This module can be used to issue and validate free, auto-renewing TLS certificates using AWS Certificate
Manager (ACM). It supports issuing and validating multiple ACM certificates.
The module will create the TLS certificates, as well as
the DNS records to validate them, and output the certificates' ARNs so you can use them with other resources, such as ALBs, CloudFront, and API Gateway.
Understanding how ACM certificates are programmatically requested and verified
This module supports ordering and programmatically validating, via DNS records that are written to a public Route53 zone, ACM certificates.
To understand the Route53 certificate ordering and DNS validation process in more detail, consult the AWS documentation.
The DNS validation scheme is preferred over the alternative email validation scheme, because the DNS scheme can be orchestrated end to end via Terraform, which this module does for you.
At a high level, the process involves:
Requesting a certificate for a given domain name such as example.com.
Receiving the challenge records provided by AWS, which ask you to prove ownership of the domain by writing a programmatically generated CNAME record to the Route53 public hosted zone associated with example.com. The provided challenge CNAME record will consist of the CNAME record name and a record value.
The Route53 public hosted zone must be created if it does not already exist, so that any records written to it will resolve via external DNS queries.
Upon writing the challenge record and its value to the public Route53 hosted zone, programmatically initiate the validation process, whereby AWS will query your Route53 zone for the challenge record, ensure it resolves, and that its value is the exact value supplied in the original challenge. Note that these queries must resolve over public DNS, so you can test them yourself:
dig _a79865eb4cd1a6ab990a45779b4e0b96.example.com. cname
Once AWS is able to verify that the records resolve correctly and with the expected values, it will convert your certificate from a pending status to an issued status.
This module is capable of handling these steps for you, so that you need only supply the correct input map of desired certificates via var.acm_tls_certificates.
How to request wildcard certificates
To provision a wildcard certificate for example.com, you would create the following acm_tls_certificates input, using the subject_alternative_names
field to specify the domain prefixed with *., e.g., *.example.com:
# Example of a simple wildcard certificate that protects BOTH example.com and the first level of subdomains# such as test.example.com, mail.example.com, etc
acm_tls_certificates = {
"example.com" = {
subject_alternative_names = ["*.example.com"]
tags = {
Environment = "stage"
run_destroy_check = true
}
create_verification_record = true
verify_certificate = true
}
}
Here's an example of requesting a wildcard certificate for the next level down of subdomains:
# Example of provisioning a wildcard certificate that protects BOTH test.example.com and mail.test.example.com,# db.test.example.com, etc
acm_tls_certificates = {
"test.example.com" = {
subject_alternative_names = ["*.test.example.com"]
tags = {
Environment = "stage"
run_destroy_check = true
}
create_verification_record = true
verify_certificate = true
}
}
Requesting a certificate for a domain that doesn't match its hosted zone name
If you are requesting a a certificate for domain X, but you're attaching it to a hosted zone that is NOT named X you must specify the hosted_zone_id of the target hosted zone in the var.acm_tls_certificates input.
For example, if you are requesting a certificate for test-29283.example.com, but you are attaching it to the public zone named example.com, then you MUST provide the hosted_zone_id for the example.com public zone in your var.acm_tls_certificates input map.
Recall that, because of how the programmatic DNS validation scheme works outlined above, you need the DNS validation challenge records that will be generated for your requessted test-29283.example.com to resolve via public DNS queries, and therefore you need to write their records to the example.com hosted zone. Therefore you would provide the hosted_zone_id of example.com in your input map as in the following example:
acm_tls_certificates = {
"test-29283.example.com" = {
subject_alternative_names = ["*.test.example.com"]
tags = {
Environment = "stage"run_destroy_check = true
}
create_verification_record = trueverify_certificate = true# This is the ID of the public zone example.comhosted_zone_id = "Z04542822CKAS2ZFBUGT"
}
}
How do you use this module?
See the root README for instructions on using Terraform modules.
See vars.tf for all the variables you can set on this module.
