refactor: add workload ZS Root CA install

zscaler · Nov 6, 2023 · 21507cf · 21507cf
1 parent e9702dd
commit 21507cf
Show file tree

Hide file tree

Showing 4 changed files with 56 additions and 0 deletions.
diff --git a/modules/terraform-zscc-workload-aws/README.md b/modules/terraform-zscc-workload-aws/README.md
@@ -9,12 +9,14 @@ This module creates all AWS EC2 instance, IAM, and Security Group resources need
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.7, < 2.0.0 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.59, <= 5.17 |
+| <a name="requirement_local"></a> [local](#requirement\_local) | ~> 2.2.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.59, <= 5.17 |
+| <a name="provider_local"></a> [local](#provider\_local) | ~> 2.2.0 |
 
 ## Modules
 
@@ -34,6 +36,7 @@ No modules.
 | [aws_partition.workload_current_partition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_ssm_parameter.amazon_linux_latest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
 | [aws_vpc.selected](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
+| [local_sensitive_file.zscaler_root_cert](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/sensitive_file) | data source |
 
 ## Inputs
 

diff --git a/modules/terraform-zscc-workload-aws/ZscalerRootCA.crt b/modules/terraform-zscc-workload-aws/ZscalerRootCA.crt
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE0zCCA7ugAwIBAgIJANu+mC2Jt3uTMA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2Ux
+FTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJbmMuMRgw
+FgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA
+enNjYWxlci5jb20wHhcNMTQxMjE5MDAyNzU1WhcNNDIwNTA2MDAyNzU1WjCBoTEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBK
+b3NlMRUwEwYDVQQKEwxac2NhbGVyIEluYy4xFTATBgNVBAsTDFpzY2FsZXIgSW5j
+LjEYMBYGA1UEAxMPWnNjYWxlciBSb290IENBMSIwIAYJKoZIhvcNAQkBFhNzdXBw
+b3J0QHpzY2FsZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+qT7STSxZRTgEFFf6doHajSc1vk5jmzmM6BWuOo044EsaTc9eVEV/HjH/1DWzZtcr
+fTj+ni205apMTlKBW3UYR+lyLHQ9FoZiDXYXK8poKSV5+Tm0Vls/5Kb8mkhVVqv7
+LgYEmvEY7HPY+i1nEGZCa46ZXCOohJ0mBEtB9JVlpDIO+nN0hUMAYYdZ1KZWCMNf
+5J/aTZiShsorN2A38iSOhdd+mcRM4iNL3gsLu99XhKnRqKoHeH83lVdfu1XBeoQz
+z5V6gA3kbRvhDwoIlTBeMa5l4yRdJAfdpkbFzqiwSgNdhbxTHnYYorDzKfr2rEFM
+dsMU0DHdeAZf711+1CunuQIDAQABo4IBCjCCAQYwHQYDVR0OBBYEFLm33UrNww4M
+hp1d3+wcBGnFTpjfMIHWBgNVHSMEgc4wgcuAFLm33UrNww4Mhp1d3+wcBGnFTpjf
+oYGnpIGkMIGhMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8G
+A1UEBxMIU2FuIEpvc2UxFTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMM
+WnNjYWxlciBJbmMuMRgwFgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG
+9w0BCQEWE3N1cHBvcnRAenNjYWxlci5jb22CCQDbvpgtibd7kzAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAw0NdJh8w3NsJu4KHuVZUrmZgIohnTm0j+
+RTmYQ9IKA/pvxAcA6K1i/LO+Bt+tCX+C0yxqB8qzuo+4vAzoY5JEBhyhBhf1uK+P
+/WVWFZN/+hTgpSbZgzUEnWQG2gOVd24msex+0Sr7hyr9vn6OueH+jj+vCMiAm5+u
+kd7lLvJsBu3AO3jGWVLyPkS3i6Gf+rwAp1OsRrv3WnbkYcFf9xjuaf4z0hRCrLN2
+xFNjavxrHmsH8jPHVvgc1VD0Opja0l/BRVauTrUaoW6tE+wFG5rEcPGS80jjHK4S
+pB5iDj2mUZH1T8lzYtuZy0ZPirxmtsk3135+CKNa2OCAhhFjE0xd
+-----END CERTIFICATE-----
diff --git a/modules/terraform-zscc-workload-aws/main.tf b/modules/terraform-zscc-workload-aws/main.tf
@@ -101,6 +101,26 @@ resource "aws_security_group_rule" "server_node_ingress_ssh" {
 }
 
 
+################################################################################
+# Generate user data script to install Zscaler Root Certificate in
+# Amazon Linux 2 Workload Trust Store for SSL inspection
+################################################################################
+data "local_sensitive_file" "zscaler_root_cert" {
+  filename = "${path.module}/ZscalerRootCA.crt"
+}
+
+locals {
+  workloaduserdata = <<WORKLOADUSERDATA
+#!/bin/bash
+
+# Create ZscalerRootCA.crt file in /etc/pki/ca-trust/source/anchors/
+echo "${data.local_sensitive_file.zscaler_root_cert.content}" > /etc/pki/ca-trust/source/anchors/ZscalerRootCA.crt
+# Update the CA trust store
+update-ca-trust
+WORKLOADUSERDATA
+}
+
+
 ################################################################################
 # Create workload EC2 instances
 ################################################################################
@@ -112,6 +132,7 @@ resource "aws_instance" "server_host" {
   subnet_id              = element(var.subnet_id, count.index)
   iam_instance_profile   = aws_iam_instance_profile.server_host_profile.name
   vpc_security_group_ids = [aws_security_group.node_sg.id]
+  user_data              = local.workloaduserdata
 
   metadata_options {
     http_endpoint = "enabled"

diff --git a/modules/terraform-zscc-workload-aws/versions.tf b/modules/terraform-zscc-workload-aws/versions.tf
@@ -4,6 +4,10 @@ terraform {
       source  = "hashicorp/aws"
       version = ">= 4.59, <= 5.17"
     }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.2.0"
+    }
   }
   required_version = ">= 0.13.7, < 2.0.0"
 }