Terraform with API-Gateway, Route53, and SSL Certification interdependency problem2019 Community Moderator ElectionHow to create an SSL AWS API Gateway endpoint with custom domain?How to specify a ACM certificate in a specific region for a data source?Routing to API gateway using AWS Route 53Using custom domain for aws api gateway endpoint in mumbaiaws cloudfront api endpoint responding with Forbidden(403)AWS API gateway High Availability setup in us-east-1 and us-east-2API Gateway - Invalid certificate chain when using regional and custom domain namesAPI Gateway + GovCloud + Custom Domain Name with SSL CertTerraform AWS ACM certificates in us-east-1 for resources in eu-west-1Custom domain name for API Gateway terraform
How to explain that I do not want to visit a country due to personal safety concern?
How to terminate ping <dest> &
Employee lack of ownership
Why do passenger jet manufacturers design their planes with stall prevention systems?
Why doesn't using two cd commands in bash script execute the second command?
How Could an Airship Be Repaired Mid-Flight
If I can solve Sudoku can I solve Travelling Salesman Problem(TSP)? If yes, how?
Why do Australian milk farmers need to protest supermarkets' milk price?
Why doesn't the EU now just force the UK to choose between referendum and no-deal?
Interplanetary conflict, some disease destroys the ability to understand or appreciate music
How to deal with taxi scam when on vacation?
Is a party consisting of only a bard, a cleric, and a warlock functional long-term?
What options are left, if Britain cannot decide?
Dice rolling probability game
Existence of subset with given Hausdorff dimension
How to make healing in an exploration game interesting
What's the meaning of “spike” in the context of “adrenaline spike”?
how to write formula in word in latex
How to use deus ex machina safely?
Professor being mistaken for a grad student
A Cautionary Suggestion
Is it possible to upcast ritual spells?
Can I use USB data pins as power source
Most cost effective thermostat setting: consistent temperature vs. lowest temperature possible
Terraform with API-Gateway, Route53, and SSL Certification interdependency problem
2019 Community Moderator ElectionHow to create an SSL AWS API Gateway endpoint with custom domain?How to specify a ACM certificate in a specific region for a data source?Routing to API gateway using AWS Route 53Using custom domain for aws api gateway endpoint in mumbaiaws cloudfront api endpoint responding with Forbidden(403)AWS API gateway High Availability setup in us-east-1 and us-east-2API Gateway - Invalid certificate chain when using regional and custom domain namesAPI Gateway + GovCloud + Custom Domain Name with SSL CertTerraform AWS ACM certificates in us-east-1 for resources in eu-west-1Custom domain name for API Gateway terraform
I can't seem to get an SSL certificate from ACM working on API-Gateway, Route53, using terraform. There seems to be an interdependency problem.
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
lifecycle
create_before_destroy = true
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$aws_route53_record.sub_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
The problem appears to be that:
- aws_api_gateway_domain_name requires aws_acm_certificate
- aws_acm_certificate has to be validated, so step 3
- aws_route53_record.cert_validation requires aws_route53_record.sub_domain
- aws_route53_record.subdomain requires aws_api_gateway_domain_name
- Go to 1
Everytime I try to use the configuration given, I get the following error:
aws_api_gateway_domain_name.domain_name: Error creating API Gateway
Domain Name: BadRequestException: Unable to associate certificate
arn:aws:acm:us-east-1:yyyy:certificate/zzzz with CloudFront. This
error may prevent the domain name audit-log.taspli.com from being used
in API Gateway for up to 40 minutes. Please ensure the certificate
domain name matches the requested domain name, and that this user has
permission to call cloudfront:UpdateDistribution on '*' resources.
status code: 400, request id: xxxx
amazon-web-services aws-api-gateway terraform amazon-route53 terraform-provider-aws
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
add a comment |
I can't seem to get an SSL certificate from ACM working on API-Gateway, Route53, using terraform. There seems to be an interdependency problem.
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
lifecycle
create_before_destroy = true
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$aws_route53_record.sub_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
The problem appears to be that:
- aws_api_gateway_domain_name requires aws_acm_certificate
- aws_acm_certificate has to be validated, so step 3
- aws_route53_record.cert_validation requires aws_route53_record.sub_domain
- aws_route53_record.subdomain requires aws_api_gateway_domain_name
- Go to 1
Everytime I try to use the configuration given, I get the following error:
aws_api_gateway_domain_name.domain_name: Error creating API Gateway
Domain Name: BadRequestException: Unable to associate certificate
arn:aws:acm:us-east-1:yyyy:certificate/zzzz with CloudFront. This
error may prevent the domain name audit-log.taspli.com from being used
in API Gateway for up to 40 minutes. Please ensure the certificate
domain name matches the requested domain name, and that this user has
permission to call cloudfront:UpdateDistribution on '*' resources.
status code: 400, request id: xxxx
amazon-web-services aws-api-gateway terraform amazon-route53 terraform-provider-aws
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domainis false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.
