Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow management of ACM certs with SANs in multiple zones #61

Merged
merged 11 commits into from
Sep 21, 2022

Conversation

nitrocode
Copy link
Member

@nitrocode nitrocode commented Sep 13, 2022

what

  • Allow management of ACM certs with SANs in multiple zones
  • Add versions.tf to examples/complete

why

  • This is useful for more complex certificates and validation of those certificates
  • Workaround without this is to manage validation records outside of the module
resource "aws_route53_record" "default" {
  for_each = {
    for dvo in module.acm_certificate.domain_validation_options[0] : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  name    = each.value.name
  records = [each.value.record]
  type    = each.value.type
  zone_id = data.aws_route53_zone.default[local.domain_to_zone[each.key]].id
  ttl     = 300
}

references

@nitrocode
Copy link
Member Author

/test all

@nitrocode
Copy link
Member Author

/test all

@nitrocode nitrocode marked this pull request as ready for review September 13, 2022 17:13
@nitrocode nitrocode requested review from a team as code owners September 13, 2022 17:13
@nitrocode
Copy link
Member Author

/test all

@nitrocode nitrocode requested a review from aknysh September 14, 2022 18:55
@nitrocode
Copy link
Member Author

/test all

aknysh
aknysh previously approved these changes Sep 15, 2022
@nitrocode
Copy link
Member Author

/test all

@nitrocode nitrocode requested a review from aknysh September 16, 2022 01:37
@nitrocode nitrocode merged commit 2eec7e5 into master Sep 21, 2022
@nitrocode nitrocode deleted the multiple-zones branch September 21, 2022 15:38
@apanzerj
Copy link

apanzerj commented Oct 11, 2022

@nitrocode seeing a weird error:

Domain: bar.com
Subdomain: foo.baz.bar.com
In v0.16.2 this apply worked just fine.

module "acm_request_certificate_east_coast" {
  source = "cloudposse/acm-request-certificate/aws"

  version         = "0.16.2"

  domain_name                       = "foo.baz.bar.com"
  process_domain_validation_options = true
  ttl                               = "300"
  subject_alternative_names         = ["*.foo.baz.bar.com", "*.bar.com"]

  providers = {
    aws = aws.use1
  }
}

Now in v0.17.0 it gives me an error saying it can’t find a zone for baz.bar.com which weird cuz, I don’t need that zone for anything.

edit: link to slack message too: https://sweetops.slack.com/archives/CB6GHNLG0/p1665521731064809

@nitrocode
Copy link
Member Author

@apanzerj set bar.com as zone_name (or zone_id) and then both subject_alternative_names and the domain_name will use the same zone_id

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support SANs with multiple hosted zones
4 participants