diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca17754..e9e51af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,3 +27,11 @@
* 1.1.0 -- 2024-05-17
- acmpca-iam-rolesanywhere new submodule
+
+* 1.2.0 -- 2024-09-11
+ - acmpca
+ - add `import_to_acm` (false) to allow for the certificate to be imported into ACM for the purpose of tracking expiration, as acmpca certs are not visible in the account
+ - acmpca-eks-cert-manager
+ - add `import_to_acm` (true)
+ - acmpca-iam-rolesanywhere
+ - add `import_to_acm` (true)
diff --git a/acmpca-eks-cert-manager/README.md b/acmpca-eks-cert-manager/README.md
index 03ee174..7f6bd5e 100644
--- a/acmpca-eks-cert-manager/README.md
+++ b/acmpca-eks-cert-manager/README.md
@@ -106,6 +106,7 @@ resource "helm_release" "intermediate-certificate-issuer" {
| [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
| [cluster\_name](#input\_cluster\_name) | EKS Cluster Name | `any` | `null` | no |
| [contact\_email](#input\_contact\_email) | Email address in @census.gov of contact for the certificate. This is strongly recommended to be a group email address. | `string` | n/a | yes |
+| [import\_to\_acm](#input\_import\_to\_acm) | Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details | `bool` | `true` | no |
| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
| [validity\_days](#input\_validity\_days) | Number of days for which the certificate is valid. For the short lived certificate, this must be <= 7 | `number` | `365` | no |
diff --git a/acmpca-eks-cert-manager/main.tf b/acmpca-eks-cert-manager/main.tf
index b1f0a96..79b628e 100644
--- a/acmpca-eks-cert-manager/main.tf
+++ b/acmpca-eks-cert-manager/main.tf
@@ -90,6 +90,7 @@ module "certificate" {
certificate_type = "subordinate-ca"
certificate_subject_overrides = { ou = "PKI-EKS" }
validity_days = 365
+ import_to_acm = var.import_to_acm
tags = merge(
local.base_tags,
diff --git a/acmpca-eks-cert-manager/variables.tf b/acmpca-eks-cert-manager/variables.tf
index e3d1642..79a364f 100644
--- a/acmpca-eks-cert-manager/variables.tf
+++ b/acmpca-eks-cert-manager/variables.tf
@@ -18,3 +18,9 @@ variable "validity_days" {
error_message = "validity_days must be larger than 0."
}
}
+
+variable "import_to_acm" {
+ description = "Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details"
+ type = bool
+ default = true
+}
diff --git a/acmpca-iam-rolesanywhere/README.md b/acmpca-iam-rolesanywhere/README.md
index cdf7368..bfdc644 100644
--- a/acmpca-iam-rolesanywhere/README.md
+++ b/acmpca-iam-rolesanywhere/README.md
@@ -130,6 +130,7 @@ certificate_subject = {
| [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
| [certificate\_subject\_ou](#input\_certificate\_subject\_ou) | Specific OU to use in the certificate subject. Default is 'IAM RolesAnywhere {account\_id}' | `string` | `null` | no |
| [contact\_email](#input\_contact\_email) | Email address in @census.gov of contact for the certificate. This is strongly recommended to be a group email address. | `string` | n/a | yes |
+| [import\_to\_acm](#input\_import\_to\_acm) | Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details | `bool` | `true` | no |
| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
| [role\_name](#input\_role\_name) | IAM RolesAnywhere Role Name (including r- prefix if necessary) | `string` | n/a | yes |
| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
diff --git a/acmpca-iam-rolesanywhere/main.tf b/acmpca-iam-rolesanywhere/main.tf
index bcc32b3..988f7a3 100644
--- a/acmpca-iam-rolesanywhere/main.tf
+++ b/acmpca-iam-rolesanywhere/main.tf
@@ -123,6 +123,7 @@ module "certificate" {
certificate_type = "end-entity"
certificate_subject_overrides = { ou = local.certificate_subject_ou }
validity_days = var.validity_days
+ import_to_acm = var.import_to_acm
tags = merge(
local.base_tags,
diff --git a/acmpca-iam-rolesanywhere/variables.tf b/acmpca-iam-rolesanywhere/variables.tf
index 43b7799..64c307f 100644
--- a/acmpca-iam-rolesanywhere/variables.tf
+++ b/acmpca-iam-rolesanywhere/variables.tf
@@ -31,3 +31,8 @@ variable "certificate_subject_ou" {
default = null
}
+variable "import_to_acm" {
+ description = "Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details"
+ type = bool
+ default = true
+}
diff --git a/acmpca/README.md b/acmpca/README.md
index b6141f6..0ef1e2d 100644
--- a/acmpca/README.md
+++ b/acmpca/README.md
@@ -59,6 +59,7 @@ No modules.