– Michael - sqlbot
Mar 7 at 9:33
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56
add a comment |
I can't seem to get an SSL certificate from ACM working on API-Gateway, Route53, using terraform. There seems to be an interdependency problem.
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
lifecycle
create_before_destroy = true
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$aws_route53_record.sub_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
The problem appears to be that:
- aws_api_gateway_domain_name requires aws_acm_certificate
- aws_acm_certificate has to be validated, so step 3
- aws_route53_record.cert_validation requires aws_route53_record.sub_domain
- aws_route53_record.subdomain requires aws_api_gateway_domain_name
- Go to 1
Everytime I try to use the configuration given, I get the following error:
aws_api_gateway_domain_name.domain_name: Error creating API Gateway
Domain Name: BadRequestException: Unable to associate certificate
arn:aws:acm:us-east-1:yyyy:certificate/zzzz with CloudFront. This
error may prevent the domain name audit-log.taspli.com from being used
in API Gateway for up to 40 minutes. Please ensure the certificate
domain name matches the requested domain name, and that this user has
permission to call cloudfront:UpdateDistribution on '*' resources.
status code: 400, request id: xxxx
amazon-web-services aws-api-gateway terraform amazon-route53 terraform-provider-aws
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
I can't seem to get an SSL certificate from ACM working on API-Gateway, Route53, using terraform. There seems to be an interdependency problem.
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
lifecycle
create_before_destroy = true
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$aws_route53_record.sub_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
The problem appears to be that:
- aws_api_gateway_domain_name requires aws_acm_certificate
- aws_acm_certificate has to be validated, so step 3
- aws_route53_record.cert_validation requires aws_route53_record.sub_domain
- aws_route53_record.subdomain requires aws_api_gateway_domain_name
- Go to 1
Everytime I try to use the configuration given, I get the following error:
aws_api_gateway_domain_name.domain_name: Error creating API Gateway
Domain Name: BadRequestException: Unable to associate certificate
arn:aws:acm:us-east-1:yyyy:certificate/zzzz with CloudFront. This
error may prevent the domain name audit-log.taspli.com from being used
in API Gateway for up to 40 minutes. Please ensure the certificate
domain name matches the requested domain name, and that this user has
permission to call cloudfront:UpdateDistribution on '*' resources.
status code: 400, request id: xxxx
amazon-web-services aws-api-gateway terraform amazon-route53 terraform-provider-aws
amazon-web-services aws-api-gateway terraform amazon-route53 terraform-provider-aws
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
asked Mar 6 at 19:52
Christopher ThomasChristopher Thomas
2,25022231
2,25022231
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domainis false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.
– Michael - sqlbot
Mar 7 at 9:33
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56
add a comment |
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domainis false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.
– Michael - sqlbot
Mar 7 at 9:33
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domain is false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.– Michael - sqlbot
Mar 7 at 9:33
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domain is false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.– Michael - sqlbot
Mar 7 at 9:33
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56
add a comment |
1 Answer
1
active
oldest
votes
I seem to have fixed the problem by adding the certificate validation records to the root domain instead of the sub domain. Therefore breaking the cyclic dependency.
The problem appears to be that the sub domain can't be created without the certificate and the certificate can't be validated without the sub domain. So the situation is stuck and unresolvable.
You could manually create the sub domain, but then whats the point in automation if you have to make manual efforts to solve problems.
So I tried adding the cert validation records to the root. Suddenly it starts to work, because the root domain is something that is created externally to the project. A sort of global infrastructure project which can be handled externally. Then your individual projects can hang off of that infrastructure on a case-by-case basis.
Here is the terraform configuration which worked:
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
timeouts
create = "45m"
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55031167%2fterraform-with-api-gateway-route53-and-ssl-certification-interdependency-probl%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I seem to have fixed the problem by adding the certificate validation records to the root domain instead of the sub domain. Therefore breaking the cyclic dependency.
The problem appears to be that the sub domain can't be created without the certificate and the certificate can't be validated without the sub domain. So the situation is stuck and unresolvable.
You could manually create the sub domain, but then whats the point in automation if you have to make manual efforts to solve problems.
So I tried adding the cert validation records to the root. Suddenly it starts to work, because the root domain is something that is created externally to the project. A sort of global infrastructure project which can be handled externally. Then your individual projects can hang off of that infrastructure on a case-by-case basis.
