Add Cognito for authentication

terraform/aws/implementation/main.tf

@@ -1,5 +1,6 @@
 locals {
-  name = "phdi-playground-${terraform.workspace}"
+  name        = "phdi-playground-${terraform.workspace}"
+  domain_name = "dibbs.cloud"
 }
 
 module "vpc" {
@@ -30,20 +31,27 @@ module "vpc" {
 }
 
 module "eks" {
-  source             = "./modules/eks"
-  region             = var.region
-  eks_name           = local.name
-  vpc_id             = module.vpc.vpc_id
-  public_subnet_ids  = module.vpc.public_subnets
-  private_subnet_ids = module.vpc.private_subnets
-  smarty_auth_id     = var.smarty_auth_id
-  smarty_auth_token  = var.smarty_auth_token
+  source                  = "./modules/eks"
+  region                  = var.region
+  eks_name                = local.name
+  vpc_id                  = module.vpc.vpc_id
+  public_subnet_ids       = module.vpc.public_subnets
+  private_subnet_ids      = module.vpc.private_subnets
+  smarty_auth_id          = var.smarty_auth_id
+  smarty_auth_token       = var.smarty_auth_token
+  aws_acm_certificate_arn = module.route53.aws_acm_certificate_arn
+  cognito_user_pool_arn   = module.cognito.cognito_user_pool_arn
+  cognito_client_id       = module.cognito.cognito_client_id
+  cognito_domain          = module.cognito.cognito_domain
 }
 
-module "cloudfront" {
-  depends_on   = [module.eks]
-  source       = "./modules/cloudfront"
-  region       = var.region
-  vpc_id       = module.vpc.vpc_id
+module "route53" {
+  source       = "./modules/route53"
+  domain_name  = local.domain_name
   alb_hostname = module.eks.alb_hostname
 }
+
+module "cognito" {
+  source      = "./modules/cognito"
+  domain_name = local.domain_name
+}

terraform/aws/implementation/manifests/ingress.yaml

@@ -6,6 +6,11 @@ metadata:
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: ip
     alb.ingress.kubernetes.io/group.name: phdi-playground-${terraform_workspace}
+    alb.ingress.kubernetes.io/certificate-arn: ${aws_acm_certificate_arn}
+    alb.ingress.kubernetes.io/auth-type: cognito
+    alb.ingress.kubernetes.io/auth-idp-cognito: '{"userPoolARN":"${cognito_user_pool_arn}","userPoolClientID":"${cognito_client_id}","userPoolDomain":"${cognito_domain}"}'
+    alb.ingress.kubernetes.io/auth-on-unauthenticated-request: authenticate
+    alb.ingress.kubernetes.io/auth-scope: openid
 spec:
   ingressClassName: alb
   rules:

terraform/aws/implementation/modules/cognito/main.tf

@@ -0,0 +1,31 @@
+resource "aws_cognito_user_pool" "pool" {
+  name = "phdi-playground-${terraform.workspace}"
+}
+
+resource "aws_cognito_user_pool_client" "client" {
+  name                                 = "alb"
+  user_pool_id                         = aws_cognito_user_pool.pool.id
+  callback_urls                        = ["https://${var.domain_name}/oauth2/idpresponse"]
+  allowed_oauth_flows_user_pool_client = true
+  allowed_oauth_flows                  = ["code", "implicit"]
+  allowed_oauth_scopes                 = ["email", "openid"]
+  supported_identity_providers         = ["COGNITO"]
+  generate_secret                      = true
+}
+
+resource "aws_cognito_user_pool_domain" "domain" {
+  domain       = "phdi-playground-${terraform.workspace}"
+  user_pool_id = aws_cognito_user_pool.pool.id
+}
+
+resource "aws_cognito_user" "admin" {
+  username           = "admin"
+  user_pool_id       = aws_cognito_user_pool.pool.id
+  temporary_password = "Password123!"
+}
+
+resource "aws_cognito_user" "dibbs" {
+  username           = "dibbs"
+  user_pool_id       = aws_cognito_user_pool.pool.id
+  temporary_password = "Password123!"
+}

terraform/aws/implementation/modules/cognito/outputs.tf

@@ -0,0 +1,11 @@
+output "cognito_user_pool_arn" {
+  value = aws_cognito_user_pool.pool.arn
+}
+
+output "cognito_client_id" {
+  value = aws_cognito_user_pool_client.client.id
+}
+
+output "cognito_domain" {
+  value = aws_cognito_user_pool_domain.domain.domain
+}

