diff --git a/configure.py b/configure.py index 2739745..1d74cc5 100755 --- a/configure.py +++ b/configure.py @@ -144,9 +144,7 @@ def main(raw_args=None): # Iterate through the different regions specified and produce an output file for each region. for region in config['perspectives']: aws_perspective_tf_region = aws_perspective_tf.replace("{{region}}", region) - - # Replace the deployment id. - aws_perspective_tf_region = aws_perspective_tf_region.replace("{{deployment-id}}", str(deployment_id)) + # Construct the default CAA domain list. default_caa_domains_list = "|".join(config['caa-domains']) aws_perspective_tf_region = aws_perspective_tf_region.replace("{{default-caa-domains}}", f"\"{default_caa_domains_list}\"") diff --git a/open-tofu/aws-perspective.tf.template b/open-tofu/aws-perspective.tf.template index 9a6b8f6..cc5ef47 100644 --- a/open-tofu/aws-perspective.tf.template +++ b/open-tofu/aws-perspective.tf.template @@ -1,7 +1,7 @@ # Each layer must be created in the region of the functions. resource "aws_lambda_layer_version" "python3_open_mpic_layer_{{region}}" { filename = "../layer/python3_layer_content.zip" - layer_name = "python3_open_mpic_layer_{{region}}_{{deployment-id}}" + layer_name = "python3_open_mpic_layer_{{region}}_${local.deployment_id}" source_code_hash = "${filebase64sha256("../layer/python3_layer_content.zip")}" compatible_runtimes = ["python3.11"] provider = aws.{{region}} @@ -197,7 +197,7 @@ resource "aws_route53_resolver_dnssec_config" "dnssec_config_{{region}}" { resource "aws_lambda_function" "mpic_dcv_checker_lambda_{{region}}" { filename = "../{{source-path}}/mpic_dcv_checker_lambda/mpic_dcv_checker_lambda.zip" - function_name = "open_mpic_dcv_checker_lambda_{{region}}_{{deployment-id}}" + function_name = "open_mpic_dcv_checker_lambda_{{region}}_${local.deployment_id}" role = aws_iam_role.open_mpic_lambda_role.arn depends_on = [ aws_iam_role.open_mpic_lambda_role, @@ -228,7 +228,7 @@ resource "aws_lambda_function" "mpic_dcv_checker_lambda_{{region}}" { resource "aws_lambda_function" "mpic_caa_checker_lambda_{{region}}" { filename = "../{{source-path}}/mpic_caa_checker_lambda/mpic_caa_checker_lambda.zip" - function_name = "open_mpic_caa_checker_lambda_{{region}}_{{deployment-id}}" + function_name = "open_mpic_caa_checker_lambda_{{region}}_${local.deployment_id}" role = aws_iam_role.open_mpic_lambda_role.arn depends_on = [ aws_iam_role.open_mpic_lambda_role, diff --git a/open-tofu/eventbridge_warmer.tf b/open-tofu/eventbridge_warmer.tf new file mode 100644 index 0000000..1f45ef9 --- /dev/null +++ b/open-tofu/eventbridge_warmer.tf @@ -0,0 +1,102 @@ +resource "aws_scheduler_schedule" "open_mpic_warmer_schedule" { + for_each = { + for k, v in { + # TODO instead of using valid MPIC requests, evaluate to modify the coordinator Lambda to receive an especial parameter to trigger the warmup of all the perspectives. That would simplify things by requiring a single warmer, instead of two, as now. + caa = { + check_type = "caa" + domain_or_ip_target = "invalid" + orchestration_parameters = { + perspective_count = length(keys(local.perspectives)) + } + } + dcv = { + check_type = "dcv" + domain_or_ip_target = "invalid" + dcv_check_parameters = { + validation_method = "dns-change" + dns_record_type = "TXT" + challenge_value = "dummy" + } + orchestration_parameters = { + perspective_count = length(keys(local.perspectives)) + } + } + } : k => v if var.eventbridge_warmer_enabled + } + name = "open-mpic-${each.key}-warmer-schedule-${local.deployment_id}" + group_name = "default" + + flexible_time_window { + mode = "OFF" + } + + schedule_expression = "rate(5 minutes)" + + target { + arn = aws_lambda_function.mpic_coordinator_lambda.arn + role_arn = aws_iam_role.open_mpic_warmer_role[0].arn + input = jsonencode({ + resource = "/dummy", + path = "/dummy", + httpMethod = "POST", + headers = {}, + multiValueHeaders = {}, + requestContext = { + accountId = "dummy", + apiId = "dummy", + stage = "dummy", + protocol = "dummy", + identity = { + sourceIp = "0.0.0.0" + }, + requestId = "dummy", + requestTime = "dummy", + requestTimeEpoch = 0, + resourcePath = "dummy", + httpMethod = "POST", + path = "dummy" + }, + body = jsonencode(each.value) + }) + } +} + +resource "aws_iam_role" "open_mpic_warmer_role" { + count = var.eventbridge_warmer_enabled ? 1 : 0 + name = "open-mpic-warmer-role-${local.deployment_id}" + + assume_role_policy = <