terrafying-components 1.11.15 → 1.11.16

data/lib/terrafying/components/ports.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
 
 PORT_NAMES = {
-  22 => "ssh",
-  80 => "http",
-  443 => "https",
-  1194 => "openvpn",
-}
+  22 => 'ssh',
+  80 => 'http',
+  443 => 'https',
+  1194 => 'openvpn'
+}.freeze
 
 def enrich_ports(ports)
   ports = add_upstream_downstream(ports)
@@ -14,9 +15,7 @@ end
 
 def add_upstream_downstream(ports)
   ports.map do |port|
-    if port.is_a?(Numeric)
-      port = { upstream_port: port, downstream_port: port }
-    end
+    port = { upstream_port: port, downstream_port: port } if port.is_a?(Numeric)
 
     if port.key?(:number)
       port[:upstream_port] = port[:number]
@@ -53,18 +52,20 @@ def add_names(ports)
   ports.map do |port|
     {
       type: 'tcp',
-      name: PORT_NAMES.fetch(port[:upstream_port], port[:upstream_port].to_s),
+      name: PORT_NAMES.fetch(port[:upstream_port], port[:upstream_port].to_s)
     }.merge(port)
   end
 end
 
 def from_port(port)
   return port unless port_range?(port)
+
   port.split('-').first.to_i
 end
 
 def to_port(port)
   return port unless port_range?(port)
+
   port.split('-').last.to_i
 end
 
@@ -73,9 +74,9 @@ def port_range?(port)
 end
 
 def is_l4_port(port)
-  port[:type] == "tcp" || port[:type] == "udp"
+  port[:type] == 'tcp' || port[:type] == 'udp'
 end
 
 def is_l7_port(port)
-  port[:type] == "http" || port[:type] == "https"
+  port[:type] == 'http' || port[:type] == 'https'
 end

data/lib/terrafying/components/prometheus.rb

@@ -22,7 +22,10 @@ module Terrafying
         thanos_name: 'thanos',
         thanos_version: 'v0.4.0',
         prom_name: 'prometheus',
-        prom_version: 'v2.9.2'
+        prom_version: 'v2.9.2',
+        instances: 2,
+        instance_type: 't3a.small',
+        instance_cpu_credits: 'standard'
       )
         super()
         @vpc = vpc
@@ -30,81 +33,104 @@ module Terrafying
         @thanos_version = thanos_version
         @prom_name = prom_name
         @prom_version = prom_version
+        @instances = instances
+        @instance_type = instance_type
+        @instance_cpu_credits = instance_cpu_credits
       end
 
       def find
         @security_group = aws.security_group_in_vpc(
           @vpc.id,
-          "dynamicset-#{@vpc.name}-#{@prom_name}"
+          "staticset-#{@vpc.name}-#{@prom_name}"
         )
       end
 
       def create
-        thanos_peers = @vpc.zone.qualify(@thanos_name)
-
-        @thanos = create_thanos(thanos_peers)
+        prometheus_thanos_sidecar_hostname = tf_safe(@prom_name)
+        prometheus_thanos_sidecar_srv_fqdn = "_grpc._tcp.#{@vpc.zone.qualify prometheus_thanos_sidecar_hostname}"
+        @instance_vcpu_count = aws.instance_type_vcpu_count(@instance_type)
+        @thanos = create_thanos(prometheus_thanos_sidecar_srv_fqdn)
         create_thanos_cloudwatch_alert(@thanos)
 
-        @prometheus = create_prom(thanos_peers)
+        @prometheus = create_prom
+
         @security_group = @prometheus.egress_security_group
-        create_prometheus_cloudwatch_alert(@prometheus)
-        allow_thanos_gossip(@prometheus.egress_security_group)
+        # Allow thanos-query connections to thanos-sidecar on prometheus instances
+        @vpc.zone.add_srv_in(self, prometheus_thanos_sidecar_hostname, 'grpc', 10_901, 'tcp', @prom_service.domain_names.drop(1))
+
+        allow_prometheus_thanos_sidecar_grpc(@prometheus.egress_security_group, @thanos.security_group)
 
         @prometheus.used_by_cidr(@vpc.cidr)
         @thanos.used_by_cidr(@vpc.cidr)
       end
 
