feat: Added support for ALB trust store

.gitignore

@@ -30,3 +30,9 @@ terraform.rc
 
 # Zip archive
 *.zip
+
+# Ignore cert generation files
+*.pem
+*.key
+*.csr
+**/cert_files/*

examples/mutual-auth-alb/README.md

@@ -0,0 +1,79 @@
+# Mutual Authentication ALB Example
+
+Configuration in this directory creates an Application Load Balancer, a self-signed CA bundle, and load balancer trust store for mutual authentication.
+https://docs.aws.amazon.com/elasticloadbalancing/latest/application/mutual-authentication.html
+
+## Usage
+
+To run this example you need to execute:
+
+```bash
+$ terraform init
+$ terraform plan
+$ terraform apply
+```
+
+Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.31 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.31 |
+| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | ~> 4.0 |
+| <a name="module_alb"></a> [alb](#module\_alb) | ../../ | n/a |
+| <a name="module_ca_cert_object"></a> [ca\_cert\_object](#module\_ca\_cert\_object) | terraform-aws-modules/s3-bucket/aws//modules/object | n/a |
+| <a name="module_certificate_bucket"></a> [certificate\_bucket](#module\_certificate\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
+| <a name="module_crl_object"></a> [crl\_object](#module\_crl\_object) | terraform-aws-modules/s3-bucket/aws//modules/object | n/a |
+| <a name="module_log_bucket"></a> [log\_bucket](#module\_log\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
+| <a name="module_trust_store"></a> [trust\_store](#module\_trust\_store) | ../../modules/lb_trust_store | n/a |
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_instance.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
+| [null_resource.generate_certificates](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
+| [aws_route53_zone.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source |
+| [aws_ssm_parameter.al2](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | The domain name for which the certificate should be issued | `string` | `"terraform-aws-modules.modules.tf"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_arn"></a> [arn](#output\_arn) | The ID and ARN of the load balancer we created |
+| <a name="output_arn_suffix"></a> [arn\_suffix](#output\_arn\_suffix) | ARN suffix of our load balancer - can be used with CloudWatch |
+| <a name="output_dns_name"></a> [dns\_name](#output\_dns\_name) | The DNS name of the load balancer |
+| <a name="output_id"></a> [id](#output\_id) | The ID and ARN of the load balancer we created |
+| <a name="output_listener_rules"></a> [listener\_rules](#output\_listener\_rules) | Map of listeners rules created and their attributes |
+| <a name="output_listeners"></a> [listeners](#output\_listeners) | Map of listeners created and their attributes |
+| <a name="output_route53_records"></a> [route53\_records](#output\_route53\_records) | The Route53 records created and attached to the load balancer |
+| <a name="output_security_group_arn"></a> [security\_group\_arn](#output\_security\_group\_arn) | Amazon Resource Name (ARN) of the security group |
+| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | ID of the security group |
+| <a name="output_target_groups"></a> [target\_groups](#output\_target\_groups) | Map of target groups created and their attributes |
+| <a name="output_trust_store"></a> [trust\_store](#output\_trust\_store) | Map of trust store attributes |
+| <a name="output_zone_id"></a> [zone\_id](#output\_zone\_id) | The zone\_id of the load balancer to assist with creating DNS records |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

examples/mutual-auth-alb/ca.conf

@@ -0,0 +1,33 @@
+# X.509v1 client certificates are not supported so we must create an X.509v3 client certificate
+# This file is for example purposes only
+[v3_req]
+authorityKeyIdentifier = keyid,issuer
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature
+
+[ca]
+default_ca = root_ca
+
+[root_ca]
+dir = ./cert_files/
+new_certs_dir = $dir
+certificate = $dir/RootCA.pem
+database = $dir/crl_index
+private_key = $dir/RootCA.key
+serial = $dir/cert_serial
+default_days = 3650
+default_md = sha256
+policy = rootca_policy
+x509_extensions = v3_req
+crlnumber = $dir/crl_number
+default_crl_days = 365
+
+[rootca_policy]
+commonName = supplied
+stateOrProvinceName = supplied
+countryName = optional
+organizationName = supplied
+organizationalUnitName = optional
+
+[crl_ext]
+authorityKeyIdentifier = keyid:always