add TLS to the SQS broker

manifests/cf-manifest/operations.d/760-sqs-broker.yml

@@ -4,9 +4,9 @@
   path: /releases/-
   value:
     name: sqs-broker
-    version: 0.1.15
-    url: https://s3-eu-west-1.amazonaws.com/gds-paas-build-releases/sqs-broker-0.1.15.tgz
-    sha1: 076c8eed7777bbc821304a492c7da112cd7d256c
+    version: 0.0.1697033641
+    url: https://s3-eu-west-1.amazonaws.com/gds-paas-build-releases/sqs-broker-0.0.1697033641.tgz
+    sha1: 2d8a9b842256e39d1def63ec552d7c7875b4721d
 
 
 - type: replace
@@ -32,7 +32,7 @@
         release: sqs-broker
         properties:
           sqs-broker:
-            port: 80
+            port: 443
             basic_auth_username: sqs-broker
             basic_auth_password: ((secrets_sqs_broker_admin_password))
             log_level: INFO
@@ -42,6 +42,7 @@
             additional_user_policy: "((terraform_outputs_restrict_to_local_ips_policy_arn))"
             permissions_boundary: "((terraform_outputs_sqs_broker_permissions_boundary_arn))"
             deploy_environment: "((environment))"
+            tls: ((secrets_sqs_broker_tls_cert))
             locket:
               api_location: "locket.service.cf.internal:8891"
               ca_cert: "((diego_locket_client.ca))"
@@ -96,3 +97,15 @@
   value:
     name: secrets_sqs_broker_admin_password
     type: password
+
+- type: replace
+  path: /variables/-
+  value:
+    name: secrets_sqs_broker_tls_cert
+    type: certificate
+    update_mode: converge
+    options:
+      ca: broker_tls_ca
+      common_name: "sqs-broker.service.cf.internal"
+      alternative_names:
+        - "sqs-broker.service.cf.internal"

terraform/cloudfoundry/broker_alb.tf

@@ -92,13 +92,13 @@ resource "aws_lb_listener_rule" "cf_s3_broker" {
 }
 
 resource "aws_lb_target_group" "cf_s3_broker" {
-  name     = "${var.env}-cf-s3-broker"
-  port     = 80
-  protocol = "HTTP"
-  vpc_id   = var.vpc_id
+  name  = "${substr(format("%s-%s", "${var.env}-cf-s3-broker", replace(uuid(), "-", "")), 0, 32)}"
+  port        = 443
+  protocol    = "HTTPS"
+  vpc_id      = var.vpc_id
 
   health_check {
-    port                = 80
+    port                = 443
     path                = "/healthcheck"
     protocol            = "HTTP"
     interval            = var.health_check_interval
@@ -136,13 +136,13 @@ resource "aws_lb_listener_rule" "cf_sqs_broker" {
 }
 
 resource "aws_lb_target_group" "cf_sqs_broker" {
-  name     = "${var.env}-cf-sqs-broker"
-  port     = 80
-  protocol = "HTTP"
-  vpc_id   = var.vpc_id
+  name  = "${substr(format("%s-%s", "${var.env}-cf-sqs-broker", replace(uuid(), "-", "")), 0, 32)}"
+  port        = 443
+  protocol    = "HTTPS"
+  vpc_id      = var.vpc_id
 
   health_check {
-    port                = 80
+    port                = 443
     path                = "/healthcheck"
     protocol            = "HTTP"
     interval            = var.health_check_interval

terraform/cloudfoundry/sqs_broker.tf

@@ -13,16 +13,16 @@ resource "aws_elb" "sqs_broker" {
   }
 
   health_check {
-    target              = "HTTP:80/healthcheck"
+    target              = "HTTPS:443/healthcheck"
     interval            = var.health_check_interval
     timeout             = var.health_check_timeout
     healthy_threshold   = var.health_check_healthy
     unhealthy_threshold = var.health_check_unhealthy
   }
 
   listener {
-    instance_port      = 80
-    instance_protocol  = "http"
+    instance_port      = 443
+    instance_protocol  = "https"
     lb_port            = 443
     lb_protocol        = "https"
     ssl_certificate_id = data.aws_acm_certificate.system.arn
@@ -39,4 +39,3 @@ resource "aws_lb_ssl_negotiation_policy" "sqs_broker" {
     value = random_pet.elb_cipher.keepers.default_classic_load_balancer_security_policy
   }
 }
-