-      def create_prom(thanos_peers)
-        add! Terrafying::Components::Service.create_in(
+      def create_prom
+        @prom_service = add! Terrafying::Components::Service.create_in(
           @vpc, @prom_name,
           ports: [
             {
-              type: 'http',
-              number: 9090,
-              health_check: { path: '/status', protocol: 'HTTP' }
+              type: 'tcp',
+              number: 9090
+            },
+            {
+              type: 'tcp',
+              number: 10_902
             }
           ],
-          instance_type: 'm5.large',
+          instance_type: @instance_type,
+          cpu_credits: @instance_cpu_credits,
           iam_policy_statements: thanos_store_access,
-          instances: { max: 3, min: 1, desired: 2 },
-          units: [prometheus_unit, thanos_sidecar_unit(thanos_peers)],
-          files: [prometheus_conf, thanos_bucket]
+          instances: [{}] * @instances,
+          units: [prometheus_unit, thanos_sidecar_unit],
+          files: [prometheus_conf, thanos_bucket],
+          tags: {
+            prometheus_port: 9090,
+            prometheus_path: '/metrics',
+            prometheus_port_0: 10_902,
+            prometheus_path_0: '/metrics'
+          }
         )
       end
 
-      def allow_thanos_gossip(security_group)
-        rule_ident = Digest::SHA2.hexdigest("#{security_group}-thanos-#{@vpc.name}")[0..24]
-        resource :aws_security_group_rule, rule_ident, {
-          security_group_id: security_group,
-          type:      'ingress',
-          from_port: 10900,
-          to_port:   10902,
-          protocol:  'tcp',
-          cidr_blocks: [@vpc.cidr]
-        }
+      def allow_prometheus_thanos_sidecar_grpc(security_group, source_security_group)
+        rule_ident = Digest::SHA2.hexdigest([security_group, source_security_group, @vpc.name, 'thanos-sidecar'].join('-'))[0..24]
+        resource :aws_security_group_rule, rule_ident,
+                 security_group_id: security_group,
+                 type: 'ingress',
+                 from_port: 10_901,
+                 to_port: 10_901,
+                 protocol: 'tcp',
+                 source_security_group_id: source_security_group
       end
 
-      def create_thanos(thanos_peers)
-        add! Terrafying::Components::Service.create_in(
+      def create_thanos(prometheus_thanos_sidecar_srv_fqdn)
+        @thanos_service = add! Terrafying::Components::Service.create_in(
           @vpc, @thanos_name,
           ports: [
             {
-              number: 10902,
+              number: 10_902,
               health_check: {
-                path: '/status',
-                protocol: 'HTTP'
+                protocol: 'HTTP',
+                path: '/-/healthy'
               }
             },
             {
-              number: 10901
-            },
-            {
-              number: 10900
+              number: 10_901,
+              health_check: {
+                protocol: 'TCP'
+              }
             }
           ],
-          instance_type: 't3.medium',
-          units: [thanos_unit(thanos_peers)],
-          instances: { max: 3, min: 1, desired: 2 }
+          instance_type: @instance_type,
+          cpu_credits: @instance_cpu_credits,
+          units: [thanos_unit(prometheus_thanos_sidecar_srv_fqdn)],
+          instances: [{}] * @instances,
+          loadbalancer: true,
+          metrics_ports: [10_902],
+          tags: {
+            prometheus_port: 10_902,
+            prometheus_path: '/metrics'
+          }
         )
       end
 
@@ -134,7 +160,12 @@ module Terrafying
               --storage.tsdb.retention.time=1d \
               --storage.tsdb.min-block-duration=2h \
               --storage.tsdb.max-block-duration=2h \
+              --storage.tsdb.no-lockfile \
+              --storage.remote.read-concurrent-limit=#{@instance_vcpu_count} \
+              --query.max-concurrency=#{@instance_vcpu_count} \
               --config.file=/opt/prometheus/prometheus.yml \
+              --web.console.templates=/etc/prometheus/consoles \
+              --web.console.libraries=/etc/prometheus/console_libraries \
               --web.enable-lifecycle \
               --log.level=warn
             Restart=always
@@ -143,7 +174,7 @@ module Terrafying
         }
       end
 
-      def thanos_sidecar_unit(thanos_peers)
+      def thanos_sidecar_unit
         {
           name: 'thanos.service',
           contents: <<~THANOS_SIDE
@@ -154,25 +185,20 @@ module Terrafying
             After=docker.service prometheus.service
             Requires=docker.service prometheus.service
              [Service]
-            EnvironmentFile=/run/metadata/coreos
             ExecStartPre=-/usr/bin/docker kill thanos
             ExecStartPre=-/usr/bin/docker rm thanos
             ExecStartPre=/usr/bin/docker pull improbable/thanos:#{@thanos_version}
             ExecStart=/usr/bin/docker run --name thanos \
-              -p 10900-10902:10900-10902 \
+              -p 10901-10902:10901-10902 \
               -v /opt/prometheus:/opt/prometheus \
               -v /opt/thanos:/opt/thanos \
               --network=prom \
               improbable/thanos:#{@thanos_version} \
               sidecar \
-              --cluster.peers=#{thanos_peers}:10900 \
-              --cluster.advertise-address=$${COREOS_EC2_IPV4_LOCAL}:10900 \
-              --grpc-advertise-address=$${COREOS_EC2_IPV4_LOCAL}:10901 \
               --prometheus.url=http://prometheus:9090 \
               --tsdb.path=/opt/prometheus/data \
               --objstore.config-file=/opt/thanos/bucket.yml \
-              --log.level=warn \
-              --no-cluster.disable
+              --log.level=warn
             Restart=always
             RestartSec=30
           THANOS_SIDE
@@ -183,66 +209,78 @@ module Terrafying
         {
           path: '/opt/prometheus/prometheus.yml',
           mode: 0o644,
-          contents: <<~PROM
+          contents: ERB.new(<<~'END', 0, '-', '_').result(binding)
             global:
               external_labels:
                 monitor: prometheus
-                cluster: "#{@vpc.name}"
+                cluster: <%= @vpc.name %>
                 replica: {{HOST}}
               scrape_interval: 15s
             scrape_configs:
-            - job_name: "ec2"
+            # While AWS EC2 instance support up to 50 tags, we wouldn't be able
+            # to fit such a long configuration file into user_data of the
+            # instance; user_data is limited to just 16k.
+            # This configuration support scraping up to 5 ports per instance:
+            <%- prom_tag_name_suffixes = [''] + (0..3).map {|i| "_#{i}"} -%>
+            <%- prom_tag_name_suffixes.each do |suffix| -%>
+            - job_name: ec2<%= suffix %>
               params:
                 format: ["prometheus"]
               ec2_sd_configs:
               - region: eu-west-1
                 filters:
                 - name: vpc-id
-                  values: ["#{@vpc.id}"]
-                - name: tag-key
+                  values: ["<%= @vpc.id %>"]
+                - # by using the same ec2_sd_configs we are able to share single
+                  # provider instance thanks to SD configuration coalescing
+                  # therefore "prometheus_port" tag must always be present on
+                  # the instance to be discovered (i. e. "prometheus_port_*" tag
+                  # would not be sufficient if "  " tag is missing)
+                  name: tag-key
                   values: ["prometheus_port"]
               relabel_configs:
-              - source_labels: [__meta_ec2_private_ip, __meta_ec2_tag_prometheus_port]
-                replacement: $1:$2
-                regex: ([^:]+)(?::\\\\d+)?;(\\\\d+)
+              - source_labels: [__meta_ec2_tag_prometheus_port<%= suffix %>]
+                regex: (.+)
+                action: keep
+              - source_labels: [__meta_ec2_private_ip, __meta_ec2_tag_prometheus_port<%= suffix %>]
                 target_label: __address__
+                separator: ':'
+              - source_labels: [__meta_ec2_tag_prometheus_path<%= suffix %>]
+                target_label: __metrics_path__
+                regex: (.+)
               - source_labels: [__meta_ec2_instance_id]
                 target_label: instance_id
               - source_labels: [__meta_ec2_tag_envoy_cluster]
                 target_label: envoy_cluster
-              - source_labels: [__meta_ec2_tag_prometheus_path]
-                regex: (.+)
-                replacement: $1
-                target_label: __metrics_path__
-          PROM
+            <%- end -%>
+          END
         }
       end
 
