Removed the [WIP] flag, from my point of view this PR is ready for review.

@bflad what you think? it's possible to merge this PR?

Agreed we have a new terraform that would benefit from this.

You caught me. 😄 I'm in the ACM neighborhood right now with #1837 and was actually planning on looking at this right after so I didn't have too much context switching. While that one is waiting for some feedback let me at least provide an initial review for this one. More shortly.

@bflad unless I missed something this should be ready for round two:

• Now Supporting E-Mail Validation and and importing certificates that aren't AMAZON_ISSUED
• Cleaned up code and tests

@bflad and @flosell this is really a very big step. Looking forward to try. Thanks for everything.

This will be a massive help to us.

This has been released in terraform-provider-aws version 1.9.0. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

Hello, this is great! The example code works fine. But I have one problem. How do I handle creating multiple DNS records for an ACM cert with multiple subject alternative names? All of the facts I need are embedded in the resource's domain_validation_options property, but the values in the maps inside that list are not directly accessible as far as I can tell. Example code:

resource "aws_acm_certificate" "cert" {
  domain_name = "myname.example.com"
  subject_alternative_names = [
    "my-alt-name.example.com",
    "my-other-name.example.com",
  ]
  validation_method = "DNS"
}

output "validation-options" {
  value = "${aws_acm_certificate.cert.domain_validation_options}"
}

This results in this output:

validation-options = [
    {
        domain_name = myname.example.com,
        resource_record_name = _8b1eece1bd9eb24c465d20ee5e902e34.myname.example.com.,
        resource_record_type = CNAME,
        resource_record_value = _7fcc0e9fce650cfc93cf84e9b3afa0a8.acm-validations.aws.
    },
    {
        domain_name = my-alt-name.example.com,
        resource_record_name = _117f0bed1655685f817791a0d446fbaf.my-alt-name.example.com.,
        resource_record_type = CNAME,
        resource_record_value = _eae8c229110499e4c535fde67c6cd8c0.acm-validations.aws.
    },
    {
        domain_name = my-other-name.example.com,
        resource_record_name = _456f43b3eacb2496165b136bda0f47db.my-other-name.example.com.,
        resource_record_type = CNAME,
        resource_record_value = _61efde25808a9a12bbd24ac29ca0308c.acm-validations.aws.
    }
]

Fair enough. But then I am stuck at how to create those three records. My first instinct is to treat this property like a multi-instance resource, and do something like:

resource "aws_route53_record" "cert_validation" {
  count = "${length(aws_acm_certificate.cert.domain_validation_options)}"
  name    = "${element(aws_acm_certificate.cert.domain_validation_options.*.resource_record_name, count.index)}"
  type    = "${element(aws_acm_certificate.cert.domain_validation_options.*.resource_record_type, count.index)}"
  records = ["${element(aws_acm_certificate.cert.domain_validation_options.*.resource_record_value, count.index)}"]
  zone_id = "${data.aws_route53_zone.zone.id}"
  ttl     = 300
}

But that gives me an error: "value of 'count' cannot be computed"

If I tweak things around or even hardcode "count" to the correct value, then I get errors like: "Resource 'aws_acm_certificate.cert' does not have attribute 'domain_validation_options.*.resource_record_type'".

I've tried using locals as interstitial calculators, but I can't figure out how to get, say, an array of just the resource_record_name values, given the cert_validation structure.

I'm also not able to get this to work using just straight local variables instead of the resource attribute. There just don't seem to be sufficient tools in the interpolation language to manipulate this particular data structure. Not sure if it's easier to fix the resource or the interpolation language.

This exactly describes the challenge I was experiencing yesterday. I know you can attach multiple ACM certs to an ALB, but it's nice if I can minimize the number of certificate lifecycles to manage.

Has anyone been able to create multiple aws_route53_record's for certificates that has multiple domains?

I am unable to dynamically lookup the domain_validation_options
If i try to access aws_acm_certificate_cert.domain_validation_options.0.resource_record_name i get the expected value.

But if i try to access it dynamically in a resource block with count like this:

resource "aws_route53_record" "cert_validation" {
  count = "${length(local.certificate_additional_domains) + 1}" // One record for each additional domain + one for the main domain
  name = "${element(aws_acm_certificate.cert.domain_validation_options.*.resource_record_name, count.index)}"
  [ ... ]
}

terraform plan tells me that:

* module.mymodule.aws_route53_record.cert_validation: At column 3, line 1: element: argument 1 should be type list, got type string in:

${element(aws_acm_certificate.cert.domain_validation_options.*.resource_record_type, count.index)})

If i try to output just aws_acm_certificate.cert.domain_validation_options.*.resource_record_name somewhere the result is 1

I've found that it works if you use:

name = "${lookup(aws_acm_certificate.cert.domain_validation_options[count.index], "resource_record_name")}"

And similar for the other fields.

@daveadams Thanks, that works perfectly!

it doesnt work i you use counts:

variable "apps" {
  type    = "list"
  default = ["foo", "bar"]
}

# dns validation record
resource "aws_route53_record" "live_cert_validation" {
  count   = "${length(var.apps)}"
  name    = "${lookup(element(aws_acm_certificate.live.*.domain_validation_options[count.index], 0), "resource_record_name")}"
  type    = "${lookup(element(aws_acm_certificate.live.*.domain_validation_options[count.index], 0), "resource_record_type")}"
  zone_id = "${data.aws_route53_zone.live.*.id[count.index]}"
  records = ["${lookup(element(aws_acm_certificate.live.*.domain_validation_options[count.index], 0), "resource_record_value")}"]
  ttl     = 60
}

more weird: it works if i create the certificate in one stack, and the certificate dns records and the validation in the next stack. but all in one stack gives me the following error:

* aws_route53_record.live_cert_validation: At column 3, line 1: lookup: argument 1 should be type map, got type string in:

${lookup(element(aws_acm_certificate.live.*.domain_validation_options[count.index], 0), "resource_record_name")}

it tried it in a lot of obscure ways, but nothing seems to work, i guess the interpolation comes in play to early here...

@flosell @bflad any ideas?

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!