Skip to content

Commit 182d16c

Browse files
bryantbiggsbryantbiggs
committed
feat: Updates from PR review
1 parent f0be2e4 commit 182d16c

File tree

14 files changed

+171
-27
lines changed

14 files changed

+171
-27
lines changed

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ module "api_gateway" {
173173
| [aws_apigatewayv2_stage.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/apigatewayv2_stage) | resource |
174174
| [aws_apigatewayv2_vpc_link.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/apigatewayv2_vpc_link) | resource |
175175
| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
176-
| [aws_route53_record.alias_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
176+
| [aws_route53_record.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
177177
| [aws_route53_zone.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
178178

179179
## Inputs
@@ -213,6 +213,7 @@ module "api_gateway" {
213213
| <a name="input_stage_name"></a> [stage\_name](#input\_stage\_name) | The name of the stage. Must be between 1 and 128 characters in length | `string` | `"$default"` | no |
214214
| <a name="input_stage_tags"></a> [stage\_tags](#input\_stage\_tags) | A mapping of tags to assign to the stage resource | `map(string)` | `{}` | no |
215215
| <a name="input_stage_variables"></a> [stage\_variables](#input\_stage\_variables) | A map that defines the stage variables for the stage | `map(string)` | `{}` | no |
216+
| <a name="input_subdomain_record_types"></a> [subdomain\_record\_types](#input\_subdomain\_record\_types) | A list of record types to create for the subdomain(s) | `list(string)` | <pre>[<br> "A",<br> "AAAA"<br>]</pre> | no |
216217
| <a name="input_subdomains"></a> [subdomains](#input\_subdomains) | An optional list of subdomains to use for API gateway | `list(string)` | `[]` | no |
217218
| <a name="input_tags"></a> [tags](#input\_tags) | A mapping of tags to assign to API gateway resources | `map(string)` | `{}` | no |
218219
| <a name="input_target"></a> [target](#input\_target) | Part of quick create. Quick create produces an API with an integration, a default catch-all route, and a default stage which is configured to automatically deploy changes. For HTTP integrations, specify a fully qualified URL. For Lambda integrations, specify a function ARN. The type of the integration will be HTTP\_PROXY or AWS\_PROXY, respectively. Applicable for HTTP APIs | `string` | `null` | no |

‎examples/complete-http/README.md

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,18 @@ Note that this example may create resources which cost money. Run `terraform des
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
2323
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.37 |
24+
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 2.5 |
25+
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
26+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 3.1 |
2427

2528
## Providers
2629

2730
| Name | Version |
2831
|------|---------|
2932
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.37 |
33+
| <a name="provider_local"></a> [local](#provider\_local) | >= 2.5 |
34+
| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
35+
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 3.1 |
3036

3137
## Modules
3238

@@ -35,19 +41,27 @@ Note that this example may create resources which cost money. Run `terraform des
3541
| <a name="module_api_gateway"></a> [api\_gateway](#module\_api\_gateway) | ../../ | n/a |
3642
| <a name="module_api_gateway_disabled"></a> [api\_gateway\_disabled](#module\_api\_gateway\_disabled) | ../../ | n/a |
3743
| <a name="module_lambda_function"></a> [lambda\_function](#module\_lambda\_function) | terraform-aws-modules/lambda/aws | ~> 7.0 |
44+
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
3845
| <a name="module_step_function"></a> [step\_function](#module\_step\_function) | terraform-aws-modules/step-functions/aws | ~> 4.0 |
3946

4047
## Resources
4148

4249
| Name | Type |
4350
|------|------|
51+
| [aws_apigatewayv2_authorizer.external](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/apigatewayv2_authorizer) | resource |
4452
| [aws_cognito_user_pool.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool) | resource |
53+
| [aws_s3_object.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |
54+
| [local_file.key](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
55+
| [local_file.pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
56+
| [null_resource.download_package](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
57+
| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
58+
| [tls_self_signed_cert.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |
4559

4660
## Inputs
4761

4862
| Name | Description | Type | Default | Required |
4963
|------|-------------|------|---------|:--------:|
50-
| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | Custom domain name to use on API Gateway endpoint | `string` | `"terraform-aws-modules.modules.tf"` | no |
64+
| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | Custom domain name to use on API Gateway endpoint | `string` | `"*.terraform-aws-modules.modules.tf"` | no |
5165