Special handling for use with API Gateway
If you are using this module to create a TLS certificate that will be used with API Gateway, along with a custom
domain name, then you need to set a tag named exactly run_destroy_check with a value of true. Do this for every certificate you configure that will be used in this way:
Without this, terraform destroy will fail. This is because you can't delete an ACM cert while it's in use,
deleting a custom domain name mapping for API Gateway takes 10 - 30 minutes, and Terraform only waits a max of 10
minutes to delete the cert, so it times out and exits with an error every time. The run_destroy_check tells this
module to run a script that waits until the cert is no longer in use.
The script is written in Bash, so it will not work on Windows versions earlier than Windows 10, which supports a Linux Bash shell.
A note on the dependency_getter pattern implementing module_depends
This module uses a null_resource named dependency_getter to effectively implement depends_on at the module level. This is a temporary workaround as Terraform does not yet natively support depends_on at the module level. You can also see this Terraform issue on GitHub for more discussion.
Here's how this works. First, we create this optional dependencies variable for the current module, which accepts a list of strings, but defaults to an empty list. The null_resource linked above does a simple join on the dependencies list, if present. Every resource within this module also depends_on this null_resource.dependency_getter(even though it's creating no resources).
This has the desirable effect of causing the dependency graph that Terraform builds to look as you'd expect if there were in fact native support for depends_on at the module level. Let's say you had a separate Terraform module that needed to consume this current module in order to generate certificates, but you wanted this certificates module to wait to do any of its work until some of the outputs from the resources in your parent module were ready. In that case, you could pass those outputs into this module's dependencies variable, like so:
# ---------------------------------------------------------------------------------------------------------------------# CREATE PUBLIC HOSTED ZONE(S)# ---------------------------------------------------------------------------------------------------------------------module"acm-tls-certificates" {
# When using these modules in your own repos, you will need to use a Git URL with a ref attribute that pins you# to a specific version of the modules, such as the following example:# source = "git::git@github.com:gruntwork-io/terraform-aws-load-balancer.git//modules/acm-tls-certificate?ref=v0.19.0"
source = "git::git@github.com:gruntwork-io/terraform-aws-load-balancer.git//modules/acm-tls-certificate?ref=v0.20.0"
acm_tls_certificates = local.acm_tls_certificates
# Workaround Terraform limitation where there is no module depends_on.# See https://github.com/hashicorp/terraform/issues/1178 for more details.# This effectively draws an explicit dependency between the public # and private zones managed here and the ACM certificates that will be optionally # provisioned for them
dependencies = flatten([values(aws_route53_zone.public_zones).*.name_servers])
}
In this example, the acm-tls-certificates module will "wait" until your aws_route53_zone.public_zones resources have been successfully provisioned.
Questions? Ask away.
We're here to talk about our services, answer any questions, give advice, or just to chat.
