From fe5e6032676909340dc1e2bdcf3df97061304938 Mon Sep 17 00:00:00 2001
From: Amanda Crawley <amanda.crawley@agilebits.com>
Date: Thu, 26 Nov 2020 10:18:18 -0400
Subject: [PATCH] Working but gets a redirect loop

---
 aws-terraform/ecs/README.md                  |  2 +
 aws-terraform/ecs/task-definitions/scim.json |  5 +-
 aws-terraform/ecs/terraform.tf               | 74 +++++++++++++++-----
 3 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/aws-terraform/ecs/README.md b/aws-terraform/ecs/README.md
index 8cf1f0f..beb2a31 100644
--- a/aws-terraform/ecs/README.md
+++ b/aws-terraform/ecs/README.md
@@ -2,3 +2,5 @@
 
 This document describes deploying the 1Password SCIM bridge to your Amazon Web Service Elastic Container Service using Terraform.
 
+terraform apply -target=aws_acm_certificate.scim_bridge_cert
+terraform apply
\ No newline at end of file
diff --git a/aws-terraform/ecs/task-definitions/scim.json b/aws-terraform/ecs/task-definitions/scim.json
index d9f095c..c1d2b34 100644
--- a/aws-terraform/ecs/task-definitions/scim.json
+++ b/aws-terraform/ecs/task-definitions/scim.json
@@ -19,12 +19,15 @@
         {
           "containerPort": 8443,
           "hostPort": 8443
+        },
+        {
+          "containerPort": 3002,
+          "hostPort": 3002
         }
       ],
       "entrypoint": ["/op-scim/op-scim", "--redis-host=localhost", "--redis-port=6379"],
       "environment": [
         { "name": "OP_PORT", "value": "8080"},
-        { "name": "OP_SESSION", "value": "/data/scimsession"},
         { "name": "OP_REDIS_URL", "value": "localhost"}
       ],
       "logConfiguration": {
diff --git a/aws-terraform/ecs/terraform.tf b/aws-terraform/ecs/terraform.tf
index b4d3335..5770777 100644
--- a/aws-terraform/ecs/terraform.tf
+++ b/aws-terraform/ecs/terraform.tf
@@ -44,7 +44,7 @@ resource "aws_ecs_service" "scim_bridge_service" {
   task_definition = aws_ecs_task_definition.scim-bridge.arn
   launch_type     = "FARGATE"
   desired_count   = 1 
-  depends_on      = [aws_lb_listener.listener_http, aws_lb_listener.listener_https]
+  depends_on      = [aws_lb_listener.listener_https]
 
   load_balancer {
     target_group_arn = aws_lb_target_group.target_group_http.arn 
@@ -52,11 +52,11 @@ resource "aws_ecs_service" "scim_bridge_service" {
     container_port   = 8080 # Specifying the container port
   }
 
-  load_balancer {
+  /*load_balancer {
     target_group_arn = aws_lb_target_group.target_group_https.arn
     container_name   = aws_ecs_task_definition.scim-bridge.family
     container_port   = 8443 # Specifying the container port
-  }
+  }*/
 
   network_configuration {
     subnets          = [aws_default_subnet.default_subnet_a.id, aws_default_subnet.default_subnet_b.id, aws_default_subnet.default_subnet_c.id]
@@ -130,17 +130,7 @@ resource "aws_lb_target_group" "target_group_http" {
   }
 }
 
-resource "aws_lb_listener" "listener_http" {
-  load_balancer_arn = aws_alb.scim-bridge-alb.arn # Referencing our load balancer
-  port              = 80
-  protocol          = "HTTP"
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.target_group_http.arn # Referencing our target group
-  }
-}
-
-resource "aws_lb_target_group" "target_group_https" {
+/*resource "aws_lb_target_group" "target_group_https" {
   name        = "target-group-https"
   port        = 8443
   protocol    = "HTTPS"
@@ -150,24 +140,32 @@ resource "aws_lb_target_group" "target_group_https" {
     matcher = "200,301,302"
     path = "/"
   }
-}
-
+}*/
 resource "aws_lb_listener" "listener_https" {
   load_balancer_arn = aws_alb.scim-bridge-alb.arn # Referencing our load balancer
   port              = 443
   protocol          = "HTTPS"
-  certificate_arn   = "arn:aws:acm:us-east-1:729119775555:certificate/7b939514-6eee-496f-97dd-b30a63331db7"
+  certificate_arn   = aws_acm_certificate.scim_bridge_cert.arn
   default_action {
     type             = "forward"
-    target_group_arn = aws_lb_target_group.target_group_https.arn # Referencing our target group
+    target_group_arn = aws_lb_target_group.target_group_http.arn # Referencing our target group
   }
 }
 
+/*resource "aws_lb_listener" "listener_http" {
+  load_balancer_arn = aws_alb.scim-bridge-alb.arn # Referencing our load balancer
+  port              = 80
+  protocol          = "HTTP"
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.target_group_http.arn # Referencing our target group
+  }
+}*/
+
 # Providing a reference to our default VPC
 resource "aws_default_vpc" "default_vpc" {
 }
 
-# Providing a reference to our default subnets
 resource "aws_default_subnet" "default_subnet_a" {
   availability_zone = "us-east-1a"
 }
@@ -178,4 +176,42 @@ resource "aws_default_subnet" "default_subnet_b" {
 
 resource "aws_default_subnet" "default_subnet_c" {
   availability_zone = "us-east-1c"
+}
+
+resource "aws_acm_certificate" "scim_bridge_cert" {
+  domain_name       = "scim-bridge-amanda.play.agilebits.net"
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_route53_record" "scim_bridge_cert_validation" {
+  for_each = {
+    for dvo in aws_acm_certificate.scim_bridge_cert.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = "Z3V3UMKDNQGJ7A"
+}
+
+resource "aws_route53_record" "scim_bridge" {
+  zone_id = "Z3V3UMKDNQGJ7A"
+  name    = "scim-bridge-amanda.play.agilebits.net"
+  type    = "A"
+
+  alias {
+    name                   = aws_alb.scim-bridge-alb.dns_name
+    zone_id                = aws_alb.scim-bridge-alb.zone_id
+    evaluate_target_health = true
+  }
 }
\ No newline at end of file