/main.tf at main · Kalepa/terraform-tls-signed-certificate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
// Create a private key for the cert
resource "tls_private_key" "key" {
  algorithm   = var.key_algorithm
  rsa_bits    = var.key_algorithm == "RSA" ? var.key_bits : null
  ecdsa_curve = var.key_algorithm == "ECDSA" ? var.ecdsa_curve : null
  lifecycle {
    create_before_destroy = true
  }
}

// If no CA was provided, create a self-signed cert
resource "tls_self_signed_cert" "cert" {
  count           = var.certificate_authority == null ? 1 : 0
  private_key_pem = tls_private_key.key.private_key_pem
  subject {
    common_name         = var.subject_common_name
    organization        = var.subject_organization
    organizational_unit = var.subject_organizational_unit
    street_address      = var.subject_street_address
    locality            = var.subject_locality
    province            = var.subject_province
    country             = var.subject_country
    postal_code         = var.subject_postal_code
    serial_number       = var.subject_serial_number
  }
  validity_period_hours = var.validity_period_hours
  allowed_uses          = var.allowed_uses
  dns_names             = var.dns_names
  ip_addresses          = var.ip_addresses
  uris                  = var.uris
  early_renewal_hours   = var.early_renewal_hours
  is_ca_certificate     = var.is_ca_certificate
  set_subject_key_id    = var.set_subject_key_id
  lifecycle {
    create_before_destroy = true
  }
}

// If a CA was provided, create a certificate request
resource "tls_cert_request" "cert" {
  count           = var.certificate_authority != null ? 1 : 0
  private_key_pem = tls_private_key.key.private_key_pem
  subject {
    common_name         = var.subject_common_name
    organization        = var.subject_organization
    organizational_unit = var.subject_organizational_unit
    street_address      = var.subject_street_address
    locality            = var.subject_locality
    province            = var.subject_province
    country             = var.subject_country
    postal_code         = var.subject_postal_code
    serial_number       = var.subject_serial_number
  }
  dns_names    = var.dns_names
  ip_addresses = var.ip_addresses
  uris         = var.uris
  lifecycle {
    create_before_destroy = true
  }
}

// If a CA was provided, sign the certificate request
resource "tls_locally_signed_cert" "cert" {
  count                 = var.certificate_authority != null ? 1 : 0
  cert_request_pem      = tls_cert_request.cert[0].cert_request_pem
  ca_private_key_pem    = var.certificate_authority.private_key_pem
  ca_cert_pem           = var.certificate_authority.cert_pem
  validity_period_hours = var.validity_period_hours
  allowed_uses          = var.allowed_uses
  early_renewal_hours   = var.early_renewal_hours
  is_ca_certificate     = var.is_ca_certificate
  set_subject_key_id    = var.set_subject_key_id
  lifecycle {
    create_before_destroy = true
  }
}

locals {
  cert_pem              = var.certificate_authority == null ? tls_self_signed_cert.cert[0].cert_pem : tls_locally_signed_cert.cert[0].cert_pem
  certificate_chain_pem = var.certificate_authority == null ? null : var.certificate_authority.cert_pem
}

// Import the cert into ACM
resource "aws_acm_certificate" "cert" {
  count             = var.acm_import ? 1 : 0
  private_key       = tls_private_key.key.private_key_pem
  certificate_body  = local.cert_pem
  certificate_chain = local.certificate_chain_pem
  tags = {
    Name = var.certificate_acm_name != null ? var.certificate_acm_name : var.subject_common_name
  }
  lifecycle {
    create_before_destroy = true
  }
}