From b5cb812d6fa9599400f4efe3b0bf0800e20974f7 Mon Sep 17 00:00:00 2001
From: Spencer Sutton <suttonsp@amazon.com>
Date: Wed, 3 Feb 2021 15:21:23 +0000
Subject: [PATCH] SSL AWS
commit 78cab700
Author: Sutton <suttonsp@147dda3a90de.ant.amazon.com>
Date: Fri Jan 29 2021 12:41:00 GMT-0600 (Central Standard Time)
Adding ssl props
commit 82a15c82
Author: Sutton <suttonsp@147dda3a90de.ant.amazon.com>
Date: Fri Jan 29 2021 12:20:36 GMT-0600 (Central Standard Time)
Adding SSL
---
provider/indexer-aws/build-aws/Dockerfile | 9 ++++-
provider/indexer-aws/build-aws/entrypoint.sh | 15 ++++++++
provider/indexer-aws/build-aws/ssl.sh | 34 +++++++++++++++++++
.../src/main/resources/application.properties | 7 ++++
4 files changed, 64 insertions(+), 1 deletion(-)
create mode 100755 provider/indexer-aws/build-aws/entrypoint.sh
create mode 100755 provider/indexer-aws/build-aws/ssl.sh
diff --git a/provider/indexer-aws/build-aws/Dockerfile b/provider/indexer-aws/build-aws/Dockerfile
index 4af0e6ae8..615dde332 100644
--- a/provider/indexer-aws/build-aws/Dockerfile
+++ b/provider/indexer-aws/build-aws/Dockerfile
@@ -16,7 +16,14 @@
FROM amazoncorretto:8
ARG JAR_FILE=provider/indexer-aws/target/*spring-boot.jar
+
+#Default to using self signed generated TLS cert
+ENV USE_SELF_SIGNED_SSL_CERT true
+
WORKDIR /
COPY ${JAR_FILE} app.jar
+COPY /provider/indexer-aws/build-aws/ssl.sh /ssl.sh
+COPY /provider/indexer-aws/build-aws/entrypoint.sh /entrypoint.sh
EXPOSE 8080
-ENTRYPOINT java $JAVA_OPTS -jar /app.jar
\ No newline at end of file
+
+ENTRYPOINT ["/bin/sh", "-c", ". /entrypoint.sh"]
\ No newline at end of file
diff --git a/provider/indexer-aws/build-aws/entrypoint.sh b/provider/indexer-aws/build-aws/entrypoint.sh
new file mode 100755
index 000000000..9bd3ec69d
--- /dev/null
+++ b/provider/indexer-aws/build-aws/entrypoint.sh
@@ -0,0 +1,15 @@
+
+
+if [ -n $USE_SELF_SIGNED_SSL_CERT ];
+then
+ export SSL_KEY_PASSWORD=$RANDOM$RANDOM$RANDOM;
+ export SSL_KEY_STORE_PASSWORD=$SSL_KEY_PASSWORD;
+ export SSL_KEY_STORE_DIR=/tmp/certs;
+ export SSL_KEY_STORE_NAME=osduonaws.p12;
+ export SSL_KEY_STORE_PATH=$SSL_KEY_STORE_DIR/$SSL_KEY_STORE_NAME;
+ export SSL_KEY_ALIAS=osduonaws;
+
+ ./ssl.sh;
+fi
+
+java $JAVA_OPTS -jar /app.jar
\ No newline at end of file
diff --git a/provider/indexer-aws/build-aws/ssl.sh b/provider/indexer-aws/build-aws/ssl.sh
new file mode 100755
index 000000000..9ede56568
--- /dev/null
+++ b/provider/indexer-aws/build-aws/ssl.sh
@@ -0,0 +1,34 @@
+# Copyright © 2021 Amazon Web Services
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#!/usr/bin/env bash
+
+#Future: Support for using Amazon Cert Manager
+# if [ "$1" == "webserver" ] && [ -n $ACM_CERTIFICATE_ARN ];
+# then
+
+# aws acm export-certificate --certificate-arn $ACM_CERTIFICATE_ARN --passphrase $(echo -n 'aws123' | openssl base64 -e) | jq -r '"\(.PrivateKey)"' > ${SSL_KEY_PATH}.enc
+# openssl rsa -in ${SSL_KEY_PATH}.enc -out $SSL_KEY_PATH -passin pass:aws123
+# aws acm get-certificate --certificate-arn $ACM_CERTIFICATE_ARN | jq -r '"\(.CertificateChain)"' > $SSL_CERT_PATH
+# aws acm get-certificate --certificate-arn $ACM_CERTIFICATE_ARN | jq -r '"\(.Certificate)"' >> $SSL_CERT_PATH
+
+# fi
+
+if [ -n $USE_SELF_SIGNED_SSL_CERT ];
+then
+ mkdir -p $SSL_KEY_STORE_DIR
+ pushd $SSL_KEY_STORE_DIR
+ keytool -genkeypair -alias $SSL_KEY_ALIAS -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore $SSL_KEY_STORE_NAME -validity 3650 -keypass $SSL_KEY_PASSWORD -storepass $SSL_KEY_PASSWORD -dname "CN=localhost, OU=AWS, O=Energy, L=Houston, ST=TX, C=US"
+ popd
+fi
diff --git a/provider/indexer-aws/src/main/resources/application.properties b/provider/indexer-aws/src/main/resources/application.properties
index d29cc7a76..a340866fb 100644
--- a/provider/indexer-aws/src/main/resources/application.properties
+++ b/provider/indexer-aws/src/main/resources/application.properties
@@ -59,3 +59,10 @@ aws.indexer.sns.topic.arn=${aws.ssm.prefix}/indexer/indexer-sns-topic-arn
aws.storage.sns.topic.arn=${aws.ssm.prefix}/storage/storage-sns-topic-arn
aws.storage.sqs.queue.url=${aws.ssm.prefix}/storage/storage-sqs-url
+
+server.ssl.enabled=${SSL_ENABLED:true}
+server.ssl.key-store-type=PKCS12
+server.ssl.key-store=${SSL_KEY_STORE_PATH:/certs/osduonaws.p12}
+server.ssl.key-alias=${SSL_KEY_ALIAS:osduonaws}
+server.ssl.key-password=${SSL_KEY_PASSWORD:}
+server.ssl.key-store-password=${SSL_KEY_STORE_PASSWORD:}
\ No newline at end of file
--
GitLab