-      def thanos_unit(thanos_peers)
+      def thanos_unit(prometheus_thanos_sidecar_srv_fqdn)
         {
           name: 'thanos.service',
           contents: <<~THANOS_UNIT
             [Install]
             WantedBy=multi-user.target
-             [Unit]
+
+            [Unit]
             Description=Thanos Service
             After=docker.service
             Requires=docker.service
-             [Service]
-            EnvironmentFile=/run/metadata/coreos
+
+            [Service]
             ExecStartPre=-/usr/bin/docker kill thanos
             ExecStartPre=-/usr/bin/docker rm thanos
             ExecStartPre=/usr/bin/docker pull improbable/thanos:#{@thanos_version}
             ExecStart=/usr/bin/docker run --name thanos \
-              -p 10900-10902:10900-10902 \
+              -p 10901-10902:10901-10902 \
               improbable/thanos:#{@thanos_version} \
               query \
-              --cluster.peers=#{thanos_peers}:10900 \
-              --cluster.advertise-address=$${COREOS_EC2_IPV4_LOCAL}:10900 \
-              --grpc-advertise-address=$${COREOS_EC2_IPV4_LOCAL}:10901 \
               --query.replica-label=replica \
-              --log.level=warn \
-              --no-cluster.disable
+              --query.max-concurrent=#{@instance_vcpu_count} \
+              --store=dnssrv+#{prometheus_thanos_sidecar_srv_fqdn} \
+              --log.level=warn
             Restart=always
             RestartSec=30
           THANOS_UNIT
@@ -296,35 +334,26 @@ module Terrafying
       end
 
       def cloudwatch_alarm(name, namespace, dimensions)
-        resource 'aws_cloudwatch_metric_alarm', name, {
-          alarm_name: name,
-          comparison_operator: 'GreaterThanOrEqualToThreshold',
-          evaluation_periods: '1',
-          metric_name: 'UnHealthyHostCount',
-          namespace: namespace,
-          period: '180',
-          threshold: '1',
-          statistic: 'Minimum',
-          alarm_description: "Monitoring #{name} target group host health",
-          dimensions: dimensions,
-          alarm_actions: ['arn:aws:sns:eu-west-1:136393635417:prometheus_cloudwatch_topic'],
-          ok_actions: ['arn:aws:sns:eu-west-1:136393635417:prometheus_cloudwatch_topic'],
-        }
-      end
-
-      def create_prometheus_cloudwatch_alert(service)
-        cloudwatch_alarm service.name, 'AWS/ApplicationELB', {
-          LoadBalancer: output_of('aws_lb', service.load_balancer.name, 'arn_suffix'),
-          TargetGroup: service.load_balancer.targets.first.target_group.to_s.gsub(/id/, 'arn_suffix')
-        }
+        resource 'aws_cloudwatch_metric_alarm', name,
+                 alarm_name: name,
+                 comparison_operator: 'GreaterThanOrEqualToThreshold',
+                 evaluation_periods: '1',
+                 metric_name: 'UnHealthyHostCount',
+                 namespace: namespace,
+                 period: '180',
+                 threshold: '1',
+                 statistic: 'Minimum',
+                 alarm_description: "Monitoring #{name} target group host health",
+                 dimensions: dimensions,
+                 alarm_actions: ['arn:aws:sns:eu-west-1:136393635417:prometheus_cloudwatch_topic'],
+                 ok_actions: ['arn:aws:sns:eu-west-1:136393635417:prometheus_cloudwatch_topic']
       end
 
       def create_thanos_cloudwatch_alert(service)
         service.load_balancer.targets.each_with_index do |target, i|
-          cloudwatch_alarm "#{service.name}_#{i}", 'AWS/NetworkELB', {
-            LoadBalancer: output_of('aws_lb', service.load_balancer.name, 'arn_suffix'),
-            TargetGroup: target.target_group.to_s.gsub(/id/, 'arn_suffix')
-          }
+          cloudwatch_alarm "#{service.name}_#{i}", 'AWS/NetworkELB',
+                           LoadBalancer: output_of('aws_lb', service.load_balancer.name, 'arn_suffix'),
+                           TargetGroup: target.target_group.to_s.gsub(/id/, 'arn_suffix')
         end
       end
     end

data/lib/terrafying/components/selfsignedca.rb

@@ -1,189 +1,175 @@
+# frozen_string_literal: true
+
 require 'terrafying/components/ca'
 require 'terrafying/generator'
 
 module Terrafying
-
   module Components
-
     class SelfSignedCA < Terrafying::Context
-
       attr_reader :name, :source, :ca_key
 
       include CA
 
-      def self.create(name, bucket, options={})
+      def self.create(name, bucket, options = {})
         SelfSignedCA.new.create name, bucket, options
       end
 
-      def initialize()
+      def initialize
         super
       end
 
-      def create(name, bucket, options={})
+      def create(name, bucket, options = {})
         options = {
-          prefix: "",
+          prefix: '',
           common_name: name,
-          organization: "uSwitch Limited",
+          organization: 'uSwitch Limited',
           public_certificate: false,
-          curve: "P384",
+          curve: 'P384'
         }.merge(options)
 
