Package: renovosolutions.aws-cdk-certbot
cdk-library-certbotA CDK Construct Library to automate the creation and renewal of Let's Encrypt certificates.FeaturesCreates a lambda function that utilizes Certbot to request a certificate from Let's EncryptUploads the resulting certificate data to S3 for later retrievalImports the certificate to AWS Certificate Manager for tracking expirationCreates a trigger to re-run and re-new if the cert will expire in the next 30 days (customizable)API DocSeeAPIReferencesOriginal [gist](# Modified from original gisthttps://gist.github.com/arkadiyt/5d764c32baa43fc486ca16cb8488169a) that was modified for the Lambda codeExamplesThis construct utilizes a Route 53 hosted zone lookup so it will require that your stack has [environment variables set for account and region](Seehttps://docs.aws.amazon.com/cdk/latest/guide/environments.htmlfor more details.).TypescriptTypescript with Default Setupimport*ascdkfrom'@aws-cdk/core';import{Certbot}from'@renovosolutions/cdk-library-certbot';import{Architecture}from'@aws-cdk/aws-lambda';exportclassCdkExampleCertsStackextendscdk.Stack{constructor(scope:cdk.Construct,id:string,props?:cdk.StackProps){super(scope,id,props);letdomains=['example.com','www.example.com']newCertbot(this,'cert',{letsencryptDomains:domains.join(','),letsencryptEmail:'webmaster+letsencrypt@example.com',hostedZoneNames:['example.com']})}}Typescript with alternate storage location (Secrets Manager)import*ascdkfrom'@aws-cdk/core';import{Certbot,CertificateStorageType}from'@renovosolutions/cdk-library-certbot';import{Architecture}from'@aws-cdk/aws-lambda';exportclassCdkExampleCertsStackextendscdk.Stack{constructor(scope:cdk.Construct,id:string,props?:cdk.StackProps){super(scope,id,props);letdomains=['example.com','www.example.com']newCertbot(this,'cert',{letsencryptDomains:domains.join(','),letsencryptEmail:'webmaster+letsencrypt@example.com',hostedZoneNames:['example.com']certificateStorage:CertificateStorageType.SECRETS_MANAGER//OptionalpathsecretsManagerPath:'/path/to/secret/'})}}Typescript with alternate storage location (Parameter Store)import*ascdkfrom'@aws-cdk/core';import{Certbot,CertificateStorageType}from'@renovosolutions/cdk-library-certbot';import{Architecture}from'@aws-cdk/aws-lambda';exportclassCdkExampleCertsStackextendscdk.Stack{constructor(scope:cdk.Construct,id:string,props?:cdk.StackProps){super(scope,id,props);letdomains=['example.com','www.example.com']newCertbot(this,'cert',{letsencryptDomains:domains.join(','),letsencryptEmail:'webmaster+letsencrypt@example.com',hostedZoneNames:['example.com']certificateStorage:CertificateStorageType.SSM_SECURE//OptionalpathssmSecurePath:'/path/to/secret/'})}}Typescript with zone creation in the same stackimport*ascdkfrom'@aws-cdk/core';import*asroute53from'@aws-cdk/aws_route53';import{Certbot}from'@renovosolutions/cdk-library-certbot';import{Architecture}from'@aws-cdk/aws-lambda';exportclassCdkExampleCertsStackextendscdk.Stack{constructor(scope:cdk.Construct,id:string,props?:cdk.StackProps){super(scope,id,props);consthostedZone=newr53.HostedZone(this,'authZone',{zoneName:'auth.example.com',});letdomains=['example.com','www.example.com','auth.example.com']newCertbot(this,'cert',{letsencryptDomains:domains.join(','),letsencryptEmail:'webmaster+letsencrypt@example.com',hostedZoneNames:['example.com'],hostedZones:[hostedZone,]})}}Pythonfromaws_cdkimport(coreascdk)fromcertbotimportCertbotclassCdkExampleCertsStack(cdk.Stack):def__init__(self,scope:cdk.Construct,construct_id:str,**kwargs)->None:super().__init__(scope,construct_id,**kwargs)Certbot(self,"certbot",letsencrypt_email="webmaster+letsencrypt@example.com",letsencrypt_domains="example.com",hosted_zone_names=["example.com"])Testing the handler in this projectSet up a python virtual env withpython3.10 -m venv .venvUse the virtual env withsource .venv/bin/activateInstall dependencies withpip install -r function/tests/requirements.txtRunpytest -vThe testing usingmototo mock AWS services and verify the function does what is expected for each given storage type.