{"treedata":{"name":"root","toggled":true,"children":[{"name":".circleci","children":[{"name":"config.yml","path":".circleci/config.yml","sha":"c973003014cea17464fbfa1e173b172beb392062"},{"name":"post-upgrade-test-results.sh","path":".circleci/post-upgrade-test-results.sh","sha":"a4867e8fbdc334b7a90259568ee41ea577fbe764"},{"name":"set-upgrade-test-vars.sh","path":".circleci/set-upgrade-test-vars.sh","sha":"04ccab865d51c1169f7ae4648c38a3d98a9889ab"}]},{"name":".github","children":[{"name":"ISSUE_TEMPLATE","children":[{"name":"bug_report.md","path":".github/ISSUE_TEMPLATE/bug_report.md","sha":"d2e87e27c601e423865ed660ec697082470ca60f"},{"name":"feature_request.md","path":".github/ISSUE_TEMPLATE/feature_request.md","sha":"023a33099be2336476930c96e17ff1ba5dc55348"}]},{"name":"pull_request_template.md","path":".github/pull_request_template.md","sha":"6b100e40e323b5b07f40ed30616277c51c9f4b9e"}]},{"name":".gitignore","path":".gitignore","sha":"9514d5739358fad56ca609d222cdfdd3c6082f04"},{"name":".pre-commit-config.yaml","path":".pre-commit-config.yaml","sha":"1d8f329691fa148e29c9f4b1628b118d253d94a3"},{"name":"CODEOWNERS","path":"CODEOWNERS","sha":"80c1a6b2aa0b84c484b0f607a394b4d4ef2b5c95"},{"name":"LICENSE.txt","path":"LICENSE.txt","sha":"154ea4429924fda533b20544c7a19d8949fc82cf"},{"name":"README.md","path":"README.md","sha":"b2c2abd8d97a3037bd6c59d259279c76707878e7"},{"name":"examples","children":[{"name":"acm-tls-certificate","children":[{"name":"README.md","path":"examples/acm-tls-certificate/README.md","sha":"0a7892a8b5d327254c91a96276273fcc975821ca"},{"name":"dependencies.tf","path":"examples/acm-tls-certificate/dependencies.tf","sha":"e7f4e61d07530fb3ccbbe4eff97130f75bdf0b58"},{"name":"main.tf","path":"examples/acm-tls-certificate/main.tf","sha":"aed1a9c08234aa358f08b9850b86f46b0104053a"},{"name":"outputs.tf","path":"examples/acm-tls-certificate/outputs.tf","sha":"083ef125b3be1f465c66f8b1e8b0ede0c782f10e"},{"name":"variables.tf","path":"examples/acm-tls-certificate/variables.tf","sha":"3b96d4f8aa3d1620494d05538069dbc5d9d4de14"}]},{"name":"alb-with-logs","children":[{"name":"README.md","path":"examples/alb-with-logs/README.md","sha":"b46a1aef114340b80c6742b9344c52f1a952a7a4"},{"name":"main.tf","path":"examples/alb-with-logs/main.tf","sha":"ee9b1fc0d2cd4d8650271bb0289536440173ea76"},{"name":"outputs.tf","path":"examples/alb-with-logs/outputs.tf","sha":"51d66cdd618681c7375244a8b47a2cfd77dd0272"},{"name":"variables.tf","path":"examples/alb-with-logs/variables.tf","sha":"029a4cf53d07f1e6e5c04c6173df8a29b0bed98f"}]},{"name":"alb","children":[{"name":"README.md","path":"examples/alb/README.md","sha":"202d51dd9238a27061a6277a4632dce37706a3f9"},{"name":"main.tf","path":"examples/alb/main.tf","sha":"25c653d1294e7d6877c3aa27343b9b2092d2550a"},{"name":"outputs.tf","path":"examples/alb/outputs.tf","sha":"201a421be76f8332b212f78216417e35f8c968eb"},{"name":"variables.tf","path":"examples/alb/variables.tf","sha":"3306c4227949373dc9fed5a83dc19f7d6904e007"}]},{"name":"lb-listener-rules","children":[{"name":"README.md","path":"examples/lb-listener-rules/README.md","sha":"3d2205b57641d6e97bc28f2a8a59093c4bfc7f61"},{"name":"main.tf","path":"examples/lb-listener-rules/main.tf","sha":"da3deba5a04e0701bd7f80df5afdce2821eb2a47"},{"name":"outputs.tf","path":"examples/lb-listener-rules/outputs.tf","sha":"2f227fe908f34ad51a837a85fa6a064f993fa897"},{"name":"user_data.sh","path":"examples/lb-listener-rules/user_data.sh","sha":"5b667c100463a2ce64a5827e4e9dc357509e1a4c"},{"name":"variables.tf","path":"examples/lb-listener-rules/variables.tf","sha":"6fd908ad8227c3e2b1058a3b752d245aef0c1b5f"}]},{"name":"multiple-acm-tls-certificates","children":[{"name":"main.tf","path":"examples/multiple-acm-tls-certificates/main.tf","sha":"8e468b03a910fda73bfa292dbf8eaafd5c3f855b"},{"name":"outputs.tf","path":"examples/multiple-acm-tls-certificates/outputs.tf","sha":"20ec52f607e69887ce2a0b54e68415cf36f034e6"},{"name":"variables.tf","path":"examples/multiple-acm-tls