Jorge Falcon
ae8863ce64
# Main terraform - Modified iam `resource "aws_iam_role_policy_attachment" "extras"` from `for_each` to `count`, which allows terraform to apply even if roles are not yet created. In cases where role is not yet created, a second terraform apply is required for the resource to attach the policy. - Modified iam `resource "aws_iam_role_policy_attachment" "execution_extras"`, which allows terraform to apply even if roles are not yet created. In cases where role is not yet created, a second terraform apply is required for the resource to attach the policy. - Added support for internal load balancers to be provisioned. - Added support for toggling deletion protection on and off on the load balancer resource. # Example Module - Updated example module with changes alb changes. # Module: Cloudfront Software Installers - Added a count & tertiary to cloudfront software installer kms key policy, as it's fed in as an input. In cases where the key had not yet been created, apply would fail. - Modified `variable "s3_kms_key_id"` to allow default value `null` # Module: Logging Destination Firehose - Added prefix variable to support use-cases where multiple environments are deployed in the same account # Module: Osquery Perf - Added dependency on `data.aws_secretsmanager_secret_version.enroll_secret` to fix race condition.
40 lines
917 B
Terraform
40 lines
917 B
Terraform
resource "tls_private_key" "scep_key" {
|
|
algorithm = "RSA"
|
|
rsa_bits = 4096
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "scep_cert" {
|
|
private_key_pem = tls_private_key.scep_key.private_key_pem
|
|
|
|
subject {
|
|
common_name = "Fleet Root CA"
|
|
organization = "Fleet."
|
|
country = "US"
|
|
}
|
|
|
|
is_ca_certificate = true
|
|
validity_period_hours = 87648
|
|
|
|
allowed_uses = [
|
|
"cert_signing",
|
|
"crl_signing",
|
|
"key_encipherment",
|
|
"digital_signature",
|
|
]
|
|
}
|
|
|
|
resource "random_password" "challenge" {
|
|
length = 12
|
|
special = false
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "scep" {
|
|
secret_id = module.mdm.scep.id
|
|
secret_string = jsonencode(
|
|
{
|
|
FLEET_MDM_APPLE_SCEP_CERT_BYTES = tls_self_signed_cert.scep_cert.cert_pem
|
|
FLEET_MDM_APPLE_SCEP_KEY_BYTES = tls_private_key.scep_key.private_key_pem
|
|
FLEET_MDM_APPLE_SCEP_CHALLENGE = random_password.challenge.result
|
|
}
|
|
)
|
|
} |