5266
## Outputs
5367

@@ -73,6 +87,7 @@ Note that this example may create resources which cost money. Run `terraform des
7387
| <a name="output_stage_execution_arn"></a> [stage\_execution\_arn](#output\_stage\_execution\_arn) | The ARN prefix to be used in an aws\_lambda\_permission's source\_arn attribute or in an aws\_iam\_policy to authorize access to the @connections API |
7488
| <a name="output_stage_id"></a> [stage\_id](#output\_stage\_id) | The stage identifier |
7589
| <a name="output_stage_invoke_url"></a> [stage\_invoke\_url](#output\_stage\_invoke\_url) | The URL to invoke the API pointing to the stage |
90+
| <a name="output_test_curl_command"></a> [test\_curl\_command](#output\_test\_curl\_command) | Curl command to test API endpoint using mTLS |
7691
| <a name="output_vpc_links"></a> [vpc\_links](#output\_vpc\_links) | Map of VPC links created and their attributes |
7792
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7893

‎examples/complete-http/lambda.py

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎examples/complete-http/main.tf

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ module "api_gateway" {
5454
create_domain_records = true
5555
create_certificate = true
5656

57+
mutual_tls_authentication = {
58+
truststore_uri = "s3://${module.s3_bucket.s3_bucket_id}/${aws_s3_object.this.id}"
59+
truststore_version = aws_s3_object.this.version_id
60+
}
61+
5762
# Routes & Integration(s)
5863
routes = {
5964
"ANY /" = {
@@ -66,7 +71,7 @@ module "api_gateway" {
6671

6772
"GET /some-route" = {
6873
authorization_type = "JWT"
69-
authorizer_key = "cognito"
74+
authorizer_id = aws_apigatewayv2_authorizer.external.id
7075
throttling_rate_limit = 80
7176
throttling_burst_limit = 40
7277
detailed_metrics_enabled = true
@@ -192,6 +197,18 @@ module "api_gateway_disabled" {
192197
# Supporting Resources
193198
################################################################################
194199

200+
resource "aws_apigatewayv2_authorizer" "external" {
201+
api_id = module.api_gateway.api_id
202+
authorizer_type = "JWT"
203+
identity_sources = ["$request.header.Authorization"]
204+
name = local.name
205+
206+
jwt_configuration {
207+
audience = ["example"]
208+
issuer = "https://${aws_cognito_user_pool.this.endpoint}"
209+
}
210+
}
211+
195212
resource "aws_cognito_user_pool" "this" {
196213
name = local.name
197214

@@ -237,17 +254,34 @@ module "step_function" {
237254
tags = local.tags
238255
}
239256

257+
locals {
258+
package_url = "https://raw.githubusercontent.com/terraform-aws-modules/terraform-aws-lambda/master/examples/fixtures/python-function.zip"
259+
downloaded = "downloaded_package_${md5(local.package_url)}.zip"
260+
}
261+
262+
resource "null_resource" "download_package" {
263+
triggers = {
264+
downloaded = local.downloaded
265+
}
266+
267+
provisioner "local-exec" {
268+
command = "curl -L -o ${local.downloaded} ${local.package_url}"
269+
}
270+
}
271+
240272
module "lambda_function" {
241273
source = "terraform-aws-modules/lambda/aws"
242274
version = "~> 7.0"
243275

244276
function_name = local.name
245277
description = "My awesome lambda function"
246-
handler = "lambda.handler"
278+
handler = "index.lambda_handler"
247279
runtime = "python3.12"
248280
architectures = ["arm64"]
249281
publish = true
250-
source_path = "lambda.py"
282+
283+
create_package = false
284+
local_existing_package = local.downloaded
251285