Here is the terraform configuration which worked:
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
timeouts
create = "45m"
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
add a comment |
I seem to have fixed the problem by adding the certificate validation records to the root domain instead of the sub domain. Therefore breaking the cyclic dependency.
The problem appears to be that the sub domain can't be created without the certificate and the certificate can't be validated without the sub domain. So the situation is stuck and unresolvable.
You could manually create the sub domain, but then whats the point in automation if you have to make manual efforts to solve problems.
So I tried adding the cert validation records to the root. Suddenly it starts to work, because the root domain is something that is created externally to the project. A sort of global infrastructure project which can be handled externally. Then your individual projects can hang off of that infrastructure on a case-by-case basis.
Here is the terraform configuration which worked:
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
timeouts
create = "45m"
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
add a comment |
I seem to have fixed the problem by adding the certificate validation records to the root domain instead of the sub domain. Therefore breaking the cyclic dependency.
The problem appears to be that the sub domain can't be created without the certificate and the certificate can't be validated without the sub domain. So the situation is stuck and unresolvable.
You could manually create the sub domain, but then whats the point in automation if you have to make manual efforts to solve problems.
So I tried adding the cert validation records to the root. Suddenly it starts to work, because the root domain is something that is created externally to the project. A sort of global infrastructure project which can be handled externally. Then your individual projects can hang off of that infrastructure on a case-by-case basis.
Here is the terraform configuration which worked:
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
timeouts
create = "45m"
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
I seem to have fixed the problem by adding the certificate validation records to the root domain instead of the sub domain. Therefore breaking the cyclic dependency.
The problem appears to be that the sub domain can't be created without the certificate and the certificate can't be validated without the sub domain. So the situation is stuck and unresolvable.
You could manually create the sub domain, but then whats the point in automation if you have to make manual efforts to solve problems.
So I tried adding the cert validation records to the root. Suddenly it starts to work, because the root domain is something that is created externally to the project. A sort of global infrastructure project which can be handled externally. Then your individual projects can hang off of that infrastructure on a case-by-case basis.
Here is the terraform configuration which worked:
data "aws_route53_zone" "root_domain"
name = "$var.route53_root_domain_name"
private_zone = false
# The domain name to use with api-gateway
resource "aws_api_gateway_domain_name" "domain_name"
domain_name = "$var.route53_sub_domain_name"
certificate_arn = "$aws_acm_certificate.cert.arn"
resource "aws_route53_record" "sub_domain"
name = "$var.route53_sub_domain_name"
type = "A"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
alias
name = "$aws_api_gateway_domain_name.domain_name.cloudfront_domain_name"
zone_id = "$aws_api_gateway_domain_name.domain_name.cloudfront_zone_id"
evaluate_target_health = false
resource "aws_acm_certificate" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
domain_name = "$var.route53_sub_domain_name"
validation_method = "DNS"
resource "aws_route53_record" "cert_validation"
name = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_name"
type = "$aws_acm_certificate.cert.domain_validation_options.0.resource_record_type"
zone_id = "$data.aws_route53_zone.root_domain.zone_id"
records = ["$aws_acm_certificate.cert.domain_validation_options.0.resource_record_value"]
ttl = 60
resource "aws_acm_certificate_validation" "cert"
# api-gateway / cloudfront certificates need to use the us-east-1 region
provider = "aws.cloudfront-acm-certs"
certificate_arn = "$aws_acm_certificate.cert.arn"
validation_record_fqdns = ["$aws_route53_record.cert_validation.fqdn"]
timeouts
create = "45m"
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
answered Mar 10 at 10:04
Christopher ThomasChristopher Thomas
2,25022231
2,25022231
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55031167%2fterraform-with-api-gateway-route53-and-ssl-certification-interdependency-probl%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3. aws_route53_record.cert_validation requires aws_route53_record.sub_domainis false. It only requires the validation records, not the record for the subdomain that is the subject of the certificate. You can prove this for yourself by manually creating an DNS-validated ACM cert for a nonexistent subdomain in a working Route 53 hosted zone. The error message suggests only that the cert has not yet been validated, not that validation can't/won't succeed.– Michael - sqlbot
Mar 7 at 9:33
ah, so I can remove the zone_id field and then it'll succeed anyway? How would it know where to add the record as it's parent if not the domain I'm creating it on?
– Christopher Thomas
Mar 7 at 9:35
ok, so I validated my claim that the aws_route53_record for cert validation requires the zone_id. Therefore the zone the records are being attached to have to exist first before it can attach the records. This makes sense. The problem then is that the aws_route53_record for the sub domain where it's being attached needs the records from the api gateway domain name in order to attach the alias to the cloudfront distribution that api gateway creates. So again, it's just another cyclic dependency that I'm unsure how to resolve.
– Christopher Thomas
Mar 7 at 9:56