How to automate issuing of AWS ACM certificates created by Terraform?

Question

Using AWS SSL certificate provider, you can create from Terraform new certificates, but you can't use them until they're issued. The problem is that you've to create a record in Route53 to make that verification (aaaa-xxxx-vvvv. | CNAME | challenge)

Is it possible to automate that Route53 validation process after creating a new certificate with Terraform?

Here's my Terraform configuration:

resource "aws_acm_certificate" "acme-cert-prod" {
  domain_name       = "www.acme.io"
  validation_method = "DNS"

  tags = {
    Environment = "prod"
  }

  lifecycle {
    create_before_destroy = true
  }
}

Are there any options I'm missing to get that certificate automatically issued?

Answer 1

The aws_acm_certificate_validation resource will handle triggering the validation and can be linked to the creation of Route53 records with the DNS challenge.

An example is giving in the resource documentation:

resource "aws_acm_certificate" "cert" {
  domain_name       = "example.com"
  validation_method = "DNS"
}

data "aws_route53_zone" "zone" {
  name         = "example.com."
  private_zone = false
}

resource "aws_route53_record" "cert_validation" {
  name    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_name}"
  type    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_type}"
  zone_id = "${data.aws_route53_zone.zone.zone_id}"
  records = ["${aws_acm_certificate.cert.domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.fqdn}"]
}

resource "aws_lb_listener" "front_end" {
  # [...]
  certificate_arn = "${aws_acm_certificate_validation.cert.certificate_arn}"
}