252286
cloudwatch_logs_retention_in_days = 7
253287

@@ -260,3 +294,55 @@ module "lambda_function" {
260294

261295
tags = local.tags
262296
}
297+
298+
################################################################################
299+
# mTLS Supporting Resources
300+
################################################################################
301+
302+
module "s3_bucket" {
303+
source = "terraform-aws-modules/s3-bucket/aws"
304+
version = "~> 3.0"
305+
306+
bucket_prefix = "${local.name}-"
307+
308+
# NOTE: This is enabled for example usage only, you should not enable this for production workloads
309+
force_destroy = true
310+
311+
tags = local.tags
312+
}
313+
resource "aws_s3_object" "this" {
314+
bucket = module.s3_bucket.s3_bucket_id
315+
key = "truststore.pem"
316+
server_side_encryption = "AES256"
317+
content = tls_self_signed_cert.this.cert_pem
318+
}
319+
320+
resource "tls_private_key" "this" {
321+
algorithm = "RSA"
322+
}
323+
324+
resource "tls_self_signed_cert" "this" {
325+
is_ca_certificate = true
326+
private_key_pem = tls_private_key.this.private_key_pem
327+
328+
subject {
329+
common_name = "example.com"
330+
}
331+
332+
validity_period_hours = 12
333+
334+
allowed_uses = [
335+
"cert_signing",
336+
"server_auth",
337+
]
338+
}
339+
340+
resource "local_file" "key" {
341+
content = tls_private_key.this.private_key_pem
342+
filename = "my-key.key"
343+
}
344+
345+
resource "local_file" "pem" {
346+
content = tls_self_signed_cert.this.cert_pem
347+
filename = "my-cert.pem"
348+
}

‎examples/complete-http/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
output "test_curl_command" {
2+
description = "Curl command to test API endpoint using mTLS"
3+
value = "curl --key ./my-key.key --cert ./my-cert.pem https://customer1.${replace(var.domain_name, "*.", "")} | jq"
4+
}
5+
16
################################################################################
27
# API Gateway
38
################################################################################

‎examples/complete-http/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
variable "domain_name" {
22
description = "Custom domain name to use on API Gateway endpoint"
33
type = string
4-
default = "terraform-aws-modules.modules.tf"
4+
default = "*.terraform-aws-modules.modules.tf"
55
}

‎examples/complete-http/versions.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,17 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 5.37"
88
}
9+
local = {
10+
source = "hashicorp/local"
11+
version = ">= 2.5"
12+
}
13+
null = {
14+
source = "hashicorp/null"
15+
version = ">= 2.0"
16+
}
17+
tls = {
18+
source = "hashicorp/tls"
19+
version = ">= 3.1"
20+
}
921
}
1022
}

‎examples/vpc-link-http/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,14 @@ Note that this example may create resources which cost money. Run `terraform des
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
2323
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.37 |
24+
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
2425

2526
## Providers
2627

2728
| Name | Version |
2829
|------|---------|
2930
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.37 |
31+
| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
3032

3133
## Modules
3234

@@ -43,6 +45,7 @@ Note that this example may create resources which cost money. Run `terraform des
4345

4446
| Name | Type |
4547
|------|------|
48+
| [null_resource.download_package](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
4649
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
4750

4851
## Inputs

‎examples/vpc-link-http/lambda.py

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎examples/vpc-link-http/main.tf

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,17 +158,35 @@ module "alb" {
158158
tags = local.tags
159159
}
160160

161+
162+
locals {
163+
package_url = "https://raw.githubusercontent.com/terraform-aws-modules/terraform-aws-lambda/master/examples/fixtures/python-function.zip"
164+
downloaded = "downloaded_package_${md5(local.package_url)}.zip"
165+
}
166+
167+
resource "null_resource" "download_package" {
168+
triggers = {
169+
downloaded = local.downloaded
170+
}
171+
172+
provisioner "local-exec" {
173+
command = "curl -L -o ${local.downloaded} ${local.package_url}"
174+
}
175+
}
176+
161177
module "lambda_function" {
162178
source = "terraform-aws-modules/lambda/aws"
163179
version = "~> 7.0"
164180

165181
function_name = local.name
166182
description = "My awesome lambda function"
167-
handler = "lambda.handler"
183+
handler = "index.lambda_handler"
168184
runtime = "python3.12"
169185
architectures = ["arm64"]
170186
publish = true
171-
source_path = "lambda.py"
187+
188+
create_package = false
189+
local_existing_package = local.downloaded
172190

