This component is responsible for requesting an ACM certificate for a domain and adding a CNAME record to the DNS zone to complete certificate validation.
The ACM component is to manage an unlimited number of certificates, predominantly for vanity domains. While the dns-primary component has the ability to generate ACM certificates, it is very opinionated and can only manage one zone. In reality, companies have many branded domains associated with a load balancer, so we need to be able to generate more complicated certificates.
We have, as a convenience, the ability to create an ACM certificate as part of creating a DNS zone, whether primary or delegated. That convenience is limited to creating
*.example.com when creating a zone for
example.com. For example, Acme has delegated
acct.acme.com and in addition to
*.acct.acme.com needed an ACM certificate for
*.usw2.acct.acme.com, so we use the ACM component to provision that, rather than extend the DNS primary or delegated components to take a list of additional certificates. Both are different views on the Single Responsibility Principle.
Stack Level: Global or Regional
Here's an example snippet for how to use this component.
# NOTE: The following subject alternative name is automatically added by the module.
# Additional entries can be added by providing this input.
# - "*.acme.com"
ACM using a private CA
|additional_tag_map||Additional key-value pairs to add to each map in |
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.
|attributes||ID element. Additional attributes (e.g. |
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the
and treated as a single ID element.
|certificate_authority_component_key||Use this component key e.g. ||no|
|certificate_authority_component_name||Use this component name to read from the remote state to get the certificate_authority_arn if using an authority type of SUBORDINATE||no|
|certificate_authority_enabled||Whether to use the certificate authority or not||no|
|certificate_authority_environment_name||Use this environment name to read from the remote state to get the certificate_authority_arn if using an authority type of SUBORDINATE||no|
|certificate_authority_stage_name||Use this stage name to read from the remote state to get the certificate_authority_arn if using an authority type of SUBORDINATE||no|
|context||Single object for setting entire context at once.|
See description of individual variables for details.
Leave string and numeric variables as
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
|delimiter||Delimiter to be used between ID elements.|
|descriptor_formats||Describe additional descriptors to be output in the |
Map of maps. Keys are names of descriptors. Values are maps of the form
Label values will be normalized before being passed to
identical to how they appear in
|dns_delegated_component_name||Use this component name to read from the remote state to get the dns_delegated zone ID||no|
|dns_delegated_environment_name||Use this environment name to read from the remote state to get the dns_delegated zone ID||no|
|dns_delegated_stage_name||Use this stage name to read from the remote state to get the dns_delegated zone ID||no|
|dns_private_zone_enabled||Whether to set the zone to public or private||no|
|domain_name||Root domain name||no|
|domain_name_prefix||Root domain name prefix to use with DNS delegated remote state||no|
|enabled||Set to false to prevent the module from creating any resources||no|
|environment||ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'||no|
Does not affect
|label_key_case||Controls the letter case of the |
Does not affect keys of tags passed in via the
|label_order||The order in which the labels (ID elements) appear in the |
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
|label_value_case||Controls the letter case of ID elements (labels) as included in |
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the
Set this to
|labels_as_tags||Set of labels (ID elements) to include as tags in the |
Default is to include all labels.
Tags with empty values will not be included in the
The value of the
changed in later chained modules. Attempts to change it will be silently ignored.
|name||ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.|
This is the only ID element not also included as a
The "name" tag is set to the full
|namespace||ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique||no|
|process_domain_validation_options||Flag to enable/disable processing of the record to add to the DNS zone to complete certificate validation||no|
|regex_replace_chars||Terraform regular expression (regex) string.|
Characters matching the regex will be removed from the ID elements.
If not set,
|stage||ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'||no|
|subject_alternative_names||A list of domains that should be SANs in the issued certificate||no|
|subject_alternative_names_prefixes||A list of domain prefixes to use with DNS delegated remote state that should be SANs in the issued certificate||no|
|tags||Additional tags (e.g. |
Neither the tag keys nor the tag values will be modified by this module.
|tenant||ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for||no|
|validation_method||Method to use for validation, DNS or EMAIL||no|
|zone_name||Name of the zone in which to place the DNS validation records to validate the certificate.|
Typically a domain name. Default of
|arn||The ARN of the certificate|
|domain_name||Certificate domain name|
|domain_validation_options||CNAME records that are added to the DNS zone to complete certificate validation|
|id||The ID of the certificate|
- cloudposse/terraform-aws-components - Cloud Posse's upstream component