Package: acm-auto-validate
ACM Auto-Validate ConstructOverviewThe ACM Auto-Validate Construct is designed to automate the validation of AWS Certificate Manager (ACM) certificates using DNS validation, especially useful in continuous deployment pipelines. It handles the complexity of validating certificates in a hosted zone that resides in a different AWS account. This automation ensures that certificates requested during infrastructure deployment are validated promptly, allowing CloudFormation templates to proceed without waiting for manual intervention.Use CaseThis construct was initially created to support CDK-based deployment pipelines where certificates requested remained pending validation. By automating this step, it significantly reduces the deployment time and manual overhead, especially in cross-account DNS validation scenarios.FeaturesAutomated DNS Validation: Automates the creation and deletion of DNS records for ACM certificate validation.Cross-Account Support: Capable of handling DNS records in a hosted zone that is in a different AWS account.Event-Driven: Utilizes AWS Lambda and Amazon EventBridge to respond to certificate request events.SSM Parameter Tracking: Tracks the certificates processed using AWS Systems Manager Parameter Store. Note that SSM parameters are created in theus-east-1region, but this construct can be deployed to any region that supports ACM, Lambda, and EventBridge.PrerequisitesTwo AWS accounts: a source account where the ACM certificates are requested and a zone account where the hosted zone resides.IAM permissions to create necessary resources in both accounts.AWS CDK v2 installed.InstallationTo use this construct, install it from npm:npminstallacm-auto-validatePython installation:pipinstallacm-auto-validateUsageHere's an example of how to use these constructs in your CDK application:TypeScriptimport{ACMValidationConstruct,DnsValidationRoleConstruct}from'acm-auto-validate';import{App,Stack}from'aws-cdk-lib';constapp=newApp();//CreateastackintheaccountwherecertificateswillberequestedconstsourceStack=newStack(app,'SourceStack',{env:{account:'111111111111'}//sourceaccountID});//DeploytheACMvalidationconstructinthesourceaccountstacknewACMValidationConstruct(sourceStack,'ACMValidationConstruct',{rolePrefix:'prod',//mustmatchprefixusedinDnsValidationRoleConstructzoneAccountId:'222222222222',zoneName:'example.com',});//CreateastackintheaccountwherethezoneishostedconstzoneStack=newStack(app,'ZoneStack',{env:{account:'222222222222'}//zoneaccountID});//DeploytheDNSvalidationroleconstructinthezoneaccountstacknewDnsValidationRoleConstruct(zoneStack,'DnsValidationRoleConstruct',{rolePrefix:'prod',//mustmatchprefixusedinACMValidationConstructsourceAcctId:'111111111111',zoneAcctId:'222222222222',});Pythonfromaws_cdkimportApp,Stackfromacm_auto_validateimport(ACMValidationConstruct,DnsValidationRoleConstruct)app=App()# Create a stack in the account where certificates will be requestedsource_stack=Stack(app,'SourceStack',env={'account':'111111111111'})# Deploy the ACM validation construct in the source account stackACMValidationConstruct(source_stack,'ACMValidationConstruct',role_prefix='prod',# must match prefix used in DnsValidationRoleConstructzone_account_id='222222222222',zone_name='example.com')# Create a stack in the account where the zone is hostedzone_stack=Stack(app,'ZoneStack',env={'account':'222222222222'})# Deploy the DNS validation role construct in the zone account stackDnsValidationRoleConstruct(zone_stack,'DnsValidationRoleConstruct',role_prefix='prod',# must match prefix used in ACMValidationConstructsource_acct_id='111111111111',zone_acct_id='222222222222')app.synth()ConfigurationACMValidationConstruct: Deploys the Lambda function (written in Python) and EventBridge rule in the source account. Requires a rolePrefix (such as 'dev' or 'prod'; this is used for naming resources), the zone account ID and the zone name.DnsValidationRoleConstruct: Deploys the IAM role in the zone account, which the Lambda function assumes. Requires a rolePrefix (such as 'dev' or 'prod'; this is used for naming resources), the source account ID, and the zone account ID.ContributingContributions to this project are welcome. Please follow the standard procedures for submitting issues or pull requests.LicenseThis project is distributed under theApache License 2.0.