         @name = name
         @bucket = bucket
         @prefix = options[:prefix]
-        @algorithm = options[:algorithm] || "ECDSA"
+        @algorithm = options[:algorithm] || 'ECDSA'
 
         @ident = "#{name}-ca"
 
-        if options[:public_certificate]
-          cert_acl = "public-read"
-        else
-          cert_acl = "private"
-        end
+        cert_acl = if options[:public_certificate]
+                     'public-read'
+                   else
+                     'private'
+                   end
 
         @source = object_url(@name, :cert)
 
         if options[:ca_key] && options[:ca_cert]
           @ca_key = options[:ca_key]
           @ca_cert = options[:ca_cert]
-          resource :aws_s3_bucket_object, "#{@name}-cert", {
-                     bucket: @bucket,
-                     key: object_key(@name, :cert),
-                     content: @ca_cert,
-                     acl: cert_acl,
-                   }
+          resource :aws_s3_bucket_object, "#{@name}-cert",
+                   bucket: @bucket,
+                   key: object_key(@name, :cert),
+                   content: @ca_cert,
+                   acl: cert_acl
           return self
         end
 
         provider :tls, {}
 
-        resource :tls_private_key, @ident, {
-                   algorithm: @algorithm,
-                   ecdsa_curve: options[:curve],
-                 }
-
-        resource :tls_self_signed_cert, @ident, {
-                   key_algorithm: @algorithm,
-                   private_key_pem: output_of(:tls_private_key, @ident, :private_key_pem),
-                   subject: {
-                     common_name: options[:common_name],
-                     organization: options[:organization],
-                   },
-                   is_ca_certificate: true,
-                   validity_period_hours: 24 * 365,
-                   allowed_uses: [
-                     "certSigning",
-                     "digitalSignature",
-                   ],
-                 }
+        resource :tls_private_key, @ident,
+                 algorithm: @algorithm,
+                 ecdsa_curve: options[:curve]
+
+        resource :tls_self_signed_cert, @ident,
+                 key_algorithm: @algorithm,
+                 private_key_pem: output_of(:tls_private_key, @ident, :private_key_pem),
+                 subject: {
+                   common_name: options[:common_name],
+                   organization: options[:organization]
+                 },
+                 is_ca_certificate: true,
+                 validity_period_hours: 24 * 365,
+                 allowed_uses: %w[
+                   certSigning
+                   digitalSignature
+                 ]
 
         @ca_key = output_of(:tls_private_key, @ident, :private_key_pem)
         @ca_cert = output_of(:tls_self_signed_cert, @ident, :cert_pem)
 
-        resource :aws_s3_bucket_object, object_name(@name, :cert), {
-                   bucket: @bucket,
-                   key: object_key(@name, :cert),
-                   content: @ca_cert,
-                   acl: cert_acl,
-                 }
+        resource :aws_s3_bucket_object, object_name(@name, :cert),
+                 bucket: @bucket,
+                 key: object_key(@name, :cert),
+                 content: @ca_cert,
+                 acl: cert_acl
 
         self
       end
 
       def keypair
-        @ca_key_ref ||= resource :aws_s3_bucket_object, object_name(@name, :key), {
-                                   bucket: @bucket,
-                                   key: File.join('', @prefix, @name, "ca.key"),
-                                   content: @ca_key,
-                                 }
+        @ca_key_ref ||= resource :aws_s3_bucket_object, object_name(@name, :key),
+                                 bucket: @bucket,
+                                 key: File.join('', @prefix, @name, 'ca.key'),
+                                 content: @ca_key
 
         {
           ca: self,
           path: {
-            cert: File.join("/etc/ssl", @name, "ca.cert"),
-            key: File.join("/etc/ssl", @name, "ca.key"),
+            cert: File.join('/etc/ssl', @name, 'ca.cert'),
+            key: File.join('/etc/ssl', @name, 'ca.key')
           },
           source: {
             cert: object_url(@name, :cert),
-            key: object_url(@name, :key),
+            key: object_url(@name, :key)
           },
           resources: [
             "aws_s3_bucket_object.#{object_name(@name, :key)}",
             "aws_s3_bucket_object.#{object_name(@name, :cert)}"
           ],
           iam_statement: {
-            Effect: "Allow",
+            Effect: 'Allow',
             Action: [
-              "s3:GetObjectAcl",
-              "s3:GetObject",
+              's3:GetObjectAcl',
+              's3:GetObject'
             ],
             Resource: [
               object_arn(@name, :cert),
-              object_arn(@name, :key),
+              object_arn(@name, :key)
             ]
           }
         }
       end
 
