r/aws_amplify_domain_association: add certificate_settings attribute

.changelog/37105.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_amplify_domain_association: Add `certificate_settings` argument
+```

internal/service/amplify/amplify_test.go

@@ -45,9 +45,10 @@ func TestAccAmplify_serial(t *testing.T) {
  "OptionalArguments": testAccBranch_OptionalArguments,
  },
  "DomainAssociation": {
- acctest.CtBasic: testAccDomainAssociation_basic,
- acctest.CtDisappears: testAccDomainAssociation_disappears,
- "update": testAccDomainAssociation_update,
+ acctest.CtBasic: testAccDomainAssociation_basic,
+ "certificateSettings": testAccDomainAssociation_certificateSettings,
+ acctest.CtDisappears: testAccDomainAssociation_disappears,
+ "update": testAccDomainAssociation_update,
  },
  "Webhook": {
  acctest.CtBasic: testAccWebhook_basic,

internal/service/amplify/domain_association.go

@@ -23,6 +23,7 @@ import (
  "github.com/hashicorp/terraform-provider-aws/internal/errs"
  "github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
  "github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+ "github.com/hashicorp/terraform-provider-aws/internal/verify"
  "github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -48,6 +49,29 @@ func resourceDomainAssociation() *schema.Resource {
  Type: schema.TypeString,
  Computed: true,
  },
+ "certificate_settings": {
+ Type: schema.TypeList,
+ Optional: true,
+ MaxItems: 1,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "certificate_verification_dns_record": {
+ Type: schema.TypeString,
+ Computed: true,
+ },
+ names.AttrType: {
+ Type: schema.TypeString,
+ Required: true,
+ ValidateDiagFunc: enum.Validate[types.CertificateType](),
+ },
+ "custom_certificate_arn": {
+ Type: schema.TypeString,
+ Optional: true,
+ ValidateFunc: verify.ValidARN,
+ },
+ },
+ },
+ },
  "certificate_verification_dns_record": {
  Type: schema.TypeString,
  Computed: true,
@@ -112,6 +136,10 @@ func resourceDomainAssociationCreate(ctx context.Context, d *schema.ResourceData
  SubDomainSettings: expandSubDomainSettings(d.Get("sub_domain").(*schema.Set).List()),
  }
 
+ if v, ok := d.GetOk("certificate_settings"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+ input.CertificateSettings = expandCertificateSettings(v.([]interface{})[0].(map[string]interface{}))
+ }
+
  _, err := conn.CreateDomainAssociation(ctx, input)
 
  if err != nil {
@@ -162,6 +190,9 @@ func resourceDomainAssociationRead(ctx context.Context, d *schema.ResourceData,
  if err := d.Set("sub_domain", flattenSubDomains(domainAssociation.SubDomains)); err != nil {
  return sdkdiag.AppendErrorf(diags, "setting sub_domain: %s", err)
  }
+ if err := d.Set("certificate_settings", flattenCertificateSettings(domainAssociation.Certificate)); err != nil {
+ return sdkdiag.AppendErrorf(diags, "setting certificate_settings: %s", err)
+ }
 
  return diags
 }
@@ -181,6 +212,10 @@ func resourceDomainAssociationUpdate(ctx context.Context, d *schema.ResourceData
  DomainName: aws.String(domainName),
  }
 
+ if d.HasChange("certificate_settings") {
+ input.CertificateSettings = expandCertificateSettings(d.Get("certificate_settings").([]interface{})[0].(map[string]interface{}))
+ }
+
  if d.HasChange("enable_auto_sub_domain") {
  input.EnableAutoSubDomain = aws.Bool(d.Get("enable_auto_sub_domain").(bool))
  }
@@ -385,6 +420,41 @@ func expandSubDomainSettings(tfList []interface{}) []types.SubDomainSetting {
  return apiObjects
 }
 
+func expandCertificateSettings(tfMap map[string]interface{}) *types.CertificateSettings {
+ if tfMap == nil {
+ return nil
+ }
+
+ apiObject := &types.CertificateSettings{
+ Type: types.CertificateType(tfMap[names.AttrType].(string)),
+ }
+
+ if v, ok := tfMap["custom_certificate_arn"].(string); ok {
+ apiObject.CustomCertificateArn = aws.String(v)
+ }
+
+ return apiObject
+}
+
+func flattenCertificateSettings(apiObject *types.Certificate) []interface{} {
+ if apiObject == nil {
+ return nil
+ }
+
+ tfMap := map[string]interface{}{}
+
+ tfMap[names.AttrType] = apiObject.Type
+
+ if v := apiObject.CertificateVerificationDNSRecord; v != nil {
+ tfMap["certificate_verification_dns_record"] = aws.ToString(v)
+ }
+ if v := apiObject.CustomCertificateArn; v != nil {
+ tfMap["custom_certificate_arn"] = aws.ToString(v)
+ }
+
+ return []interface{}{tfMap}
+}
+
 func flattenSubDomain(apiObject types.SubDomain) map[string]interface{} {
  tfMap := map[string]interface{}{}
 

internal/service/amplify/domain_association_test.go

@@ -156,6 +156,45 @@ func testAccDomainAssociation_update(t *testing.T) {
  })
 }
 
