[apigateway] The certificate provided must be owned by the account creating the domain

[Lock128]

I have a manually imported certifcated in ACM in us-east-1 (not part of the CDK stack) and a EDGE API created by CDK in eu-central-1

Unfortunately when trying to deploy the stack I am getting

3/26 | 1:04:21 AM | CREATE_FAILED | AWS::ApiGateway::DomainName | Widgets/Widgets-API/CustomDomain (WidgetsWidgetsAPICustomDomainAFFC7939) Invalid request provided: The certificate provided must be owned by the account creating the domain. (Service: ApiGateway, Status Code: 400, Request ID: 368eb32d-f0e0-442e-b38e-31590def84e4, Extended Request ID: null)
109 | new DomainName (/tmp/jsii-kernel-g3fCMN/node_modules/@aws-cdk/aws-apigateway/lib/domain-name.js:36:26)
110 | _ RestApi.addDomainName (/tmp/jsii-kernel-g3fCMN/node_modules/@aws-cdk/aws-apigateway/lib/restapi.js:83:28)
111 | _ new RestApi (/tmp/jsii-kernel-g3fCMN/node_modules/@aws-cdk/aws-apigateway/lib/restapi.js:409:18)
112 | _ /tmp/jsii-java-runtime2101771176231171458/lib/program.js:2720:58
113 | _ Kernel._wrapSandboxCode (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:3148:24)
114 | _ Kernel._create (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:2720:34)
115 | _ Kernel.create (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:2461:29)
116 | _ KernelHost.processRequest (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:9457:36)
117 | _ KernelHost.run (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:9420:22)
118 | _ Immediate._onImmediate (/tmp/jsii-java-runtime2101771176231171458/lib/program.js:9421:46)
119 | _ processImmediate (internal/timers.js:461:21)

Reproduction Steps

Java code used for API:

String domainName = "api.domain.com";
SecurityPolicy securityPolicy = SecurityPolicy.TLS_1_2;
String certificateArn = "arn:aws:acm:us-east-1:acc:certificate/arn";
ICertificate certificate = Certificate.fromCertificateArn(this, "sslCertificate", certificateArn);
RestApi api = RestApi.Builder.create(this, "Widgets-API").restApiName("Widget Service")
.description("This service services widgets.").domainName(DomainNameOptions.builder()
.domainName(domainName).securityPolicy(securityPolicy).certificate(certificate).build())
.build();

What did you expect to happen?

I was expecting that "api.domain.com" is created as custom domain for the API Gateway

What actually happened?

Got the error message mentioned above

Environment

• CDK CLI Version : 1.91.0 (build 0f728ce)
• Framework Version:
• Node.js Version: v15.8.0
• OS : LinuxBuildImage.AMAZON_LINUX_2_3
• Language (Version): Java 11

Other

see above

---

This is 🐛 Bug Report

[Lock128]

I already checked that #10529 and #9548 and #9608 do not help, CDK is bootstrapped into us-east-1 and eu-central-1

[nija-at]

Hey @Lock128 -

This doesn't seem to be related to the CDK.

According to the issue you've linked - #9548 - it seems that the certificate and ApiGateway need to be in the same region and account. However, I'm not intimately aware of the requirements and limitations of ACM.

You will need to contact the relevant teams via AWS support. Let us know if I misunderstood something here and requires attention from the CDK.

[Lock128]

Hey @nija-at

I think t his is a CDK issue as somewhere it automatically references the certificate in the wrong region (in eu-central-1 where the apigateway is deployed, however due to the nature of the APIGateway using cloudfront to provide the HTTPS functionality, the certificate needs to be placed in the us-east-1 region).

Manually I was able to set up the set up the customdomain

Regards
Johannes

[nija-at]

Hey @Lock128 - Thanks for your response.

You will need to provide a code sample and reproduction steps for me to proceed.

[Lock128]

Hey @nija-at

here you are:
https://github.com/Lock128/aws-cdk-13512

in the credentials file I have

[default]
aws_access_key_id=XXX
aws_secret_access_key=YYY
region = eu-central-1

And obviouslyI have removed my ARN here

Let me know if you need anything else

Regards
Johannes

[Lock128]

C:\Users\JohannesKoch\git-private\aws-cdk-13512>cdk --version
1.91.0 (build 0f728ce)

[nija-at]

The generated template, references the ARN only in one place, namely the RegionalCertificateArn property and it contains the correct region information -

    "WidgetsAPICustomDomainDC6E303E": {
      "Type": "AWS::ApiGateway::DomainName",
      "Properties": {
        "DomainName": "<##redacted##>",
        "EndpointConfiguration": {
          "Types": [
            "REGIONAL"
          ]
        },
        "RegionalCertificateArn": "<##redacted##>",
        "SecurityPolicy": "TLS_1_2"
      },
      "Metadata": {
        "aws:cdk:path": "AwsCdk13512Stack/Widgets-API/CustomDomain/Resource"
      }
    },

I'm still suspecting that this is something with APIGateway and CloudFormation.

As far as I can tell, I cannot see any other incorrect reference of region.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[vsuzdaltsev]

having the same issue