Package: troposphere-dns-certificate
Cloudformation DNS Validated Certificate ResourceThis is a cloudformation custom resource which is an enhancement of theAWS::CertificateManager::Certificateresource.It allows creating a certificate in a region different from the stack's region (e.g.us-east-1for cloudfront),
and allows for creating a certificate for a Route 53 hosted zone in another AWS account.
It also allows for setting the key algorithm.UsageTo use this custom resource, copy the CustomAcmCertificateLambda and CustomAcmCertificateLambdaExecutionRole resources
into your template. You can then create certificate resources of Type:Custom::DNSCertificate.This resource is also available as troposphere extension, in thetroposphere-dns-certificatepackageRemember to add a ServiceToken property to the resource which references the CustomAcmCertificateLambda arn.
Certificates may take up to 30 minutes to be issued, but typically takes ~3 minutes. The Certificate resource remains as
CREATE_IN_PROGRESS until the certificate is issued.Differences from AWS::CertificateManager::CertificateIt should behave similarly toAWS::CertificateManager::Certificate,
except for the differences described here.The additionalRegionproperty can be used to set the region to create the certificate in.TheDomainValidationOptionhas a additional propertiesRoute53RoleArnandRoute53RoleExternalIdwhich allow assuming a role before creating DNS validation records.
This lets you create a certificate for a hosted zone in another account.The additionalKeyAlgorithmproperty allows setting the key algorithm used to generate the key pair used by the certificate.Certificate ResourceSyntaxType:Custom::DNSCertificateProperties:DomainName:StringDomainValidationOptions:-DomainValidationOptionSubjectAlternativeNames:-StringTags:-Resource TagValidationMethod:StringRegion:StringCertificateTransparencyLoggingPreference:StringKeyAlgorithm:StringServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'PropertiesDomainNameFully qualified domain name (FQDN) to issue the certificate for. Use an asterisk as a wildcard.Required: YesType: StringUpdate requires:ReplacementDomainValidationOptionsInformation for validating domain ownership. A DomainValidationOption should be present for the DomainName and all
SubjectAlternativeNames. A DomainValidationOption for a parent domain can be used for names that have the same HostedZoneId.Required: YesType: List ofDomainValidationOptionUpdate requires:Replacementif a HostedZoneId changesSubjectAlternativeNamesFQDNs to include in the Subject Alternative Name of the certificate.Required: NoType: List of String valuesUpdate requires:ReplacementTagsTags for this certificateRequired: NoType:Resource TagUpdate requires:No interruptionValidationMethodMethod to use to validate domain ownership. This should beDNS.Required: NoDefault:EMAILType: StringUpdate requires:ReplacementRegionThe region to create the certificate in.Required: NoDefault: The Stack's regionType: StringUpdate requires:ReplacementCertificateTransparencyLoggingPreferenceCertificate Transparency Logging Preference. This may be 'ENABLED' or 'DISABLED'.Required: NoDefault:ENABLEDType: StringUpdate requires:No interruptionKeyAlgorithmThe algorithm that will be used to generate the key pair used by the certificate.
Currently, this may beRSA_2048,EC_prime256v1, orEC_secp384r1for new certificates.:warning: Not all algorithms are supported by all clients, AWS services or regions.Required: NoDefault:RSA_2048Type: StringUpdate requires:ReplacementReturn valueRefWhen theReffunction is used on the logical ID of a Certificate resource the certificate ARN is returned.DomainValidationOptionSyntaxDomainName:StringHostedZoneId:StringRoute53RoleArn:StringRoute53RoleExternalId:StringPropertiesDomainNameFully qualified domain name of the validation request.Required: YesType: StringUpdate requires:ReplacementHostedZoneIdThe Route53 Hosted Zone to create validation records in.Required: YesType: StringUpdate requires:ReplacementRoute53RoleArnThe arn of an IAM Role to assume when creating DNS validation records. This can be used to create the records for a
Hosted Zone in another AWS account.Required: NoType: StringUpdate requires:No interruptionRoute53RoleExternalIdAn External ID to use when assuming the Route53RoleArn. This can be set if required by the trust policy of the role.
Seehttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.htmlfor details of using ExternalIds.Required: NoType: StringUpdate requires:No interruptionTroposphereIf you are using troposphere you can install this resource as an extension using pip:$ pip install troposphere_dns_certificateYou can then import the Certificate resource from troposphere_dns_certificate.certificatemanager instead of troposphere.certificatemanager.cloudformation.py is an example of using troposphere to create a template with a Certificate resource.If you are not using troposphere, you can simply copy the CustomAcmCertificateLambda and CustomAcmCertificateLambdaExecutionRole
resources from the cloudformation.json or cloudformation.yaml files.ExamplesThe certificate resource looks like:ExampleCertificate:Properties:DomainName:test.example.comValidationMethod:DNSDomainValidationOptions:-DomainName:test.example.comHostedZoneId:Z2KZ5YTUFZNC7HTags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateAs with AWS::CertificateManager::Certificate providing the logical ID of the resource to the Ref function returns the certificate ARN.For example (in yaml):!Ref 'ExampleCertificate'SubjectAlternativeNamesAdditional names can be added to the certificate using the SubjectAlternativeNames property.ExampleCertificate:Properties:DomainName:example.comSubjectAlternativeNames:-additional.example.com-another.example.comValidationMethod:DNSDomainValidationOptions:-DomainName:example.comHostedZoneId:Z2KZ5YTUFZNC7HTags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateMultiple Hosted ZonesNames from multiple hosted zones can be used by adding DomainValidationOptions for each of the hosted zones.