-certificates/variables.tf","sha":"55bb61a54afca24f007dfdf2aed50fb86355d56a"}]}]},{"name":"modules","children":[{"name":"acm-tls-certificate","children":[{"name":"README.md","path":"modules/acm-tls-certificate/README.md","sha":"adc409026d87983f04e60b1a59d5a32c54739a12","toggled":true},{"name":"main.tf","path":"modules/acm-tls-certificate/main.tf","sha":"9841b5c772204721df489dd45afc78081a337f04"},{"name":"outputs.tf","path":"modules/acm-tls-certificate/outputs.tf","sha":"18fa9f9ce0d23ca8f81f8fa41cb20c81922f7a87"},{"name":"variables.tf","path":"modules/acm-tls-certificate/variables.tf","sha":"f2b1b853fc7181523bf1f10a2530433f4ff373bb"},{"name":"wait-until-tls-cert-not-in-use.sh","path":"modules/acm-tls-certificate/wait-until-tls-cert-not-in-use.sh","sha":"68296e34cc4e86fbefcae3820e6de88f2aa6f911"}],"toggled":true},{"name":"alb","children":[{"name":"README.md","path":"modules/alb/README.md","sha":"143055ff2770a1c1e4a52e2ab588a5bd30aaba45"},{"name":"locals.tf","path":"modules/alb/locals.tf","sha":"e2f2e20542e0ba4552dcb0b1aa76598f215db4e9"},{"name":"main.tf","path":"modules/alb/main.tf","sha":"da9054ab2cb4f91d2150e299fead6a1fad0bd0e0"},{"name":"outputs.tf","path":"modules/alb/outputs.tf","sha":"a823c6cd265e9a1db66616424256a03fab81a691"},{"name":"variables.tf","path":"modules/alb/variables.tf","sha":"8c4c3c1b1b000fcc6ce8693951fdc67a5aff0389"}]},{"name":"lb-listener-rules","children":[{"name":"README.md","path":"modules/lb-listener-rules/README.md","sha":"a4a3c1a510f7958373a35ba409a6ce4eb5ba63eb"},{"name":"listener-rules-list-to-map","children":[{"name":"README.md","path":"modules/lb-listener-rules/listener-rules-list-to-map/README.md","sha":"2a61caf06789c48011607cb7976da736bfa61aaf"},{"name":"outputs.tf","path":"modules/lb-listener-rules/listener-rules-list-to-map/outputs.tf","sha":"9e3ec0fe862aaa41a52c7f059616b4b18e2bac95"},{"name":"variables.tf","path":"modules/lb-listener-rules/listener-rules-list-to-map/variables.tf","sha":"b771acd0bac2a12d25764435f3e48150edbf68f5"}]},{"name":"main.tf","path":"modules/lb-listener-rules/main.tf","sha":"fc85f54a2ebbc318dfa831beb6acb5a181d45af9"},{"name":"outputs.tf","path":"modules/lb-listener-rules/outputs.tf","sha":"9d3efd16064ff8defdb7e8c95634f875d10832b1"},{"name":"variables.tf","path":"modules/lb-listener-rules/variables.tf","sha":"9953e57c1acacfeeaae618105c3da7b419d8cc8e"}]},{"name":"nlb","children":[{"name":"README.md","path":"modules/nlb/README.md","sha":"254a0821c57aaf051690b99f3d2fea939aa8ad80"}]}],"toggled":true},{"name":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","path":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","sha":"ae586c0fe830819580e1009d41a9074f16e65bed"},{"name":"test","children":[{"name":"README.md","path":"test/README.md","sha":"f798bda8aed01240778826ec33d91a059f52acde"},{"name":"acm_tls_certificate_test.go","path":"test/acm_tls_certificate_test.go","sha":"f83e2cfc10b90ed90481122640aa8ba001b81eb9"},{"name":"go.mod","path":"test/go.mod","sha":"338526fe490cca0c259cd7550f9985a5adbee43d"},{"name":"go.sum","path":"test/go.sum","sha":"15d7d1f1ed80cb690998c0639da15c981a2db472"},{"name":"lb_listener_rules_test.go","path":"test/lb_listener_rules_test.go","sha":"ac221391256ca51748c6b33fed3cf41b55521a86"},{"name":"lb_test.go","path":"test/lb_test.go","sha":"38c1e2bc106941a9c455fe6bb2686715050f5d16"},{"name":"test_helpers.go","path":"test/test_helpers.go","sha":"1de788f3eae7c13dab153d103cc1a68a53536467"},{"name":"upgrades","children":[{"name":"upgrade_test.go","path":"test/upgrades/upgrade_test.go","sha":"bec22b77e8b7281b33b90a5364e3fc101656b527"}]},{"name":"validation","children":[{"name":"validate_all_modules_and_examples_test.go","path":"test/validation/validate_all_modules_and_examples_test.go","sha":"33d73c385b64c4fc870033e99427e683c31dc45a"}]}]}]},"detailsContent":"<h1 class=\"preview__body--title\" id=\"acm-tls-certificate\">ACM TLS Certificate</h1><div class=\"preview__body--border\"></div><p>This module can be used to issue and validate free, auto-renewing TLS certificates using <a href=\"https://aws.amazon.com/certificate-manager/\" class=\"preview__body--description--blue\" target=\"_blank\">AWS Certificate\nManager (ACM)</a>. It supports issuing and validating multiple ACM certificates.