-      def create_keypair_in(ctx, name, options={})
+      def create_keypair_in(ctx, name, options = {})
         options = {
           common_name: name,
-          organization: "uSwitch Limited",
+          organization: 'uSwitch Limited',
           validity_in_hours: 24 * 365,
-          allowed_uses: [
-            "nonRepudiation",
-            "digitalSignature",
-            "keyEncipherment"
+          allowed_uses: %w[
+            nonRepudiation
+            digitalSignature
+            keyEncipherment
           ],
           dns_names: [],
           ip_addresses: [],
-          curve: "P384",
+          curve: 'P384'
         }.merge(options)
 
         key_ident = object_ident(name)
 
-        ctx.resource :tls_private_key, key_ident, {
-                       algorithm: @algorithm,
-                       ecdsa_curve: options[:curve],
-                     }
-
-        ctx.resource :tls_cert_request, key_ident, {
-                       key_algorithm: @algorithm,
-                       private_key_pem: output_of(:tls_private_key, key_ident, :private_key_pem),
-                       subject: {
-                         common_name: options[:common_name],
-                         organization: options[:organization],
-                       },
-                       dns_names: options[:dns_names],
-                       ip_addresses: options[:ip_addresses],
-                     }
-
-        ctx.resource :tls_locally_signed_cert, key_ident, {
-                       cert_request_pem: output_of(:tls_cert_request, key_ident, :cert_request_pem),
-                       ca_key_algorithm: @algorithm,
-                       ca_private_key_pem: @ca_key,
-                       ca_cert_pem: @ca_cert,
-                       validity_period_hours: options[:validity_in_hours],
-                       allowed_uses: options[:allowed_uses],
-                     }
-
-        ctx.resource :aws_s3_bucket_object, object_name(name, :key), {
-                       bucket: @bucket,
-                       key: object_key(name, :key, "${sha256(tls_private_key.#{key_ident}.private_key_pem)}"),
-                       content: output_of(:tls_private_key, key_ident, :private_key_pem),
-                     }
-
-        ctx.resource :aws_s3_bucket_object, object_name(name, :cert), {
-                       bucket: @bucket,
-                       key: object_key(name, :cert, "${sha256(tls_locally_signed_cert.#{key_ident}.cert_pem)}"),
-                       content: output_of(:tls_locally_signed_cert, key_ident, :cert_pem),
-                     }
+        ctx.resource :tls_private_key, key_ident,
+                     algorithm: @algorithm,
+                     ecdsa_curve: options[:curve]
+
+        ctx.resource :tls_cert_request, key_ident,
+                     key_algorithm: @algorithm,
+                     private_key_pem: output_of(:tls_private_key, key_ident, :private_key_pem),
+                     subject: {
+                       common_name: options[:common_name],
+                       organization: options[:organization]
+                     },
+                     dns_names: options[:dns_names],
+                     ip_addresses: options[:ip_addresses]
+
+        ctx.resource :tls_locally_signed_cert, key_ident,
+                     cert_request_pem: output_of(:tls_cert_request, key_ident, :cert_request_pem),
+                     ca_key_algorithm: @algorithm,
+                     ca_private_key_pem: @ca_key,
+                     ca_cert_pem: @ca_cert,
+                     validity_period_hours: options[:validity_in_hours],
+                     allowed_uses: options[:allowed_uses]
+
+        ctx.resource :aws_s3_bucket_object, object_name(name, :key),
+                     bucket: @bucket,
+                     key: object_key(name, :key, "${sha256(tls_private_key.#{key_ident}.private_key_pem)}"),
+                     content: output_of(:tls_private_key, key_ident, :private_key_pem)
+
+        ctx.resource :aws_s3_bucket_object, object_name(name, :cert),
+                     bucket: @bucket,
+                     key: object_key(name, :cert, "${sha256(tls_locally_signed_cert.#{key_ident}.cert_pem)}"),
+                     content: output_of(:tls_locally_signed_cert, key_ident, :cert_pem)
 
         reference_keypair(ctx, name)
       end
-
     end
-
   end
-
 end