fix: ACM cert not being recreated on domain name addition

.github/workflows/terragrunt-apply-production.yml

@@ -6,7 +6,7 @@ on:
 
 env:
   APP_ENV: production
-  APP_DOMAIN: ${{ vars.PRODUCTION_APP_DOMAIN}}
+  APP_DOMAINS: ${{ vars.PRODUCTION_APP_DOMAINS}}
   AWS_ACCOUNT_ID: ${{ vars.PRODUCTION_AWS_ACCOUNT_ID }}
   AWS_REGION: ca-central-1
   AWS_ACCESS_KEY_ID: ${{ secrets.PRODUCTION_AWS_ACCESS_KEY_ID }}

.github/workflows/terragrunt-apply-staging.yml

@@ -12,7 +12,7 @@ on:
 
 env:
   APP_ENV: "staging"
-  APP_DOMAIN: ${{ vars.STAGING_APP_DOMAIN }}
+  APP_DOMAINS: ${{ vars.STAGING_APP_DOMAINS }}
   AWS_ACCOUNT_ID: ${{ vars.STAGING_AWS_ACCOUNT_ID }}
   AWS_REGION: ca-central-1
   AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }}
@@ -250,4 +250,4 @@ jobs:
           WORKFLOW_NAME: "${{ github.workflow }}"
         run: |
           json='{"channel":"#forms-staging-events", "blocks":[{"type":"section","text":{"type":"mrkdwn","text":":red: GitHub workflow failed: <${{ env.WORKFLOW_URL }}|${{ env.WORKFLOW_NAME }}>"}}]}'
-          curl -X POST -H 'Content-type: application/json' --data "$json" "https://hooks.slack.com${{ secrets.STAGING_SLACK_WEBHOOK }}"
+          curl -X POST -H 'Content-type: application/json' --data "$json" "https://hooks.slack.com${{ secrets.STAGING_SLACK_WEBHOOK }}"

.github/workflows/terragrunt-plan-all-staging.yml

@@ -5,7 +5,7 @@ on:
 
 env:
   APP_ENV: staging
-  APP_DOMAIN: ${{ vars.STAGING_APP_DOMAIN_ARRAY }}
+  APP_DOMAINS: ${{ vars.STAGING_APP_DOMAINS }}
   AWS_ACCOUNT_ID: ${{ vars.STAGING_AWS_ACCOUNT_ID }}
   AWS_REGION: ca-central-1
   AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }}

.github/workflows/terragrunt-plan-production.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   APP_ENV: production
-  APP_DOMAIN: ${{ vars.PRODUCTION_APP_DOMAIN}}
+  APP_DOMAINS: ${{ vars.PRODUCTION_APP_DOMAINS}}
   AWS_ACCOUNT_ID: ${{ vars.PRODUCTION_AWS_ACCOUNT_ID }}
   AWS_REGION: ca-central-1
   AWS_ACCESS_KEY_ID: ${{ secrets.PRODUCTION_AWS_ACCESS_KEY_ID }}

.github/workflows/terragrunt-plan-staging.yml

@@ -12,7 +12,7 @@ on:
 
 env:
   APP_ENV: staging
-  APP_DOMAIN: ${{ vars.STAGING_APP_DOMAIN_ARRAY }}
+  APP_DOMAINS: ${{ vars.STAGING_APP_DOMAINS }}
   AWS_ACCOUNT_ID: ${{ vars.STAGING_AWS_ACCOUNT_ID }}
   AWS_REGION: ca-central-1
   AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }}

aws/app/ecs.tf

@@ -37,7 +37,7 @@ data "template_file" "form_viewer_task" {
     token_secret                    = aws_secretsmanager_secret_version.token_secret.arn
     database_url                    = var.database_url_secret_arn
     redis_url                       = var.redis_url
-    nextauth_url                    = "https://${var.domain[0]}"
+    nextauth_url                    = "https://${var.domains[0]}"
     submission_api                  = aws_lambda_function.submission.arn
     reliability_file_storage        = aws_s3_bucket.reliability_file_storage.id
     vault_file_storage              = aws_s3_bucket.vault_file_storage.id

aws/app/lambda.tf

@@ -565,7 +565,7 @@ resource "aws_lambda_function" "nagware" {
     variables = {
       ENVIRONMENT               = var.env
       REGION                    = var.region
-      DOMAIN                    = var.domain[0]
+      DOMAIN                    = var.domains[0]
       DYNAMODB_VAULT_TABLE_NAME = var.dynamodb_vault_table_name
       DB_ARN                    = var.rds_cluster_arn
       DB_SECRET                 = var.database_secret_arn

aws/cognito/user_pool.tf

@@ -32,7 +32,7 @@ resource "aws_cognito_user_pool_client" "forms" {
   name = "forms_client"
 
   user_pool_id                         = aws_cognito_user_pool.forms.id
-  callback_urls                        = concat(formatlist("https://%s/api/auth/callback/cognito", var.domain), ["https://localhost:3000/api/auth/callback/cognito"])
+  callback_urls                        = concat(formatlist("https://%s/api/auth/callback/cognito", var.domains), ["https://localhost:3000/api/auth/callback/cognito"])
   allowed_oauth_flows_user_pool_client = true
   allowed_oauth_flows                  = ["code"]
   allowed_oauth_scopes                 = ["email", "openid", "profile"]

