PLT-1658 Add ACM Certificate Module

[mianava]

🎫 Ticket

https://jira.cms.gov/browse/...

🛠 Changes

Added a new modules/acm-certificate Terraform module that manages TLS certificate issuance and import across three endpoint types:

• Internal (*.cmscloud.internal) — PCA-issued certificate for VPC-only service-to-service traffic
• Zscaler (*.cmscloud.local) — PCA-issued certificate for Zscaler-accessible internal endpoints
• Public (*.cms.gov) — CMS-signed certificate that can be passed in from SOPS or SSM parameter

ℹ️ Context

To enforce TLS everywhere, services need a standardized, secure way to provision and manage certificates.

To reduce the number of certificates in rotation, subject alternative names are used for internal and zscaler domains.

🧪 Validation

output for tftest.test.cdap.cms.<>

Details

# module.private_acm_certificate.aws_acm_certificate.private[0] will be created
  + resource "aws_acm_certificate" "private" {
      + arn                       = (known after apply)
      + certificate_authority_arn = "arn:aws:acm-pca:us-east-1:###:certificate-authority/###"
      + domain_name               = "tf-test-acm-certificate.test.cdap.cmscloud.internal"
      + domain_validation_options = (known after apply)
      + id                        = (known after apply)
      + key_algorithm             = (known after apply)
      + not_after                 = (known after apply)
      + not_before                = (known after apply)
      + pending_renewal           = (known after apply)
      + renewal_eligibility       = (known after apply)
      + renewal_summary           = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "tf-test-acm-certificate.test.cdap.cmscloud.internal",
          + "tf-test-acm-certificate.test.cdap.cmscloud.local",
        ]
      + tags                      = {
          + "Name" = "tf-test-acm-certificate.test.cdap.cmscloud.internal-private-cert"
        }
      + tags_all                  = {
          + "Name"           = "tf-test-acm-certificate.test.cdap.cmscloud.internal-private-cert"
          + "application"    = "cdap"
          + "business"       = "oeda"
          + "environment"    = "test"
          + "parent_env"     = "test"
          + "service"        = "tf-test-acm-certificate"
          + "terraform"      = "true"
          + "tf_root_module" = "https://github.com/CMSgov/cdap/tree/main/terraform/services/acm-tests"
        }
      + type                      = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = (known after apply)

      + options (known after apply)
    }

  # module.private_acm_certificate.aws_acm_certificate_validation.private[0] will be created
  + resource "aws_acm_certificate_validation" "private" {
      + certificate_arn = (known after apply)
      + id              = (known after apply)

      + timeouts {
          + create = "5m"
        }
    }

  # module.public_acm_certificate.aws_ssm_parameter.csr["1"] will be created
  + resource "aws_ssm_parameter" "csr" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "Certificate Signing Request for tftest-acm-certificate.cdap.cms.gov. Submit this to CMS for signing."
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/cdap/test/tf-test-acm-certificate/tls/v1/csr"
      + tags_all       = {
          + "application"    = "cdap"
          + "business"       = "oeda"
          + "environment"    = "test"
          + "parent_env"     = "test"
          + "service"        = "tf-test-acm-certificate"
          + "terraform"      = "true"
          + "tf_root_module" = "https://github.com/CMSgov/cdap/tree/main/terraform/services/acm-tests"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.public_acm_certificate.aws_ssm_parameter.private_key["1"] will be created
  + resource "aws_ssm_parameter" "private_key" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (sensitive value)
      + name           = "/cdap/test/tf-test-acm-certificate/tls/v1/private-key"
      + tags           = {
          + "Name" = "tftest-acm-certificate.cdap.cms.gov-private-key"
        }
      + tags_all       = {
          + "Name"           = "tftest-acm-certificate.cdap.cms.gov-private-key"
          + "application"    = "cdap"
          + "business"       = "oeda"
          + "environment"    = "test"
          + "parent_env"     = "test"
          + "service"        = "tf-test-acm-certificate"
          + "terraform"      = "true"
          + "tf_root_module" = "https://github.com/CMSgov/cdap/tree/main/terraform/services/acm-tests"
        }
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.public_acm_certificate.tls_cert_request.this["1"] will be created
  + resource "tls_cert_request" "this" {
      + cert_request_pem = (known after apply)
      + id               = (known after apply)
      + key_algorithm    = (known after apply)
      + private_key_pem  = (sensitive value)

      + subject {
          + common_name         = "tftest-acm-certificate.cdap.cms.gov"
          + country             = "US"
          + locality            = "Rockville"
          + organization        = "US Dept of Health and Human Services"
          + organizational_unit = "Centers for Medicare and Medicaid Services"
          + province            = "MD"
        }
    }

  # module.public_acm_certificate.tls_private_key.this["1"] will be created
  + resource "tls_private_key" "this" {
      + algorithm                     = "RSA"
      + ecdsa_curve                   = "P224"
      + id                            = (known after apply)
      + private_key_openssh           = (sensitive value)
      + private_key_pem               = (sensitive value)
      + private_key_pem_pkcs8         = (sensitive value)
      + public_key_fingerprint_md5    = (known after apply)
      + public_key_fingerprint_sha256 = (known after apply)
      + public_key_openssh            = (known after apply)
      + public_key_pem                = (known after apply)
      + rsa_bits                      = 4096
    }

Plan: 6 to add, 0 to change, 0 to destroy.