Deploy custom domain with Terraform

environment

@@ -77,6 +77,8 @@ DSS_ES_DOMAIN="dss-index-$DSS_DEPLOYMENT_STAGE"
 DSS_ES_INSTANCE_TYPE="m4.large.elasticsearch"
 DSS_ES_VOLUME_SIZE="35"
 DSS_ES_INSTANCE_COUNT="1"
+DSS_CERTIFICATE_DOMAIN="*.dev.data.humancellatlas.org"
+DSS_ZONE_NAME="dev.data.humancellatlas.org."
 PYTHONWARNINGS=ignore:ResourceWarning,ignore::UserWarning:zipfile:
 DSS_SECRETS_STORE="dcp/dss"
 EVENT_RELAY_AWS_USERNAME="dss-event-relay-${DSS_DEPLOYMENT_STAGE}"

infra/Makefile

@@ -30,7 +30,7 @@ destroy: init
 	cd $(COMPONENT); terraform destroy
 
 init:
-	rm -rf $(COMPONENT)/.terraform
+	rm -rf $(COMPONENT)/.terraform/*.tfstate
 	./build_deploy_config.py $(COMPONENT)
 	cd $(COMPONENT); terraform init;
 

infra/build_deploy_config.py

@@ -76,6 +76,9 @@
     "DSS_GS_BUCKET_REGION",
     "DSS_GS_BUCKET_TEST_REGION",
     "DSS_GS_BUCKET_TEST_FIXTURES_REGION",
+    "API_DOMAIN_NAME",
+    "DSS_CERTIFICATE_DOMAIN",
+    "DSS_ZONE_NAME",
 ]
 
 terraform_variable_info = {'variable': dict()}

infra/domain/create_regional_domain_name.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+
+"""
+This script configures a regional domain name for API Gateway, based on an existing
+certificate, and Route 53 zone. The certificate must be in the same region as the regional
+domain. 
+"""
+
+import os
+import sys
+import json
+import boto3
+import argparse
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("--domain-name", required=True)
+parser.add_argument("--certificate-arn", required=True)
+parser.add_argument("--zone-id", required=True)
+args = parser.parse_args()
+
+resp = boto3.client("apigateway").create_domain_name(
+    domainName=args.domain_name,
+    regionalCertificateArn=args.certificate_arn,
+    endpointConfiguration={'types': ["REGIONAL"]}
+)
+
+boto3.client("route53").change_resource_record_sets(
+    HostedZoneId=args.zone_id,
+    ChangeBatch={
+        'Changes': [{
+            'Action': 'CREATE',
+            'ResourceRecordSet': {
+                'Name': f"{args.domain_name}.",
+                'Type': 'CNAME',
+                'ResourceRecords': [ {'Value': resp['regionalDomainName']} ],
+                'TTL': 300,
+            }
+        }]
+    }
+)

infra/domain/domain.tf

@@ -0,0 +1,18 @@
+data aws_caller_identity current {}
+
+data aws_route53_zone dss_route53_zone {
+  name = "${var.DSS_ZONE_NAME}"
+}
+
+data aws_acm_certificate dss_domain_cert {
+  domain = "${var.DSS_CERTIFICATE_DOMAIN}"
+}
+
+# TODO: Configure regional domain name with Terraform
+#   Terraform does not currently support regional API Gateway endpoints:
+#   https://github.com/terraform-providers/terraform-provider-aws/issues/2195
+resource null_resource dss_domain {
+  provisioner "local-exec" {
+    command = "./create_regional_domain_name.py --domain-name ${var.API_DOMAIN_NAME} --certificate-arn ${data.aws_acm_certificate.dss_domain_cert.arn} --zone-id ${data.aws_route53_zone.dss_route53_zone.zone_id}"
+  }
+}