f-aws_ecs_service-service_connect_tls

.changelog/35684.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ecs_service: Add TLS support for ECS Service Connect
+```

internal/service/ecs/service.go

@@ -414,6 +414,36 @@ func ResourceService() *schema.Resource {
 										Type:     schema.TypeString,
 										Required: true,
 									},
+									"tls": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"issuer_cert_authority": {
+													Type:     schema.TypeList,
+													Required: true,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"aws_pca_authority_arn": {
+																Type:     schema.TypeString,
+																Required: true,
+															},
+														},
+													},
+												},
+												"kms_key": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+												"role_arn": {
+													Type:     schema.TypeString,
+													Required: true,
+												},
+											},
+										},
+									},
 								},
 							},
 						},
@@ -764,9 +794,9 @@ func resourceServiceRead(ctx context.Context, d *schema.ResourceData, meta inter
 		return sdkdiag.AppendErrorf(diags, "setting network_configuration: %s", err)
 	}
 
-	// if err := d.Set("service_connect_configuration", flattenServiceConnectConfiguration(service.ServiceConnectConfiguration)); err != nil {
-	// 	return fmt.Errorf("setting service_connect_configuration for (%s): %w", d.Id(), err)
-	// }
+	//if err := d.Set("service_connect_configuration", flattenServiceConnectConfiguration(service.ServiceConnectConfiguration)); err != nil {
+	//	return sdkdiag.AppendErrorf(diags, "setting service_connect_configuration: %s", err)
+	//}
 
 	if err := d.Set("service_registries", flattenServiceRegistries(service.ServiceRegistries)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting service_registries: %s", err)
@@ -1441,12 +1471,49 @@ func expandServices(srv []interface{}) []*ecs.ServiceConnectService {
 			config.PortName = aws.String(v)
 		}
 
+		if v, ok := raw["tls"].([]interface{}); ok && len(v) > 0 {
+			config.Tls = expandTls(v)
+		}
+
 		out = append(out, &config)
 	}
 
 	return out
 }
 
+func expandTls(tls []interface{}) *ecs.ServiceConnectTlsConfiguration {
+	if len(tls) == 0 {
+		return nil
+	}
+
+	raw := tls[0].(map[string]interface{})
+	tlsConfig := &ecs.ServiceConnectTlsConfiguration{}
+	if v, ok := raw["issuer_cert_authority"].([]interface{}); ok && len(v) > 0 {
+		tlsConfig.IssuerCertificateAuthority = expandIssuerCertAuthority(v)
+	}
+	if v, ok := raw["kms_key"].(string); ok && v != "" {
+		tlsConfig.KmsKey = aws.String(v)
+	}
+	if v, ok := raw["role_arn"].(string); ok && v != "" {
+		tlsConfig.RoleArn = aws.String(v)
+	}
+	return tlsConfig
+}
+
+func expandIssuerCertAuthority(pca []interface{}) *ecs.ServiceConnectTlsCertificateAuthority {
+	if len(pca) == 0 {
+		return nil
+	}
+
+	raw := pca[0].(map[string]interface{})
+	config := &ecs.ServiceConnectTlsCertificateAuthority{}
+
+	if v, ok := raw["aws_pca_authority_arn"].(string); ok && v != "" {
+		config.AwsPcaAuthorityArn = aws.String(v)
+	}
+	return config
+}
+
 func expandClientAliases(srv []interface{}) []*ecs.ServiceConnectClientAlias {
 	if len(srv) == 0 {
 		return nil