173191
cloudwatch_logs_retention_in_days = 7
174192

‎examples/vpc-link-http/versions.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,9 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 5.37"
88
}
9+
null = {
10+
source = "hashicorp/null"
11+
version = ">= 2.0"
12+
}
913
}
1014
}

‎main.tf

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,11 @@ resource "aws_apigatewayv2_api_mapping" "this" {
123123
locals {
124124
# https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html
125125
stripped_domain_name = replace(var.domain_name, "*.", "")
126+
127+
record_set = { for prd in setproduct(var.subdomains, var.subdomain_record_types) : "${prd[0]}-${prd[1]}" => {
128+
name = prd[0]
129+
type = prd[1]
130+
} }
126131
}
127132

128133
data "aws_route53_zone" "this" {
@@ -131,12 +136,12 @@ data "aws_route53_zone" "this" {
131136
name = local.stripped_domain_name
132137
}
133138

134-
resource "aws_route53_record" "alias_ipv4" {
135-
for_each = { for k, v in toset(var.subdomains) : k => v if local.create_domain_name && var.create_domain_records }
139+
resource "aws_route53_record" "this" {
140+
for_each = { for k, v in local.record_set : k => v if local.create_domain_name && var.create_domain_records }
136141

137142
zone_id = data.aws_route53_zone.this[0].zone_id
138-
name = each.value
139-
type = "A"
143+
name = each.value.name
144+
type = each.value.type
140145

141146
alias {
142147
name = aws_apigatewayv2_domain_name.this[0].domain_name_configuration[0].target_domain_name
@@ -424,5 +429,5 @@ resource "aws_apigatewayv2_vpc_link" "this" {
424429
security_group_ids = each.value.security_group_ids
425430
subnet_ids = each.value.subnet_ids
426431

427-
tags = merge(var.tags, var.vpc_link_tags, each.value.tags)
432+
tags = merge(var.tags, var.vpc_link_tags, try(each.value.tags, {}))
428433
}

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,12 @@ variable "subdomains" {
178178
default = []
179179
}
180180

181+
variable "subdomain_record_types" {
182+
description = "A list of record types to create for the subdomain(s)"
183+
type = list(string)
184+
default = ["A", "AAAA"]
185+
}
186+
181187
################################################################################
182188
# Domain - Certificate
183189
################################################################################

‎wrappers/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,19 @@ module "wrapper" {
2727
name = try(each.value.name, var.defaults.name, "")
2828
protocol_type = try(each.value.protocol_type, var.defaults.protocol_type, "HTTP")
2929
route_key = try(each.value.route_key, var.defaults.route_key, null)
30-
route_selection_expression = try(each.value.route_selection_expression, var.defaults.route_selection_expression, null)
3130
routes = try(each.value.routes, var.defaults.routes, {})
31+
route_selection_expression = try(each.value.route_selection_expression, var.defaults.route_selection_expression, null)
3232
stage_access_log_settings = try(each.value.stage_access_log_settings, var.defaults.stage_access_log_settings, {})
3333
stage_client_certificate_id = try(each.value.stage_client_certificate_id, var.defaults.stage_client_certificate_id, null)
3434
stage_default_route_settings = try(each.value.stage_default_route_settings, var.defaults.stage_default_route_settings, {})
3535
stage_description = try(each.value.stage_description, var.defaults.stage_description, null)
3636
stage_name = try(each.value.stage_name, var.defaults.stage_name, "$default")
3737
stage_tags = try(each.value.stage_tags, var.defaults.stage_tags, {})
3838
stage_variables = try(each.value.stage_variables, var.defaults.stage_variables, {})
39+
subdomain_record_types = try(each.value.subdomain_record_types, var.defaults.subdomain_record_types, ["A", "AAAA"])
3940
subdomains = try(each.value.subdomains, var.defaults.subdomains, [])
4041
tags = try(each.value.tags, var.defaults.tags, {})
4142
target = try(each.value.target, var.defaults.target, null)
42-
vpc_link_tags = try(each.value.vpc_link_tags, var.defaults.vpc_link_tags, {})
4343
vpc_links = try(each.value.vpc_links, var.defaults.vpc_links, {})
44+
vpc_link_tags = try(each.value.vpc_link_tags, var.defaults.vpc_link_tags, {})
4445
}

0 commit comments

Comments
 (0)