Question

您可以使用AWS SSL证书提供程序从Terraform创建新证书，但是只有在颁发新证书后才能使用它们。问题是您必须在Route53中创建一条记录以进行验证（aaaa-xxxx-vvvv。| CNAME |质询）

使用Terraform创建新证书后是否可以自动执行Route53验证过程？

这是我的Terraform配置：

resource "aws_acm_certificate" "acme-cert-prod" {
  domain_name       = "www.acme.io"
  validation_method = "DNS"

  tags = {
    Environment = "prod"
  }

  lifecycle {
    create_before_destroy = true
  }
}

我缺少任何自动获得该证书的选项吗？

Answer 1

aws_acm_certificate_validation resource将处理触发验证，并可以通过DNS质询链接到创建Route53记录。

资源文档中提供了一个示例：

resource "aws_acm_certificate" "cert" {
  domain_name       = "example.com"
  validation_method = "DNS"
}

data "aws_route53_zone" "zone" {
  name         = "example.com."
  private_zone = false
}

resource "aws_route53_record" "cert_validation" {
  name    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_name}"
  type    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_type}"
  zone_id = "${data.aws_route53_zone.zone.zone_id}"
  records = ["${aws_acm_certificate.cert.domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.fqdn}"]
}

resource "aws_lb_listener" "front_end" {
  # [...]
  certificate_arn = "${aws_acm_certificate_validation.cert.certificate_arn}"
}

如何自动发行Terraform创建的AWS ACM证书？

1 个答案: