Project: KICS (Provisioning / Security & Compliance)
File: cc8b294f-006f-4f8f-b5bb-0a9140c33131.md

title: Wildcard In ACM Certificate Domain Name hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cc8b294f-006f-4f8f-b5bb-0a9140c33131 Query name: Wildcard In ACM Certificate Domain Name Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: ACM Certificate should not use wildcards (*) in the domain name<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="16" AWSTemplateFormatVersion: '2010-09-09' Parameters: DomainName: Description: "Domain for which you are requesting a cert" Type: String Default: example.com #Put your own domain name here HostedZoneId: Description: "hosted zone id in which CNAME record for the validation needs to be added" Type: String Default: XYZABCDERYH #Put the hosted zone id in which CNAME record for the validation needs to be added Resources: Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: "*" DomainValidationOptions: DomainName: !Ref DomainName HostedZoneId: !Ref HostedZoneId ValidationMethod: 'DNS' ``` ```json title="Positive test num. 2 - json file" hl_lines="19" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "HostedZoneId": { "Type": "String", "Default": "XYZABCDERYH", "Description": "hosted zone id in which CNAME record for the validation needs to be added" }, "DomainName": { "Description": "Domain for which you are requesting a cert", "Type": "String", "Default": "example.com" } }, "Resources": { "Certificate": { "Type": "AWS::CertificateManager::Certificate", "Properties": { "DomainName": "*", "DomainValidationOptions": [ { "DomainName": "DomainName", "HostedZoneId": "HostedZoneId" } ], "ValidationMethod": "DNS" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Parameters: DomainName: Description: "Domain for which you are requesting a cert" Type: String Default: example.com #Put your own domain name here HostedZoneId: Description: "hosted zone id in which CNAME record for the validation needs to be added" Type: String Default: XYZABCDERYH #Put the hosted zone id in which CNAME record for the validation needs to be added Resources: Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: CMDomain DomainValidationOptions: DomainName: !Ref DomainName HostedZoneId: !Ref HostedZoneId ValidationMethod: 'DNS' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "DomainName": { "Type": "String", "Default": "example.com", "Description": "Domain for which you are requesting a cert" }, "HostedZoneId": { "Description": "hosted zone id in which CNAME record for the validation needs to be added", "Type": "String", "Default": "XYZABCDERYH" } }, "Resources": { "Certificate": { "Type": "AWS::CertificateManager::Certificate", "Properties": { "DomainName": "CMDomain", "DomainValidationOptions": [ { "HostedZoneId": "HostedZoneId", "DomainName": "DomainName" } ], "ValidationMethod": "DNS" } } } } ```