</p>\n<p>The module will create the TLS certificates, as well as\nthe DNS records to validate them, and output the certificates' ARNs so you can use them with other resources, such as ALBs, CloudFront, and API Gateway.</p>\n<h2 class=\"preview__body--subtitle\" id=\"understanding-how-acm-certificates-are-programmatically-requested-and-verified\">Understanding how ACM certificates are programmatically requested and verified</h2>\n<p>This module supports ordering and programmatically validating, via DNS records that are written to a public Route53 zone, ACM certificates.</p>\n<p>To understand the Route53 certificate ordering and DNS validation process in more detail, consult <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html\" class=\"preview__body--description--blue\" target=\"_blank\">the AWS documentation</a>.\nThe DNS validation scheme is preferred over the alternative email validation scheme, because the DNS scheme can be orchestrated end to end via Terraform, which this module does for you.</p>\n<p>At a high level, the process involves:</p>\n<ol>\n<li>Requesting a certificate for a given domain name such as example.com.</li>\n<li>Receiving the challenge records provided by AWS, which ask you to prove ownership of the domain by writing a programmatically generated CNAME record to the Route53 public hosted zone associated with example.com. The provided challenge CNAME record will consist of the CNAME record name and a record value.</li>\n<li>The Route53 public hosted zone must be created if it does not already exist, so that any records written to it will resolve via external DNS queries.</li>\n<li>Upon writing the challenge record and its value to the public Route53 hosted zone, programmatically initiate the validation process, whereby AWS will query your Route53 zone for the challenge record, ensure it resolves, and that its value is the exact value supplied in the original challenge. Note that these queries must resolve over public DNS, so you can test them yourself:\n<code>dig _a79865eb4cd1a6ab990a45779b4e0b96.example.com. cname</code></li>\n<li>Once AWS is able to verify that the records resolve correctly and with the expected values, it will convert your certificate from a <code>pending</code> status to an <code>issued</code> status.</li>\n</ol>\n<p>This module is capable of handling these steps for you, so that you need only supply the correct input map of desired certificates via <code>var.acm_tls_certificates</code>.</p>\n<h2 class=\"preview__body--subtitle\" id=\"how-to-request-wildcard-certificates\">How to request wildcard certificates</h2>\n<p>To provision a wildcard certificate for example.com, you would create the following <code>acm_tls_certificates</code> input, using the <code>subject_alternative_names</code>\nfield to specify the domain prefixed with <code>*.