Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactoring VPN to use AWS private certificate authority #1522

Merged
merged 3 commits into from
Sep 10, 2024
Merged

Refactoring VPN to use AWS private certificate authority #1522

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
428fbda
Refactoring VPN to use AWS private certificate authority
ben851 Sep 10, 2024
7beaad7
permanent deletion
ben851 Sep 10, 2024
60b97e8
formatting
ben851 Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 40 additions & 32 deletions aws/eks/vpn.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,45 +51,53 @@ module "gha_vpn" {
billing_tag_value = "notification-canada-ca-${var.env}"
}

resource "aws_acm_certificate" "client_vpn" {
certificate_authority_arn = aws_acmpca_certificate_authority.client_vpn.arn
domain_name = "${var.env}.notification.canada.ca"

#
# Certificate used for VPN communication
#
resource "tls_private_key" "client_vpn" {
algorithm = "RSA"
rsa_bits = 2048
}

resource "tls_self_signed_cert" "client_vpn" {
private_key_pem = tls_private_key.client_vpn.private_key_pem
validity_period_hours = 43800 # 5 years
early_renewal_hours = 672 # Generate new cert if Terraform is run within 4 weeks of expiry
tags = {
Environment = var.env
}

subject {
common_name = "vpn.${var.env}.notification.canada.ca"
lifecycle {
create_before_destroy = true
}
}

resource "aws_acmpca_certificate_authority_certificate" "client_vpn" {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The resource aws_acmpca_certificate_authority_certificate is not necessary. The aws_acm_certificate resource already handles the certificate issuance and management. Consider removing this resource to avoid redundancy.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not according to all documentation!

certificate_authority_arn = aws_acmpca_certificate_authority.client_vpn.arn

allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
"ipsec_end_system",
"ipsec_tunnel",
"any_extended",
"cert_signing",
]
certificate = aws_acmpca_certificate.client_vpn.certificate
certificate_chain = aws_acmpca_certificate.client_vpn.certificate_chain
}

resource "aws_acm_certificate" "client_vpn" {
private_key = tls_private_key.client_vpn.private_key_pem
certificate_body = tls_self_signed_cert.client_vpn.cert_pem
resource "aws_acmpca_certificate" "client_vpn" {
certificate_authority_arn = aws_acmpca_certificate_authority.client_vpn.arn
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The aws_acmpca_certificate resource is redundant. The aws_acm_certificate resource should be sufficient for managing the certificate. Consider removing this resource to simplify the configuration.

certificate_signing_request = aws_acmpca_certificate_authority.client_vpn.certificate_signing_request
signing_algorithm = "SHA512WITHRSA"

tags = {
Name = "notification-canada-ca"
CostCenter = "notification-canada-ca-${var.env}"
template_arn = "arn:${data.aws_partition.current.partition}:acm-pca:::template/RootCACertificate/V1"

ben851 marked this conversation as resolved.
Show resolved Hide resolved
validity {
type = "YEARS"
value = 5
}
}

lifecycle {
create_before_destroy = true
resource "aws_acmpca_certificate_authority" "client_vpn" {
type = "ROOT"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The aws_acmpca_certificate_authority resource should have a permanent_deletion_time_in_days attribute to specify the retention period before permanent deletion. Consider adding this attribute for better resource management.


certificate_authority_configuration {
key_algorithm = "RSA_4096"
signing_algorithm = "SHA512WITHRSA"

subject {
common_name = "notification.canada.ca"
}
}
}

ben851 marked this conversation as resolved.
Show resolved Hide resolved
permanent_deletion_time_in_days = 7
}

ben851 marked this conversation as resolved.
Show resolved Hide resolved

data "aws_partition" "current" {}
Loading