This post describes the steps needed for setting up automatic SSL certificates creation and renewal, using Let's Encrypt as the automated Certificate Authority, which provides a well-maintained API.
acme-dns-route53 is the tool to obtain SSL certificates from Let’s Encrypt using DNS-01 challenge with Route53 and Amazon Certificate Manager by AWS. acme-dns-route53 also has the built-in functionality for using this tool inside AWS Lambda, and this is what we are going to do. This post is broken down into 4 sections: Note: before starting, make sure that GoLang 1.9+ and AWS CLI already installed. acme-dns-route53 is written in GoLang and supporting version not less than 1.9. We need to create a self-contained, deployable zip-file which contains executable of acme-dns-route53 tool inside. The first step is to build an executable from remote GitHub repo of acme-dns-route53 tool using go install command: The executable will be installed in $GOPATH/bin directory. Important: as part of this command we're using env to temporarily set two environment variables for the duration for the command (GOOS=linux and GOARCH=amd64). These instruct the Go compiler to create an executable suitable for use with a Linux OS and amd64 architecture — which is what it will be running on when we deploy it to AWS.
AWS requires us to upload our lambda functions in a zip file, so let's make an acme-dns-route53.zip zip file containing the executable we just made: Note that the executable must be in the root of the zip file — not in a folder within the zip file. To ensure this I've used the -j flag in the snippet above to junk directory names. Now the zip-file can be deployed, but it still needs permissions to run. We need to set up an IAM role which defines the permission that our lambda function will have when it is running.
For now, let's set up a lambda-acme-dns-route53-executor role and attach the AWSLambdaBasicExecutionRole managed policy to it. This will give our lambda function the basic permissions it needs to run and log to the AWS CloudWatch service.
First, we have to create a trust policy JSON file. This will essentially instruct AWS to allow lambda services to assume the lambda-acme-dns-route53-executor role: The content of the created JSON file should be the following: Then use the aws iam create-role command to create the role with this trust policy: Make a note of the returned ARN (Amazon Resource Name) — you'll need this in the next step. Now the lambda-acme-dns-route53-executor role has been created we need to specify the permissions that the role has. The easiest way to do this is to use the aws iam attach-role-policy command, passing in the ARN of AWSLambdaBasicExecutionRole permission policy like so: Note: you can find a list of other permission policies that might be useful here. Now we're ready to actually deploy the lambda function to AWS, which we can do using the aws lambda create-function command. The lambda function needs to be configured with the following options: Go ahead and try to deploying it: The last step is to create a daily trigger for the function. To do this we can: I’ve pasted my Terraform config for it below, but it’s also very straightforward to do it from either the AWS console or CLI. Now you too can have 100% automated TLS certificate renewals!