用于 eu-west-1 中资源的 us-east-1 中的 Terraform AWS ACM 证书 [英] Terraform AWS ACM certificates in us-east-1 for resources in eu-west-1
问题描述
我有一个 terraform 模块,主要在 eu-west-1 中提供资源.我需要一个 ACM 证书才能附加到 Cloudfront 发行版.证书必须在 us-east-1 中提供.
I have a terraform module that provisions resources primarily in eu-west-1. I need an ACM certificate to attach to a Cloudfront distribution. The certificate must be provisioned in us-east-1.
我因此配置了两个提供程序:
I have thus configured two providers:
provider "aws" {
version = "~> 1.0"
region = "eu-west-1"
}
provider "aws" {
version = "~> 1.0"
region = "us-east-1"
alias = "us-east-1"
}
在我的模块中,我像这样提供证书:
In my module, I provision the certificate like so:
resource "aws_acm_certificate" "cert" {
provider = "aws.us-east-1"
domain_name = "${var.domain_name}"
validation_method = "DNS"
tags = "${var.tags}"
lifecycle {
create_before_destroy = true
}
}
问题 #1:我尝试使用以下方法导入现有 ACM 证书:
Problem #1: I tried to import my existing ACM certificate using:
terraform import module.mymod.aws_acm_certificate.cert arn:aws:acm:us-east-1:xyz:certificate/uuid
这失败了:找不到带有 id 的证书".terraform 是否在错误的区域中寻找?我通过 aws CLI 确认证书确实存在(例如 ARN 中没有拼写错误).
This fails with: "Could not find certificate with id". Is terraform looking in the wrong region? I confirmed with the aws CLI that the certificate does indeed exist (e.g. no typos in the ARN).
好的,所以我想我可以创建新证书.这确实有效,我现在有两个证书,但是我遇到了问题 #2:
Ok, so I figured I could just create new certificate. This does work, and I now have two certificates, but I then run into problem #2:
resource "aws_route53_record" "cert_validation" {
name = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_name}"
type = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_type}"
zone_id = "${data.aws_route53_zone.zone.id}"
records = ["${aws_acm_certificate.cert.domain_validation_options.0.resource_record_value}"]
ttl = 60
}
这会尝试为 ACM 设置 DNS 验证.托管区域存在于 eu-west-1 中,所以我预计这里会出现问题.但是,这仍然因找不到证书..."而失败,我假设 terraform 对区域感到困惑.我也尝试将 provider = "aws.us-east-1"
添加到此资源,但仍然以同样的方式失败.
This attempts to set up DNS validation for ACM. The hosted zone exists in eu-west-1, so I'm expecting problems here. However, this still fails with "Could not find certificate ...", and I'm assuming terraform gets confused about regions. I tried adding provider = "aws.us-east-1"
to this resource as well, but it still fails the same way.
因此,无论我做什么,Terraform 都无法找到我的证书,即使它自己创建了它.我做错了吗?
So, no matter what I do, Terraform is unable to locate my certificate, even it has created it itself. Am I doing something wrong?
推荐答案
原来我的问题是 aws_acm_certificate_validation
.通过将提供者指定在与证书相同的区域,一切都解决了.
Turns out my problem was with aws_acm_certificate_validation
. By specifying the provider in the same region as the certificate, it was all resolved.
resource "aws_acm_certificate_validation" "cert" {
provider = "aws.us-east-1" # <== Add this
certificate_arn = "${aws_acm_certificate.cert.arn}"
validation_record_fqdns = ["${aws_route53_record.cert_validation.fqdn}"]
}
这篇关于用于 eu-west-1 中资源的 us-east-1 中的 Terraform AWS ACM 证书的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!