test(e2e): Created enos scenario for https testing (#6324)

* test(e2e): Created enos scenario for https testing

enos/modules/aws_boundary/alb.tf

@@ -24,10 +24,48 @@ resource "aws_alb" "boundary_alb" {
   )
 }
 
+resource "tls_private_key" "private_key" {
+  depends_on = [aws_alb.boundary_alb]
+  count      = var.protocol == "https" ? 1 : 0
+
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "certificate" {
+  depends_on = [aws_alb.boundary_alb]
+  count      = var.protocol == "https" ? 1 : 0
+
+  private_key_pem = tls_private_key.private_key[0].private_key_pem
+
+  subject {
+    common_name = aws_alb.boundary_alb.dns_name
+  }
+
+  dns_names = [aws_alb.boundary_alb.dns_name]
+
+  validity_period_hours = 8760
+
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth",
+  ]
+}
+
+resource "aws_acm_certificate" "cert" {
+  depends_on = [aws_alb.boundary_alb]
+  count      = var.protocol == "https" ? 1 : 0
+
+  private_key      = tls_private_key.private_key[0].private_key_pem
+  certificate_body = tls_self_signed_cert.certificate[0].cert_pem
+}
+
 resource "aws_alb_target_group" "boundary_tg" {
+  depends_on      = [aws_acm_certificate.cert]
   name            = "boundary-tg-${random_string.cluster_id.result}"
-  port            = var.listener_api_port
   protocol        = "HTTP"
+  port            = var.listener_api_port
   vpc_id          = var.vpc_id
   ip_address_type = var.ip_version == "6" ? "ipv6" : "ipv4"
 
@@ -57,7 +95,11 @@ resource "aws_lb_target_group_attachment" "boundary" {
 resource "aws_alb_listener" "boundary" {
   load_balancer_arn = aws_alb.boundary_alb.arn
   port              = var.alb_listener_api_port
-  protocol          = "HTTP"
+  protocol          = var.protocol == "https" ? "HTTPS" : "HTTP"
+
+  # These MUST be null if protocol is HTTP
+  ssl_policy      = var.protocol == "https" ? "ELBSecurityPolicy-2016-08" : null
+  certificate_arn = var.protocol == "https" ? aws_acm_certificate.cert[0].arn : null
 
   default_action {
     target_group_arn = aws_alb_target_group.boundary_tg.arn

enos/modules/aws_boundary/outputs.tf

@@ -38,7 +38,7 @@ output "rds_db_name" {
 
 output "alb_boundary_api_addr" {
   description = "The address of the boundary API"
-  value       = "http://${aws_alb.boundary_alb.dns_name}:${var.alb_listener_api_port}"
+  value       = var.protocol == "https" ? "https://${aws_alb.boundary_alb.dns_name}:${var.alb_listener_api_port}" : "http://${aws_alb.boundary_alb.dns_name}:${var.alb_listener_api_port}"
 }
 
 // Boundary init outputs
@@ -252,3 +252,8 @@ output "worker_ipv6_cidr" {
   description = "List of ipv6 subnets of all workers"
   value       = distinct([for ip in flatten(aws_instance.worker.*.ipv6_addresses) : cidrsubnet("${ip}/64", 0, 0)])
 }
+
+output "alb_cert" {
+  description = "Public cert for the alb"
+  value       = try(tls_self_signed_cert.certificate[0].cert_pem, null)
+}

enos/modules/aws_boundary/variables.tf

@@ -401,3 +401,9 @@ variable "vault_transit_token" {
   type        = string
   default     = ""
 }
+
+variable "protocol" {
+  description = "http protocol (http/https)"
+  type        = string
+  default     = "http"
+}

enos/modules/test_e2e_ui/main.tf

@@ -194,6 +194,11 @@ variable "worker_tag_egress" {
   type        = string
   default     = ""
 }
+variable "alb_cert" {
+  description = "public cert for the alb"
+  type        = string
+  default     = ""
+}
 
 locals {
   aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path)
@@ -236,6 +241,7 @@ resource "enos_local_exec" "run_e2e_test" {
     E2E_LDAP_GROUP_NAME           = var.ldap_group_name
     E2E_WORKER_TOKEN              = var.worker_token
     E2E_WORKER_TAG_EGRESS         = var.worker_tag_egress
+    E2E_ALB_CERT                  = var.alb_cert
   }
 
   inline = var.debug_no_run ? [""] : ["set -o pipefail; PATH=\"${var.local_boundary_dir}:$PATH\" pnpm --cwd ${var.local_boundary_ui_src_dir}/ui/admin run e2e 2>&1 | tee ${path.module}/../../test-e2e-ui.log"]