| Name | Type |
|------|------|
+| [aws_acm_certificate.certificate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |
| [aws_acmpca_certificate.certificate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acmpca_certificate) | resource |
| [local_sensitive_file.certificate_cert](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource |
| [local_sensitive_file.certificate_cert_chain](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource |
@@ -96,6 +97,7 @@ No modules.
| [contact\_email](#input\_contact\_email) | Email address in @census.gov of contact for the certificate. This is strongly recommended to be a group email address. | `string` | n/a | yes |
| [create\_files](#input\_create\_files) | Flag controlling the creation of output files for the key, CSR, and certificate and bundle. | `bool` | `false` | no |
| [csr\_filename](#input\_csr\_filename) | Filename for Certificate Signing Request (CSR). Defaults to {certificate\_dns}.csr | `string` | `null` | no |
+| [import\_to\_acm](#input\_import\_to\_acm) | Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details | `bool` | `false` | no |
| [key\_filename](#input\_key\_filename) | Filename for RSA private key. Defaults to {certificate\_dns}.key | `string` | `null` | no |
| [output\_file\_directory](#input\_output\_file\_directory) | File path for resultant files when create\_files is used. Defaults to path.root/certs | `string` | `null` | no |
| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
diff --git a/acmpca/certificate.tf b/acmpca/certificate.tf
index 9b38c36..a9d53a9 100644
--- a/acmpca/certificate.tf
+++ b/acmpca/certificate.tf
@@ -159,3 +159,16 @@ locals {
c_cert_subject = try(local.c_cert_fields.subject != "") ? { for x in split(",", local.c_cert_fields.subject) : (split("=", x)[0]) => split("=", x)[1] } : {}
c_cert_subject_map = { for k, v in local.c_cert_subject : lookup(local.subject_fields, k, k) => v }
}
+
+resource "aws_acm_certificate" "certificate" {
+ count = var.import_to_acm ? 1 : 0
+ private_key = tls_private_key.certificate.private_key_pem
+ certificate_body = aws_acmpca_certificate.certificate.certificate
+ certificate_chain = local.certificate_chain
+
+ tags = merge(
+ local.base_tags,
+ var.tags,
+ { "boc:pki:mail" = var.contact_email },
+ )
+}
diff --git a/acmpca/variables.tf b/acmpca/variables.tf
index 55c0077..b0c8b82 100644
--- a/acmpca/variables.tf
+++ b/acmpca/variables.tf
@@ -114,3 +114,9 @@ variable "certificate_type" {
error_message = "certificate_type must be one of 'end-entity' | 'subordinate-ca'."
}
}
+
+variable "import_to_acm" {
+ description = "Flag to import certificate to ACM, used primarily for tracking expiration and establishing contact details"
+ type = bool
+ default = false
+}
diff --git a/common/version.tf b/common/version.tf
index 9c489cd..1ee6619 100644
--- a/common/version.tf
+++ b/common/version.tf
@@ -1,3 +1,3 @@
locals {
- _module_version = "1.1.0"
+ _module_version = "1.2.0"
}