+func testAccDomainAssociation_certificateSettings(t *testing.T) {
+ ctx := acctest.Context(t)
+ key := "AMPLIFY_DOMAIN_NAME"
+ domainName := os.Getenv(key)
+ if domainName == "" {
+ t.Skipf("Environment variable %s is not set", key)
+ }
+
+ var domain types.DomainAssociation
+ rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+ resourceName := "aws_amplify_domain_association.test"
+
+ resource.Test(t, resource.TestCase{
+ PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
+ ErrorCheck: acctest.ErrorCheck(t, names.AmplifyServiceID),
+ ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+ CheckDestroy: testAccCheckDomainAssociationDestroy(ctx),
+ Steps: []resource.TestStep{
+ {
+ Config: testAccDomainAssociationConfig_certificateSettings(rName, domainName, false, false),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckDomainAssociationExists(ctx, resourceName, &domain),
+ acctest.MatchResourceAttrRegionalARN(resourceName, names.AttrARN, "amplify", regexache.MustCompile(`apps/.+/domains/.+`)),
+ resource.TestCheckResourceAttr(resourceName, names.AttrDomainName, domainName),
+ resource.TestCheckResourceAttr(resourceName, "certificate_settings.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "certificate_settings.0.type", "AMPLIFY_MANAGED"),
+ resource.TestCheckResourceAttrSet(resourceName, "certificate_settings.0.certificate_verification_dns_record"),
+ ),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateVerifyIgnore: []string{"wait_for_verification"},
+ },
+ },
+ })
+}
+
 func testAccCheckDomainAssociationExists(ctx context.Context, n string, v *types.DomainAssociation) resource.TestCheckFunc {
  return func(s *terraform.State) error {
  rs, ok := s.RootModule().Resources[n]
@@ -264,3 +303,33 @@ resource "aws_amplify_domain_association" "test" {
 }
 `, rName, domainName, enableAutoSubDomain, waitForVerification)
 }
+
+func testAccDomainAssociationConfig_certificateSettings(rName, domainName string, enableAutoSubDomain bool, waitForVerification bool) string {
+ return fmt.Sprintf(`
+resource "aws_amplify_app" "test" {
+ name = %[1]q
+}
+
+resource "aws_amplify_branch" "test" {
+ app_id = aws_amplify_app.test.id
+ branch_name = %[1]q
+}
+
+resource "aws_amplify_domain_association" "test" {
+ app_id = aws_amplify_app.test.id
+ domain_name = %[2]q
+
+ sub_domain {
+ branch_name = aws_amplify_branch.test.branch_name
+ prefix = ""
+ }
+
+ certificate_settings {
+ type = "AMPLIFY_MANAGED"
+ }
+
+ enable_auto_sub_domain = %[3]t
+ wait_for_verification = %[4]t
+}
+`, rName, domainName, enableAutoSubDomain, waitForVerification)
+}

website/docs/r/amplify_domain_association.html.markdown

@@ -52,11 +52,17 @@ resource "aws_amplify_domain_association" "example" {
 This resource supports the following arguments:
 
 * `app_id` - (Required) Unique ID for an Amplify app.
+* `certificate_settings` - (Optional) The type of SSL/TLS certificate to use for your custom domain. If you don't specify a certificate type, Amplify uses the default certificate that it provisions and manages for you.
 * `domain_name` - (Required) Domain name for the domain association.
 * `enable_auto_sub_domain` - (Optional) Enables the automated creation of subdomains for branches.
 * `sub_domain` - (Required) Setting for the subdomain. Documented below.
 * `wait_for_verification` - (Optional) If enabled, the resource will wait for the domain association status to change to `PENDING_DEPLOYMENT` or `AVAILABLE`. Setting this to `false` will skip the process. Default: `true`.
 
+The `certificate_settings` configuration block supports the following arguments:
+
+* `type` - (Required) The certificate type. Valid values are `AMPLIFY_MANAGED` and `CUSTOM`.
+* `custom_certificate_arn` - (Optional) The Amazon resource name (ARN) for the custom certificate.
+
 The `sub_domain` configuration block supports the following arguments:
 
 * `branch_name` - (Required) Branch name setting for the subdomain.