x.md

run no.1:

          ID: get-deploy-server.key
    Function: file.managed
        Name: /srv/certs/server.key
      Result: False
     Comment: File sum set for file /srv/certs/server.key of 1a5790c00acd4a19f3eae17dfc19d5800438303bf2318fdb6e17ece50b555c9f does not match real sum of 6c36e8bfd88db0b956f47f5f37036d73cf919a6950cec0b2a6b27f6c6774431c
     Started: 14:30:47.468295
    Duration: 46.769 ms
     Changes:
              ----------
              diff:
                  New file

run no.2:

          ID: get-deploy-server.key
    Function: file.managed
        Name: /srv/certs/server.key
      Result: False
     Comment: File sum set for file /srv/certs/server.key of 1a5790c00acd4a19f3eae17dfc19d5800438303bf2318fdb6e17ece50b555c9f does not match real sum of 40b8a4a6b3709801c6de3fc75163c0d65f1a29b79106f0144b661b493740cc9d
     Started: 14:30:57.781175
    Duration: 32.381 ms
     Changes:
              ----------
              diff:
                  New file

# nginx.sls
  {% for cert, hash in salt['pillar.get']('civix:api_certs').items() %}
get-deploy-{{ cert }}:
  file.managed:
    - name: /srv/certs/{{ cert }}
    - source: s3://{{ salt['pillar.get']('civix:deployment-bucket') }}/{{ env }}/certs/{{ cert }}
    - user: {{ user }}
    - group: {{ user }}
    - mode: 644
    - source_hash: sha256={{ hash }}

  {% endfor %}