</code>, e.g., <code>*.example.com</code>:</p>\n<pre><span class=\"hljs-comment\"># Example of a simple wildcard certificate that protects BOTH example.com and the first level of subdomains</span>\n<span class=\"hljs-comment\"># such as test.example.com, mail.example.com, etc</span>\nacm_tls_certificates = {\n <span class=\"hljs-string\">\"example.com\"</span> = {\n subject_alternative_names = [<span class=\"hljs-string\">\"*.example.com\"</span>]\n tags = {\n Environment = <span class=\"hljs-string\">\"stage\"</span>\n run_destroy_check = true\n }\n create_verification_record = true\n verify_certificate = true\n }\n }\n</pre>\n<p>Here's an example of requesting a wildcard certificate for the next level down of subdomains:</p>\n<pre>\n<span class=\"hljs-comment\"># Example of provisioning a wildcard certificate that protects BOTH test.example.com and mail.test.example.com,</span>\n<span class=\"hljs-comment\"># db.test.example.com, etc</span>\nacm_tls_certificates = {\n <span class=\"hljs-string\">\"test.example.com\"</span> = {\n subject_alternative_names = [<span class=\"hljs-string\">\"*.test.example.com\"</span>]\n tags = {\n Environment = <span class=\"hljs-string\">\"stage\"</span>\n run_destroy_check = true\n }\n create_verification_record = true\n verify_certificate = true\n }\n }\n</pre>\n<h2 class=\"preview__body--subtitle\" id=\"requesting-a-certificate-for-a-domain-that-doesnt-match-its-hosted-zone-name\">Requesting a certificate for a domain that doesn't match its hosted zone name</h2>\n<p>If you are requesting a a certificate for domain X, but you're attaching it to a hosted zone that is NOT named X you must specify the <code>hosted_zone_id</code> of the target hosted zone in the <code>var.acm_tls_certificates</code> input.</p>\n<p>For example, if you are requesting a certificate for <code>test-29283.example.com</code>, but you are attaching it to the public zone named <code>example.com</code>, then you MUST provide the <code>hosted_zone_id</code> for the example.com public zone in your <code>var.acm_tls_certificates</code> input map.</p>\n<p>Recall that, because of how the programmatic DNS validation scheme works <a href=\"#understanding-how-acm-certificates-are-programmatically-requested-and-verified\" class=\"preview__body--description--blue\">outlined above</a>, you need the DNS validation challenge records that will be generated for your requessted <code>test-29283.example.com</code> to resolve via public DNS queries, and therefore you need to write their records to the <code>example.com</code> hosted zone. Therefore you would provide the <code>hosted_zone_id</code> of <code>example.com</code> in your input map as in the following example:</p>\n<pre><span class=\"hljs-attr\">acm_tls_certificates</span> = {\n <span class=\"hljs-string\">\"test-29283.example.com\"</span> = {\n <span class=\"hljs-attr\">subject_alternative_names</span> = [<span class=\"hljs-string\">\"*.test.example.com\"</span>]\n <span class=\"hljs-attr\">tags</span> = {\n <span class=\"hljs-attr\">Environment</span> = <span class=\"hljs-string\">\"stage\"</span>\n <span class=\"hljs-attr\">run_destroy_check</span> = <span class=\"hljs-literal\">true</span>\n }\n <span class=\"hljs-attr\">create_verification_record</span> = <span class=\"hljs-literal\">true</span>\n <span class=\"hljs-attr\">verify_certificate</span> = <span class=\"hljs-literal\">true</span>\n <span class=\"hljs-comment\"># This is the ID of the public zone example.com</span>\n <span class=\"hljs-attr\">hosted_zone_id</span> = <span class=\"hljs-string\">\"Z04542822CKAS2ZFBUGT\"</span>\n }\n }\n</pre>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-you-use-this-module\">How do you use this module?</h2>\n<ul>\n<li>See the <a href=\"/repos/v0.29.3/module-load-balancer/README.md\" class=\"preview__body--description--blue\">root README</a> for instructions on using Terraform modules.</li>\n<li>See the <a href=\"/repos/v0.29.3/module-load-balancer/examples\" class=\"preview__body--description--blue\">examples</a> folder for example usage.</li>\n<li>See <a href=\"/repos/v0.29.3/module-load-balancer/modules/acm-tls-certificate/vars.tf\" class=\"preview__body--description--blue\">vars.tf</a> for all the variables you can set on this module.