terrafying-components 1.14.10 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96ab02163f59abbca33da70716d52b158df9b5bd82311babe7f895a754fbc7d3
-  data.tar.gz: 35012aee6747600bee403b48402fb4ef8e84b72f90cd9a6c390ee55d72adcf04
+  metadata.gz: 6b23fdea2286a2479dbf077b4c22324c2b0aadd3eb9b92da59c1518ea1ca47c5
+  data.tar.gz: cf2b7383cea8ea495f8762b663d6d595365b4da58563dc8c34f94197ad75c87f
 SHA512:
-  metadata.gz: 51290d391c153825fdc4def0660132722a0a9d632cce7bde8d9230201b608833338ca551e81ef2b71c9993eb6d6ac4a3bc7b4352ec9d9bce79d757fdc574ad49
-  data.tar.gz: 3540ebe6318ab64509011792d333ea48bfabb5eceb03f28e07d5f39ae0bc0b12959ec36e689ec4d2e9699f89dba28be8c49372eca74ca10a2e7fe1852235fcb4
+  metadata.gz: ec5cda26c1162f9b0e9b034ae84a97ac0c27c1d14a350ca20bca601afe9c354f6d059e75a3ed781c37f6bbe96784464e4f0531cfbc2fdd448b7968b10d4cd9a1
+  data.tar.gz: 601c572f76ca019a6621bbdd66639b03b5ce1334b043e50716cf65346f32a6a233345f618db2314a08b459e7bde62bdafb582e40ee88dd46f93577a0a511876e

data/lib/terrafying/components/letsencrypt.rb

@@ -16,13 +16,11 @@ module Terrafying
       def self.find(name, bucket, options = {})
         LetsEncrypt.new.find name, bucket, options
       end
-      def self.renew(name, bucket, domains, options = {})
-        LetsEncrypt.new.renew name, bucket, domains, options
-      end
 
       def initialize
         super
         @acme_providers = setup_providers
+        @zones = []
       end
 
       def setup_providers
@@ -48,7 +46,8 @@ module Terrafying
           public_certificate: false,
           curve: 'P384',
           rsa_bits: '3072',
-          use_external_dns: false
+          use_external_dns: false,
+          renewing: false
         }.merge(options)
 
         @name = name
@@ -56,6 +55,9 @@ module Terrafying
         @prefix = options[:prefix]
         @acme_provider = @acme_providers[options[:provider]]
         @use_external_dns = options[:use_external_dns]
+        @renewing = options[:renewing]
+
+        renew() if @renewing
 
         provider :tls, {}
 
@@ -145,9 +147,11 @@ module Terrafying
           organization: "uSwitch Limited",
           dns_names: [],
           ip_addresses: [],
-          curve: "P384",
+          curve: "P384"
         }.merge(options)
 
+        @zones << options[:zone] if options[:zone]
+
         key_ident = "#{@name}-#{tf_safe(name)}"
 
         ctx.resource :tls_private_key, key_ident,
@@ -203,11 +207,14 @@ module Terrafying
 
         cert_version = "${sha256(acme_certificate.#{key_ident}.certificate_pem)}"
 
-        ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert",
+        cert_config = {
                      bucket: @bucket,
                      key: object_key(name, :cert, cert_version),
                      content: output_of(:acme_certificate, key_ident, :certificate_pem).to_s + @ca_cert,
-                     lifecycle: { ignore_changes: [ "content" ] } # the lambda will be updating it
+        }
+        cert_config[:lifecycle] = { ignore_changes: [ "content" ] } if @renewing
+
+        ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert", cert_config
 
         ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert-latest",
                      bucket: @bucket,
@@ -217,55 +224,14 @@ module Terrafying
         reference_keypair(ctx, name, key_version: key_version, cert_version: cert_version)
       end
 
-      def renew(name, bucket, domains, options={})
-        options = {
-          prefix: "",
-          provider: :staging,
-        }.merge(options)
+      def output_with_children
+        @prefix_path = [@prefix, @name].reject(&:empty?).join("/")
 
