provider/aws: Add support for ACM certificates to api_gateway_domain_name

[stack72]

Fixes: #12566

% make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSAPIGatewayDomainName_'         ✹
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/03/10 19:32:31 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSAPIGatewayDomainName_ -timeout 120m
=== RUN   TestAccAWSAPIGatewayDomainName_basic
--- PASS: TestAccAWSAPIGatewayDomainName_basic (54.06s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	54.091s

Unfortunately, due to ACM not being automatable, we can't add a test for this!

[Ninir]

@stack72 Hi Paul,

Even though it has been merged, have a few questions on this:

As the CLI already deprecates it (http://docs.aws.amazon.com/apigateway/api-reference/link-relation/domainname-create/), what do you think of deprecating it also to be consistent?

Also, don't you think we should mark certificate_arn as conflicting with certificate_body, certificate_chain, certificate_name, certificate_private_key?

Thanks for the work on this, really helpful :)

[radeksimko]

Re conflicting - I agree - would you mind sending a PR for this? :)

Regarding deprecation - we did have a brief conversation with Paul about this - I was firstly suggesting the same thing as you, but then we both realized that ACM doesn't offer a good automation mechanisms (which is also why we don't have any ACM resources in Terraform yet) - therefore we have no reasonable alternatives to offer to the user, unless the alternative is "go ahead and manually verify domain in ACM and then come back", which I think is suboptimal.

Therefore we're hoping AWS will eventually support DNS based verification prior to removing the deprecated certificate handling and then we'd actually deprecate or remove those fields here.

[Ninir]

Hi @radeksimko !

Sure, here it is: #12649
Sounds good for the next steps on that, thanks for the inputs!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.