</li>\n</ul>\n<h2 class=\"preview__body--subtitle\" id=\"special-handling-for-use-with-api-gateway\">Special handling for use with API Gateway</h2>\n<p>If you are using this module to create a TLS certificate that will be used with API Gateway, along with a custom\ndomain name, then you need to set a tag named exactly <code>run_destroy_check</code> with a value of <code>true</code>. Do this for every certificate you configure that will be used in this way:</p>\n<pre>module <span class=\"hljs-string\">\"cert\"</span> {\n <span class=\"hljs-attr\">source</span> = <span class=\"hljs-string\">\"git::git@github.com:gruntwork-io/terraform-aws-load-balancer.git//modules/acm-tls-certificate?ref=v0.13.2\"</span>\n \n <span class=\"hljs-comment\"># ... other params ommitted ...</span>\n \n <span class=\"hljs-attr\">acm_tls_certificates</span> = {\n <span class=\"hljs-string\">\"mail.example.com\"</span> = {\n <span class=\"hljs-attr\">subject_alternative_names</span> = [<span class=\"hljs-string\">\"mailme.example.com\"</span>]\n <span class=\"hljs-attr\">tags</span> = {\n <span class=\"hljs-attr\">Environment</span> = <span class=\"hljs-string\">\"stage\"</span>\n <span class=\"hljs-attr\">run_destroy_check</span> = <span class=\"hljs-literal\">true</span>\n }\n <span class=\"hljs-attr\">create_verification_record</span> = <span class=\"hljs-literal\">true</span>\n <span class=\"hljs-attr\">verify_certificate</span> = <span class=\"hljs-literal\">true</span>\n }\n <span class=\"hljs-string\">\"admin.example.com\"</span> = {\n <span class=\"hljs-attr\">subject_alternative_names</span> = [<span class=\"hljs-string\">\"restricted.example.com\"</span>]\n <span class=\"hljs-attr\">tags</span> = {\n <span class=\"hljs-attr\">Something</span> = <span class=\"hljs-string\">\"else\"</span>\n <span class=\"hljs-attr\">run_destroy_check</span> = <span class=\"hljs-literal\">true</span>\n }\n <span class=\"hljs-attr\">create_verification_record</span> = <span class=\"hljs-literal\">true</span>\n <span class=\"hljs-attr\">verify_certificate</span> = <span class=\"hljs-literal\">true</span>\n }\n }\n \n <span class=\"hljs-comment\"># ... other params ommitted ...</span>\n}\n</pre>\n<p>Without this, <code>terraform destroy</code> will fail. This is because you can't delete an ACM cert while it's in use,\ndeleting a custom domain name mapping for API Gateway takes 10 - 30 minutes, and Terraform only waits a max of 10\nminutes to delete the cert, so it times out and exits with an error every time. The <code>run_destroy_check</code> tells this\nmodule to run a script that waits until the cert is no longer in use.</p>\n<p>Two notes about this script:</p>\n<ol>\n<li>You must install the <a href=\"https://aws.amazon.com/cli/\" class=\"preview__body--description--blue\" target=\"_blank\">AWS CLI</a> to use it.</li>\n<li>The script is written in Bash, so it will not work on Windows versions earlier than Windows 10, which supports a Linux Bash shell.</li>\n</ol>\n<h2 class=\"preview__body--subtitle\" id=\"a-note-on-the-dependency-getter-pattern-implementing-module-depends\">A note on the dependency_getter pattern implementing module_depends</h2>\n<p>This module uses a <a href=\"/repos/terraform-aws-load-balancer/modules/acm-tls-certificate/main.tf#L15\" class=\"preview__body--description--blue\">null_resource</a> named <code>dependency_getter</code> to effectively implement <code>depends_on</code> at the module level. This is a temporary workaround as Terraform does not yet natively support <code>depends_on</code> at the module level. You can also see <a href=\"https://github.com/hashicorp/terraform/issues/1178\" class=\"preview__body--description--blue\" target=\"_blank\">this Terraform issue on GitHub</a> for more discussion.