terraform/aws/implementation/modules/cognito/variables.tf

@@ -0,0 +1,4 @@
+variable "domain_name" {
+  description = "The domain name for ALB"
+  type        = string
+}

terraform/aws/implementation/modules/eks/data.tf

@@ -338,7 +338,11 @@ data "kubectl_file_documents" "load_balancer_controller_crds" {
 # Ingress
 data "kubectl_file_documents" "ingress" {
   content = templatefile("./manifests/ingress.yaml", {
-    terraform_workspace = terraform.workspace
+    terraform_workspace     = terraform.workspace,
+    aws_acm_certificate_arn = var.aws_acm_certificate_arn,
+    cognito_user_pool_arn   = var.cognito_user_pool_arn,
+    cognito_client_id       = var.cognito_client_id,
+    cognito_domain          = var.cognito_domain
   })
 }
 

terraform/aws/implementation/modules/eks/outputs.tf

@@ -1,3 +1,3 @@
 output "alb_hostname" {
   value = data.kubernetes_ingress_v1.ingress.status.0.load_balancer.0.ingress.0.hostname
-}
+}

terraform/aws/implementation/modules/eks/variables.tf

@@ -41,3 +41,19 @@ variable "smarty_auth_id" {
 variable "smarty_auth_token" {
   description = "value of the SmartyStreets Auth Token"
 }
+
+variable "aws_acm_certificate_arn" {
+  description = "The ARN of the ACM certificate"
+}
+
+variable "cognito_user_pool_arn" {
+  description = "The ARN of the Cognito user pool"
+}
+
+variable "cognito_client_id" {
+  description = "The ID of the Cognito user pool client"
+}
+
+variable "cognito_domain" {
+  description = "The domain of the Cognito user pool"
+}

terraform/aws/implementation/modules/route53/data.tf

@@ -0,0 +1,9 @@
+data "aws_route53_zone" "domain" {
+  name = var.domain_name
+}
+
+data "aws_lb" "alb" {
+  tags = {
+    "ingress.k8s.aws/stack" = "phdi-playground-${terraform.workspace}"
+  }
+}

terraform/aws/implementation/modules/route53/main.tf

@@ -0,0 +1,56 @@
+resource "aws_route53domains_registered_domain" "domain" {
+  domain_name = var.domain_name
+
+  name_server {
+    name = "ns-821.awsdns-38.net"
+  }
+
+  name_server {
+    name = "ns-236.awsdns-29.com"
+  }
+
+  name_server {
+    name = "ns-1819.awsdns-35.co.uk"
+  }
+
+  name_server {
+    name = "ns-1315.awsdns-36.org"
+  }
+}
+
+# Create ACM certificate for the domain
+resource "aws_acm_certificate" "site_cert" {
+  domain_name       = var.domain_name
+  validation_method = "DNS"
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# Create DNS record for the ACM certificate
+resource "aws_route53_record" "site_cert_dns" {
+  allow_overwrite = true
+  name            = tolist(aws_acm_certificate.site_cert.domain_validation_options)[0].resource_record_name
+  records         = [tolist(aws_acm_certificate.site_cert.domain_validation_options)[0].resource_record_value]
+  type            = tolist(aws_acm_certificate.site_cert.domain_validation_options)[0].resource_record_type
+  zone_id         = data.aws_route53_zone.domain.zone_id
+  ttl             = 60
+}
+
+resource "aws_acm_certificate_validation" "site_cert_validation" {
+  certificate_arn         = aws_acm_certificate.site_cert.arn
+  validation_record_fqdns = [aws_route53_record.site_cert_dns.fqdn]
+}
+
+# Create DNS record for the application load balancer
+resource "aws_route53_record" "alb" {
+  name    = var.domain_name
+  type    = "A"
+  zone_id = data.aws_route53_zone.domain.zone_id
+
+  alias {
+    name                   = var.alb_hostname
+    zone_id                = data.aws_lb.alb.zone_id
+    evaluate_target_health = true
+  }
+}

terraform/aws/implementation/modules/route53/outputs.tf

@@ -0,0 +1,3 @@
+output "aws_acm_certificate_arn" {
+  value = aws_acm_certificate.site_cert.arn
+}

terraform/aws/implementation/modules/route53/variables.tf

@@ -0,0 +1,10 @@
+variable "domain_name" {
+  description = "The domain name to use for the Route53 hosted zone"
+  type        = string
+  default     = "dibbs.cloud"
+}
+
+variable "alb_hostname" {
+  description = "The hostname of the ALB"
+  type        = string
+}