aws/hosted_zone/hosted_zone.tf

@@ -3,8 +3,8 @@
 # Holds the DNS records for the service
 #
 resource "aws_route53_zone" "form_viewer" {
-  count = length(var.domain)
-  name  = var.domain[count.index]
+  count = length(var.domains)
+  name  = var.domains[count.index]
 
   tags = {
     (var.billing_tag_key) = var.billing_tag_value

aws/load_balancer/certificates.tf

@@ -3,9 +3,9 @@
 #
 resource "aws_acm_certificate" "form_viewer" {
   # First entry in domain list is the primary domain
-  domain_name               = var.domain[0]
+  domain_name               = var.domains[0]
   validation_method         = "DNS"
-  subject_alternative_names = length(var.domain) > 1 ? slice(var.domain, 1, length(var.domain) - 1) : []
+  subject_alternative_names = length(var.domains) > 1 ? setsubtract(var.domains, [var.domains[0]]) : []
 
   lifecycle {
     create_before_destroy = true

aws/load_balancer/route53.tf

@@ -2,9 +2,9 @@
 # Route53 records
 #
 resource "aws_route53_record" "form_viewer" {
-  count   = length(var.domain)
+  count   = length(var.domains)
   zone_id = var.hosted_zone_ids[count.index]
-  name    = var.domain[count.index]
+  name    = var.domains[count.index]
   type    = "A"
 
   alias {
@@ -18,29 +18,25 @@ resource "aws_route53_record" "form_viewer" {
 # Certificate validation
 # 
 locals {
-  cert_validation_by_zone_id = setproduct(var.hosted_zone_ids, [for dvo in aws_acm_certificate.form_viewer.domain_validation_options : {
-    name   = dvo.resource_record_name
-    type   = dvo.resource_record_type
-    record = dvo.resource_record_value
-  }])
+  domain_name_to_zone_id = zipmap(var.domains, var.hosted_zone_ids)
 }
 
 
 resource "aws_route53_record" "form_viewer_certificate_validation" {
-
   for_each = {
-    for idx, entry in local.cert_validation_by_zone_id : idx => {
-      zone_id = entry[0]
-      name    = entry[1].name
-      type    = entry[1].type
-      record  = entry[1].record
+    for dvo in aws_acm_certificate.form_viewer.domain_validation_options : dvo.domain_name => {
+      domain = dvo.domain_name
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
     }
   }
+
   allow_overwrite = true
-  zone_id         = each.value.zone_id
   name            = each.value.name
   records         = [each.value.record]
+  ttl             = 60
   type            = each.value.type
+  zone_id         = local.domain_name_to_zone_id[each.value.domain]
 
-  ttl = 60
 }

aws/load_balancer/waf.tf

@@ -294,7 +294,7 @@ resource "aws_wafv2_regex_pattern_set" "forms_base_url" {
   description = "Regex matching the root domain of GCForms"
   scope       = "REGIONAL"
   dynamic "regular_expression" {
-    for_each = var.domain
+    for_each = var.domains
     content {
       regex_string = "^${regular_expression.value}$"
     }

aws/load_testing/lambda.tf

@@ -17,7 +17,7 @@ resource "aws_lambda_function" "load_testing" {
     variables = {
       LOCUST_RUN_TIME    = "3m"
       LOCUST_LOCUSTFILE  = "locust_test_file.py"
-      LOCUST_HOST        = "https://${var.domain[0]}"
+      LOCUST_HOST        = "https://${var.domains[0]}"
       LOCUST_HATCH_RATE  = "1"
       LOCUST_NUM_CLIENTS = "1"
     }

env/cloud/alarms/terragrunt.hcl

@@ -7,7 +7,7 @@ dependencies {
 }
 
 locals {
-  domain = jsondecode(get_env("APP_DOMAIN", "['localhost:3000']"))
+  domain = jsondecode(get_env("APP_DOMAINS", "['localhost:3000']"))
 }
 
 dependency "hosted_zone" {

env/cloud/load_balancer/terragrunt.hcl

@@ -7,7 +7,7 @@ dependencies {
 }
 
 locals {
-  domain = jsondecode(get_env("APP_DOMAIN", "['localhost:3000']"))
+  domain = jsondecode(get_env("APP_DOMAINS", "['localhost:3000']"))
 }
 
 

env/common/common_variables.tf

@@ -18,8 +18,8 @@ variable "billing_tag_value" {
   type        = string
 }
 
-variable "domain" {
-  description = "The server domain"
+variable "domains" {
+  description = "The server domains"
   type        = list(string)
 }
 

env/terragrunt.hcl

@@ -1,14 +1,14 @@
 locals {
   account_id = get_env("AWS_ACCOUNT_ID", "")
   env = get_env("APP_ENV", "local")
-  domain = get_env("APP_DOMAIN", "['localhost:3000']")
+  domains = get_env("APP_DOMAINS", "['localhost:3000']")
 }
 
 inputs = {
   account_id                = "${local.account_id}"
   billing_tag_key           = "CostCentre"
   billing_tag_value         = "forms-platform-${local.env}"   
-  domain                    = local.domain
+  domains                    = local.domains
   env                       = "${local.env}"
   region                    = "ca-central-1"
   cbs_satellite_bucket_name = "cbs-satellite-${local.account_id}"