-        @name = name
-        @bucket = bucket
-        @domains = domains
-        @prefix = options[:prefix]
-
-        resource :aws_lambda_function, "#{@name}_lambda", {
-          function_name: "#{@name}_lambda",
-          s3_bucket: "uswitch-certbot-lambda",
-          s3_key: "certbot-lambda.zip",
-          handler: "main.handler",
-          runtime: "python3.7",
-          timeout: "900",
-          role: "${aws_iam_role.#{@name}_lambda_execution.arn}",
-          environment:{
-            variables: {
-              CA_BUCKET: @bucket,
-              CA_PREFIX: @prefix,
-            }
-          }
-        }
-
-        resource :aws_iam_role, "#{@name}_lambda_execution", {
-          name: "#{@name}_lambda_execution",
-          assume_role_policy: JSON.pretty_generate(
-                {
-                  Version: "2012-10-17",
-                  Statement: [
-                    {
-                      Action: "sts:AssumeRole",
-                      Principal: {
-                        Service: "lambda.amazonaws.com"
-                        },
-                      Effect: "Allow",
-                      Sid: ""
-                    }
-                  ]
-                }
-              )
-            }
-
-        resource :aws_iam_policy, "#{@name}_lambda_execution_policy", {
+        iam_policy = {}
+        if @renewing
+          iam_policy = resource :aws_iam_policy, "#{@name}_lambda_execution_policy", {
           name: "#{@name}_lambda_execution_policy",
-          description: "A policy for the #{@name}-lambda function to access S3",
+          description: "A policy for the #{@name}_lambda function to access S3 and R53",
           policy: JSON.pretty_generate(
                 {
                   Version: "2012-10-17",
@@ -277,7 +243,7 @@ module Terrafying
                         "s3:DeleteObject"
                       ],
                       Resource: [
-                        "arn:aws:s3:::#{@bucket}/#{@prefix}/*"
+                        "arn:aws:s3:::#{@bucket}/#{@prefix_path}/*"
                       ],
                       Effect: "Allow"
                     },
@@ -324,8 +290,8 @@ module Terrafying
                         "route53:ChangeResourceRecordSets",
                       ],
                       Resource:
-                        domains.map { | domain |
-                          "arn:aws:route53:::#{domain.zone.id[1..-1]}"
+                        @zones.compact.map { | zone |
+                          "arn:aws:route53:::#{zone.id[1..-1]}"
                         },
                       Effect: "Allow"
                     }
@@ -333,14 +299,53 @@ module Terrafying
                 }
               )
             }
+          end
+        super
+      end
+
+      def renew
+        execution_role = resource :aws_iam_role, "#{@name}_lambda_execution", {
+          name: "#{@name}_lambda_execution",
+          assume_role_policy: JSON.pretty_generate(
+                {
+                  Version: "2012-10-17",
+                  Statement: [
+                    {
+                      Action: "sts:AssumeRole",
+                      Principal: {
+                        Service: "lambda.amazonaws.com"
+                        },
+                      Effect: "Allow",
+                      Sid: ""
+                    }
+                  ]
+                }
+              )
+            }
+
+        resource :aws_lambda_function, "#{@name}_lambda", {
+          function_name: "#{@name}_lambda",
+          s3_bucket: "uswitch-certbot-lambda",
+          s3_key: "certbot-lambda.zip",
+          handler: "main.handler",
+          runtime: "python3.7",
+          timeout: "900",
+          role: execution_role["arn"],
+          environment:{
+            variables: {
+              CA_BUCKET: @bucket,
+              CA_PREFIX: @prefix_path
+            }
+          }
+        }
 
         resource :aws_iam_role_policy_attachment, "#{@name}_lambda_policy_attachment", {
-            role: "${aws_iam_role.#{@name}_lambda_execution.name}",
+            role: execution_role["name"],
             policy_arn: "${aws_iam_policy.#{@name}_lambda_execution_policy.arn}"
             }
 
-          self
-        end
+        self
+      end
 
     end
   end

data/lib/terrafying/components/version.rb

@@ -2,6 +2,6 @@
 
 module Terrafying
   module Components
-    VERSION = '1.14.10'
+    VERSION = '1.15.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: terrafying-components
 version: !ruby/object:Gem::Version
-  version: 1.14.10
+  version: 1.15.0
 platform: ruby
 authors:
 - uSwitch Limited
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-19 00:00:00.000000000 Z
+date: 2020-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake