Added ACM SSL cert

Author: Srihari Raman

terraform/aws/custom_domain.tf

@@ -0,0 +1,47 @@
+# Custom domain resources for the prod MCP server.
+# Only created when var.custom_domain is non-empty (i.e. boston-prod workspace).
+# DNS records are managed externally by city IT — no Route53 resources here.
+
+locals {
+  create_custom_domain = var.custom_domain != "" ? 1 : 0
+}
+
+# ── ACM Certificate ──────────────────────────────────────────────────────────
+
+resource "aws_acm_certificate" "mcp_cert" {
+  count             = local.create_custom_domain
+  domain_name       = var.custom_domain
+  validation_method = "DNS"
+
+  tags = {
+    Name        = "${local.lambda_name}-cert"
+    Environment = var.stage_name
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# ── API Gateway Custom Domain Name ──────────────────────────────────────────
+
+resource "aws_api_gateway_domain_name" "custom" {
+  count       = local.create_custom_domain
+  domain_name = var.custom_domain
+
+  regional_certificate_arn = aws_acm_certificate.mcp_cert[0].arn
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+}
+
+# ── Base Path Mapping ───────────────────────────────────────────────────────
+# Empty base path so data-mcp.boston.gov/mcp hits the existing /mcp resource.
+
+resource "aws_api_gateway_base_path_mapping" "custom" {
+  count       = local.create_custom_domain
+  domain_name = aws_api_gateway_domain_name.custom[0].domain_name
+  api_id      = aws_api_gateway_rest_api.mcp_api.id
+  stage_name  = aws_api_gateway_stage.prod.stage_name
+}

terraform/aws/outputs.tf

@@ -22,3 +22,25 @@ output "api_gateway_url" {
   description = "API Gateway URL for MCP server (production endpoint with authentication)"
   value       = "${aws_api_gateway_stage.prod.invoke_url}/mcp"
 }
+
+# ── Custom domain outputs (only populated when var.custom_domain is set) ────
+
+output "acm_certificate_arn" {
+  description = "ARN of the ACM certificate for the custom domain"
+  value       = var.custom_domain != "" ? aws_acm_certificate.mcp_cert[0].arn : null
+}
+
+output "acm_validation_cname_name" {
+  description = "DNS CNAME record name that city IT must create for ACM validation"
+  value       = var.custom_domain != "" ? tolist(aws_acm_certificate.mcp_cert[0].domain_validation_options)[0].resource_record_name : null
+}
+
+output "acm_validation_cname_value" {
+  description = "DNS CNAME record value for ACM validation"
+  value       = var.custom_domain != "" ? tolist(aws_acm_certificate.mcp_cert[0].domain_validation_options)[0].resource_record_value : null
+}
+
+output "custom_domain_target" {
+  description = "API Gateway regional domain name — city IT points the custom domain CNAME here"
+  value       = var.custom_domain != "" ? aws_api_gateway_domain_name.custom[0].regional_domain_name : null
+}

terraform/aws/prod.tfvars

@@ -7,3 +7,4 @@ lambda_timeout  = 120
 api_quota_limit = 1000
 api_rate_limit  = 5
 api_burst_limit = 10
+custom_domain   = "data-mcp.boston.gov"

terraform/aws/staging.tfvars

@@ -7,3 +7,4 @@ lambda_timeout  = 120
 api_quota_limit = 1000
 api_rate_limit  = 5
 api_burst_limit = 10
+custom_domain = ""

terraform/aws/variables.tf

@@ -51,3 +51,9 @@ variable "stage_name" {
   type        = string
   default     = "staging"
 }
+
+variable "custom_domain" {
+  description = "Custom domain name for API Gateway (leave empty to skip custom domain setup)"
+  type        = string
+  default     = ""
+}