</p>\n<p>Here's how this works. First, we create <a href=\"/repos/terraform-aws-load-balancer/modules/acm-tls-certificate/vars.tf#L124\" class=\"preview__body--description--blue\">this optional dependencies variable</a> for the current module, which accepts a list of strings, but defaults to an empty list. The <code>null_resource</code> linked above does a simple join on the dependencies list, if present. Every resource within this module also <code>depends_on</code> this <code>null_resource.dependency_getter</code>(even though it's creating no resources).</p>\n<p>This has the desirable effect of causing the dependency graph that Terraform builds to look as you'd expect if there were in fact native support for <code>depends_on</code> at the module level. Let's say you had a separate Terraform module that needed to consume this current module in order to generate certificates, but you wanted this certificates module to wait to do any of its work until some of the outputs from the resources in your parent module were ready. In that case, you could pass those outputs into this module's <code>dependencies</code> variable, like so:</p>\n<pre><span class=\"hljs-comment\"># ---------------------------------------------------------------------------------------------------------------------</span>\n<span class=\"hljs-comment\"># CREATE PUBLIC HOSTED ZONE(S)</span>\n<span class=\"hljs-comment\"># ---------------------------------------------------------------------------------------------------------------------</span>\n\n<span class=\"hljs-keyword\">module</span> <span class=\"hljs-string\">\"acm-tls-certificates\"</span> {\n <span class=\"hljs-comment\"># When using these modules in your own repos, you will need to use a Git URL with a ref attribute that pins you</span>\n <span class=\"hljs-comment\"># to a specific version of the modules, such as the following example:</span>\n <span class=\"hljs-comment\"># source = \"git::git@github.com:gruntwork-io/terraform-aws-load-balancer.git//modules/acm-tls-certificate?ref=v0.19.0\"</span>\n\n source = <span class=\"hljs-string\">\"git::git@github.com:gruntwork-io/terraform-aws-load-balancer.git//modules/acm-tls-certificate?ref=v0.20.0\"</span>\n acm_tls_certificates = local.acm_tls_certificates\n\n <span class=\"hljs-comment\"># Workaround Terraform limitation where there is no module depends_on.</span>\n <span class=\"hljs-comment\"># See https://github.com/hashicorp/terraform/issues/1178 for more details.</span>\n <span class=\"hljs-comment\"># This effectively draws an explicit dependency between the public </span>\n <span class=\"hljs-comment\"># and private zones managed here and the ACM certificates that will be optionally </span>\n <span class=\"hljs-comment\"># provisioned for them </span>\n dependencies = flatten([values(aws_route53_zone.public_zones).*.name_servers])\n}\n</pre>\n<p>In this example, the <code>acm-tls-certificates</code> module will "wait" until your <code>aws_route53_zone.public_zones</code> resources have been successfully provisioned.</p>\n","repoName":"module-load-balancer","repoRef":"v0.29.2","serviceDescriptor":{"serviceName":"Elastic Load Balancer (ELB)","serviceRepoName":"module-load-balancer","serviceRepoOrg":"gruntwork-io","cloudProviders":["aws"],"description":"Deploy the Application Load Balancer (ALB) for load balancing HTTP and HTTPS, with support for routing rules and WebSockets.","imageUrl":"elastic.png","licenseType":"subscriber","technologies":["Terraform"],"compliance":[],"tags":[""]},"serviceCategoryName":"Networking","fileName":"README.md","filePath":"/modules/acm-tls-certificate","title":"Repo Browser: Elastic Load Balancer (ELB)","description":"Browse the repos in the Gruntwork Infrastructure as Code Library."}
.circleci
main.tf