internal/service/ecs/service_test.go

@@ -4237,6 +4237,66 @@ resource "aws_ecs_service" "test" {
 
 func testAccServiceConfig_serviceConnectAllAttributes(rName string) string {
 	return fmt.Sprintf(`
+resource "aws_kms_key" "test" {
+  description             = %[1]q
+  deletion_window_in_days = 7
+  policy = data.aws_iam_policy_document.test.json
+}
+
+
+data "aws_iam_policy_document" "test" {
+  policy_id = "KMSPolicy"
+
+  statement {
+    sid       = "Root User Permissions"
+    effect    = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+    actions   = [
+      "kms:*"]
+    resources = [ "*"]
+  }
+
+  statement {
+    sid       = "EC2 kms permissions"
+    effect    = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [ aws_iam_role.test.arn ]
+    }
+    actions   = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:GenerateDataKeyPair"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role" "test" {
+	  name = %[1]q
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ecs.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+  managed_policy_arns = ["arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity"]
+}
+
 resource "aws_service_discovery_http_namespace" "test" {
   name = %[1]q
 }
@@ -4297,9 +4357,56 @@ resource "aws_ecs_service" "test" {
       discovery_name        = "test"
       ingress_port_override = 8443
       port_name             = "tf-test"
+      tls {
+        issuer_cert_authority {
+		  aws_pca_authority_arn = 	aws_acmpca_certificate_authority.test.arn
+        }
+        kms_key = aws_kms_key.test.arn
+        role_arn = aws_iam_role.test.arn	
+      }
     }
   }
 }
+
+resource "aws_acmpca_certificate_authority_certificate" "test" {
+  certificate_authority_arn = aws_acmpca_certificate_authority.test.arn
+
+  certificate       = aws_acmpca_certificate.test.certificate
+  certificate_chain = aws_acmpca_certificate.test.certificate_chain
+}
+
+resource "aws_acmpca_certificate" "test" {
+  certificate_authority_arn   = aws_acmpca_certificate_authority.test.arn
+  certificate_signing_request = aws_acmpca_certificate_authority.test.certificate_signing_request
+  signing_algorithm           = "SHA512WITHRSA"
+
+  template_arn = "arn:${data.aws_partition.current.partition}:acm-pca:::template/RootCACertificate/V1"
+
+  validity {
+    type  = "YEARS"
+    value = 1
+  }
+}
+
+resource "aws_acmpca_certificate_authority" "test" {
+  permanent_deletion_time_in_days = 7
+  type                            = "ROOT"
+  usage_mode = "SHORT_LIVED_CERTIFICATE"
+  certificate_authority_configuration {
+    key_algorithm     = "RSA_4096"
+    signing_algorithm = "SHA512WITHRSA"
+
+    subject {
+      common_name = %[1]q
+    }
+  }
+  tags = {
+	AmazonECSManaged = "true"
+  }
+}
+
+data "aws_partition" "current" {}
+data "aws_caller_identity" "current" {}
 `, rName)
 }
 

website/docs/r/ecs_service.html.markdown

@@ -241,6 +241,20 @@ For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonEC
 * `namespace` - (Optional) The namespace name or ARN of the [`aws_service_discovery_http_namespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) for use with Service Connect.
 * `service` - (Optional) The list of Service Connect service objects. See below.
 
+### tls
+
+`tls` supports the following:
+
+* `issuer_cert_authority` - (Required) The details of the certificate authority which will issue the certificate.
+* `kms_key` - (Required) The KMS key used to encrypt the private key in Secrets Manager.
+* `role_arn` - (Required) The ARN of the IAM Role that's associated with the Service Connect TLS.
+
+### issuer_cert_authority
+
+`issuer_cert_authority` supports the following:
+
+* `aws_pca_authority_arn`: The ARN of the [`aws_acmpca_certificate_authority`](/docs/providers/aws/r/acmpca_certificate_authority.html) used to create the TLS Certificates.
+
 ### log_configuration
 
 `log_configuration` supports the following:
@@ -264,6 +278,7 @@ For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonEC
 * `discovery_name` - (Optional) The name of the new AWS Cloud Map service that Amazon ECS creates for this Amazon ECS service.
 * `ingress_port_override` - (Optional) The port number for the Service Connect proxy to listen on.
 * `port_name` - (Required) The name of one of the `portMappings` from all the containers in the task definition of this Amazon ECS service.
+* `tls` - (Optional) The configuration for enabling Transport Layer Security (TLS)
 
 ### client_alias