For example:ExampleCertificate:Properties:DomainName:example.comSubjectAlternativeNames:-additional.example.orgValidationMethod:DNSDomainValidationOptions:-DomainName:example.comHostedZoneId:Z2KZ5YTUFZNC7H-DomainName:example.orgHostedZoneId:ZEJZ9DIN47IQNTags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateWildcardsWildcards can be used normally. A certificate for a name and all subdomains for example:ExampleCertificate:Properties:DomainName:example.comSubjectAlternativeNames:-*.example.comValidationMethod:DNSDomainValidationOptions:-DomainName:example.comHostedZoneId:Z2KZ5YTUFZNC7HTags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateSpecifying a regionThis example uses the Region property to create the certificate in us-east-1, for use with cloudfront:ExampleCertificate:Properties:DomainName:example.comValidationMethod:DNSDomainValidationOptions:-DomainName:example.comHostedZoneId:Z2KZ5YTUFZNC7HRegion:us-east-1Tags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateAssuming a role for Route 53 record creationIn some cases the account owning the hosted zone might be a different one than the one you are generating the certificate in.
To support this you can specify the domain validation option propertyRoute53RoleArnwith a role-ARN that should be
assumed before creating the records required for certificate validation.Optionally, you can also specify aRoute53RoleExternalIdthat will be used when assuming the role specified byRoute53RoleArn.
This would be required if the trust policy of the role requires an external ID.If a top-level Route53RoleArn property is specified it will be assumed when validating domains that don't contain a
Route53RoleArn domain validation option property.ExampleCertificate:Properties:DomainName:test.example.comValidationMethod:DNSDomainValidationOptions:-DomainName:test.example.comHostedZoneId:Z2KZ5YTUFZNC7HRoute53RoleArn:arn:aws:iam::TRUSTING-ACCOUNT-ID:role/ACMRecordCreationRoleRoute53RoleExternalId:EXTERNAL-IDTags:-Key:NameValue:Example CertificateServiceToken:!GetAtt'CustomAcmCertificateLambda.Arn'Type:Custom::DNSCertificateAdditionally you have to allow the assumption of this role by adding this statement to the CustomAcmCertificateLambdaExecutionRole:-Action:-sts:AssumeRoleResource:-arn:aws:iam::TRUSTING-ACCOUNT-ID:role/ACMRecordCreationRoleEffect:AllowIf you are using the troposphere extension, this statement is added automatically. The full CustomAcmCertificateLambdaExecutionRole
for this example would look like:CustomAcmCertificateLambdaExecutionRole:Properties:AssumeRolePolicyDocument:Statement:-Action:-sts:AssumeRoleEffect:AllowPrincipal:Service:lambda.amazonaws.comVersion:'2012-10-17'ManagedPolicyArns:-arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole-arn:aws:iam::aws:policy/service-role/AWSLambdaRolePolicies:-PolicyDocument:Statement:-Action:-acm:AddTagsToCertificate-acm:DeleteCertificate-acm:DescribeCertificate-acm:RemoveTagsFromCertificate-acm:UpdateCertificateOptionsEffect:AllowResource:-!Sub'arn:${AWS::Partition}:acm:*:${AWS::AccountId}:certificate/*'-Action:-acm:RequestCertificate-acm:ListTagsForCertificate-acm:ListCertificatesEffect:AllowResource:-'*'-Action:-route53:ChangeResourceRecordSetsEffect:AllowResource:-arn:aws:route53:::hostedzone/*-Action:-sts:AssumeRoleEffect:AllowResource:-arn:aws:iam::TRUSTING-ACCOUNT-ID:role/ACMRecordCreationRoleVersion:'2012-10-17'PolicyName:!Sub'${AWS::StackName}CustomAcmCertificateLambdaExecutionPolicy'The IAM role in the account with the hosted zone would look something like:ACMRecordCreationRole:Type:AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Statement:-Action:-sts:AssumeRolePrincipal:AWS:-arn:aws:iam::TRUSTED-ACCOUNT-ID:rootEffect:AllowCondition:StringEquals:'sts:ExternalId':EXTERNAL-IDVersion:'2012-10-17'Policies:-PolicyName:'ACMRecordCreation'PolicyDocument:Version:'2012-10-17'Statement:-Action:-route53:ChangeResourceRecordSetsResource:-arn:aws:route53:::hostedzone/Z2KZ5YTUFZNC7HEffect:AllowRoleName:ACMRecordCreationRole