Multiple fixes for "ghost" diffs

acm.tf

@@ -18,16 +18,26 @@ resource "aws_acm_certificate" "cert" {
 }
 
 resource "aws_route53_record" "cert_validation" {
-  name    = tolist(aws_acm_certificate.cert[0].domain_validation_options)[0].resource_record_name
-  type    = tolist(aws_acm_certificate.cert[0].domain_validation_options)[0].resource_record_type
-  zone_id = data.aws_route53_zone.proxy.zone_id
-  records = [tolist(aws_acm_certificate.cert[0].domain_validation_options)[0].resource_record_value]
-  ttl     = 60
-  count   = var.use_acm ? 1 : 0
+  for_each = {
+    for dvo in aws_acm_certificate.cert[0].domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+  name            = each.value.name
+  records         = [each.value.record]
+  type            = each.value.type
+  allow_overwrite = true
+  zone_id         = data.aws_route53_zone.proxy.zone_id
+
+  depends_on = [
+    aws_acm_certificate.cert
+  ]
 }
 
 resource "aws_acm_certificate_validation" "cert" {
   certificate_arn         = aws_acm_certificate.cert[0].arn
-  validation_record_fqdns = [aws_route53_record.cert_validation[0].fqdn]
+  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
   count                   = var.use_acm ? 1 : 0
 }

auth_asg.tf

@@ -67,7 +67,8 @@ resource "aws_launch_configuration" "auth" {
     }
   )
   metadata_options {
-    http_tokens = "required"
+    http_endpoint = "enabled"
+    http_tokens   = "required"
   }
   root_block_device {
     encrypted = true

data.tf

@@ -8,8 +8,3 @@ data "aws_region" "current" {}
 data "aws_kms_alias" "ssm" {
   name = var.kms_alias_name
 }
-
-# Pick up the license path and make it accessible as a file
-data "local_file" "license" {
-  filename = var.license_path
-}

monitor_asg.tf

@@ -99,7 +99,8 @@ resource "aws_launch_configuration" "monitor" {
     }
   )
   metadata_options {
-    http_tokens = "required"
+    http_endpoint = "enabled"
+    http_tokens   = "required"
   }
   root_block_device {
     encrypted = true

node_asg.tf

@@ -53,7 +53,8 @@ resource "aws_launch_configuration" "node" {
     }
   )
   metadata_options {
-    http_tokens = "required"
+    http_endpoint = "enabled"
+    http_tokens   = "required"
   }
   root_block_device {
     encrypted = true

proxy_asg.tf

@@ -117,7 +117,8 @@ resource "aws_launch_configuration" "proxy" {
     }
   )
   metadata_options {
-    http_tokens = "required"
+    http_endpoint = "enabled"
+    http_tokens   = "required"
   }
   root_block_device {
     encrypted = true

ssm.tf

@@ -3,10 +3,10 @@
 // is destroyed, cluster will overwrite them with real values
 
 resource "aws_ssm_parameter" "license" {
-  count     = var.license_path != "" ? 1 : 0
+  count     = var.teleport_license != "" ? 1 : 0
   name      = "/teleport/${var.cluster_name}/license"
   type      = "SecureString"
-  value     = data.local_file.license.content
+  value     = var.teleport_license
   overwrite = true
 }
 

variables.tf

@@ -83,6 +83,13 @@ variable "license_path" {
   default = ""
 }
 
+# Contents of the Teleport Enterprise license to be used for the cluster
+variable "teleport_license" {
+  type      = string
+  default   = ""
+  sensitive = true
+}
+
 # Instance type used for auth autoscaling group
 variable "auth_instance_type" {
   type    = string