search

serverless-ca / terraform-aws-ca

Terraform module for serverless certificate authority on AWS
https://serverlessca.com/
Other
102 stars 13 forks source link

Lambda functions should not try to resolve resource names #166

Closed 1oglop1 closed 2 weeks ago

1oglop1 commented 4 months ago

Hi, I am restructuring the solution to fit our use-case and I wanted to avoid modification of the Python code, however the functions which rely on the resolution of resource names rather than resource IDs passed in as parameters.

namely:

https://github.com/serverless-ca/terraform-aws-ca/blob/7e14b3254a44a4bf1492818906636f57129a098f/modules/terraform-aws-ca-lambda/utils/certs/ca.py#L28-L32

https://github.com/serverless-ca/terraform-aws-ca/blob/7e14b3254a44a4bf1492818906636f57129a098f/modules/terraform-aws-ca-lambda/utils/certs/kms.py#L13-L18

https://github.com/serverless-ca/terraform-aws-ca/blob/7e14b3254a44a4bf1492818906636f57129a098f/modules/terraform-aws-ca-lambda/utils/certs/db.py#L13-L20

are forcing certain naming conventions which do not fit my environment.

Would it be possible to update the code so that dynamoDB and kms aliases/arns are function parameters rather than resolved from the naming convention?

paulschwarzenberger commented 4 months ago

Hi @1oglop1 this is a good idea to allow more flexibility. We can set all of these as environment variables. Then, in the Terraform, we can pass the environment variables in to the Lambda functions, and use Terraform conditionals to set the current names as the defaults, with additional optional variables that can be passed in from the top level module for people who want to pass in custom resource names. We're already doing something along these lines for the S3 buckets using the optional bucket_prefix Terraform variable.

Is this something you'd be interested in submitting a PR / PRs for? If so, before you start let's have a discussion via Slack, you can reach me on the CloudSecurityForum Slack workspace. If you're not already a member, please email me on paul@celidor.net with your preferred email address and I'll invite you.

1oglop1 commented 4 months ago

paul@celidor.net

Yes, I'd be interested in contributing back, it would release me from having to maintain a fork. I talked with our security specialist and found one more improvement which is required to meet the standard. Looking forward to your invitation.

paulschwarzenberger commented 4 months ago

invite requested, you should get it once approved by a moderator

paulschwarzenberger commented 2 weeks ago

@1oglop1 I'm closing this issue for now, but feel free to reopen if you have time to work on this!