/
rds-ssl-java.config
105 lines (88 loc) · 4.91 KB
/
rds-ssl-java.config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
###################################################################################################
#### Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
####
#### Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file
#### except in compliance with the License. A copy of the License is located at
####
#### http://aws.amazon.com/apache2.0/
####
#### or in the "license" file accompanying this file. This file is distributed on an "AS IS"
#### BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#### License for the specific language governing permissions and limitations under the License.
###################################################################################################
###################################################################################################
#### This configuration file installs the SSL intermediate and root certificates for
#### RDS into the root Java installation so that your Java Tomcat Elastic Beanstalk
#### can securely talk to an RDS database over SSL using standard JDBC mechanisms.
####
#### For more details, see:
#### http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
####
#### To connect to an RDS database in a different region than your Elastic Beanstalk application,
#### you may change the "APP_REGION" value to be a specific region.
####
#### NOTE: The mechanism for connecting to an RDS database over SSL varies by provider, so make
#### sure to consult the RDS documentation.
###################################################################################################
option_settings:
aws:elasticbeanstalk:application:environment:
APP_REGION: '`{"Ref": "AWS::Region"}`'
##############################################
#### Do not modify values below this line ####
##############################################
commands:
01_install:
command: "/tmp/install-rds-ssl-certs.sh"
files:
"/tmp/install-rds-ssl-certs.sh":
mode: "000755"
content : |
#!/bin/bash
APP_REGION=$(/opt/elasticbeanstalk/bin/get-config environment -k APP_REGION)
if [ -z "$APP_REGION" ]; then
echo "Could not determine proper environment region!"
exit 1
fi
echo "Detected current region as $APP_REGION..."
RDS_ROOT_ALIAS="rds_root"
RDS_ROOT_LOCAL_FILE="/tmp/rds-ca-2019-root.pem"
RDS_REGION_ALIAS="rds_${APP_REGION}"
RDS_REGION_LOCAL_FILE="/tmp/rds-ca-2019-${APP_REGION}.pem"
JAVA_KEYSTORE_PASSWORD="changeit"
#via http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
ROOT_RDS_CERT_URL="https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem"
REGION_RDS_CERT_URL="https://s3.amazonaws.com/rds-downloads/rds-ca-2019-${APP_REGION}.pem"
if [ -z "$JAVA_HOME" ]; then
echo "JAVA_HOME was not set. Setting to default of /usr/lib/jvm/jre..."
export JAVA_HOME=/usr/lib/jvm/jre
fi
JAVA_KEYSTORE_FILE="$JAVA_HOME/lib/security/cacerts"
echo "Attempting to remove any previously installed RDS SSL certificates (and ignoring errors)..."
$JAVA_HOME/bin/keytool -delete -alias $RDS_ROOT_ALIAS -storepass $JAVA_KEYSTORE_PASSWORD -noprompt -keystore $JAVA_KEYSTORE_FILE
$JAVA_HOME/bin/keytool -delete -alias $RDS_REGION_ALIAS -storepass $JAVA_KEYSTORE_PASSWORD -noprompt -keystore $JAVA_KEYSTORE_FILE
echo "Downloading ${ROOT_RDS_CERT_URL}..."
curl $ROOT_RDS_CERT_URL > $RDS_ROOT_LOCAL_FILE
if [ $? -ne 0 ]; then
echo "ERROR: Could not download RDS root certificate!"
exit 1
fi
echo "Downloading ${REGION_RDS_CERT_URL}..."
curl $REGION_RDS_CERT_URL > $RDS_REGION_LOCAL_FILE
if [ $? -ne 0 ]; then
echo "ERROR: Could not download RDS regional certificate!"
exit 1
fi
#Installing new certs to the keystore requires root permissions
echo 'Installing downloaded RDS certificates into Java keystore...'
$JAVA_HOME/bin/keytool -import -alias $RDS_ROOT_ALIAS -storepass $JAVA_KEYSTORE_PASSWORD -noprompt -keystore $JAVA_KEYSTORE_FILE -file $RDS_ROOT_LOCAL_FILE
if [ $? -ne 0 ]; then
echo "ERROR: Could not install RDS root certificate!"
exit 1
fi
echo 'RDS root certificate installed successfully!'
$JAVA_HOME/bin/keytool -import -alias $RDS_REGION_ALIAS -storepass $JAVA_KEYSTORE_PASSWORD -noprompt -keystore $JAVA_KEYSTORE_FILE -file $RDS_REGION_LOCAL_FILE
if [ $? -ne 0 ]; then
echo "ERROR: Could not install RDS regional certificate!"
exit 1
fi
echo 'RDS regional certificate installed successfully!'