创建 LB 侦听器时出现 CertificateNotfound 错误

Question

我在向 LB 侦听器添加证书时遇到问题。这是用于执行此操作的代码（注意这些是代码片段）：

全球/main.tf

  resource "aws_acm_certificate" "demo_cert_east" {
  provider          = "aws.east"
  domain_name       = "*.mydomain.com"
  validation_method = "DNS"

  tags {
    Name        = "demo certificate"
    Environment = "demo"
  }

  lifecycle {
    create_before_destroy = true
  }
}

阶段/主要.tf

data "aws_acm_certificate" "demo_cert" {
  domain   = "*.mydomain.com"
  statuses = ["ISSUED", "PENDING_VALIDATION"]
}

resource "aws_lb_listener" "wfe_demo_ssl" {
  load_balancer_arn = "${aws_lb.wfe_demo.arn}"
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = "${data.aws_acm_certificate.demo_cert.arn}"

  default_action {
    target_group_arn = "${aws_lb_target_group.wfe_demo.arn}"
    type             = "forward"
  }
}

我已经确保这两个资源都在 aws-east 区域。我收到错误：

创建 LB 侦听器时出错：CertificateNotFound：未找到证书 'arn:aws:acm:us-east-1:078395932517:certificate/b83ba534-ef9d-4a07-ae13-832695dc8b5a'。

因此，数据源正确检索了证书，但侦听器似乎无法找到它。

Answer 1

为了能够将 ACM 证书附加到负载均衡器或其他 AWS 资源（例如 Cloudfront），必须先对其进行验证。

ISSUED如果没有与您的模式匹配的经过验证的证书，则更改数据源以仅查找证书应该将错误推送到数据源中：

data "aws_acm_certificate" "demo_cert" {
  domain   = "*.mydomain.com"
  statuses = ["ISSUED"]
}

要验证证书，您可以在请求时手动处理带外，使用其他工具为您自动验证它，或者您可以在创建 ACM 证书请求时使用 Terraform 的aws_acm_certificate_validation资源：

resource "aws_acm_certificate" "cert" {
  domain_name = "example.com"
  validation_method = "DNS"
}

data "aws_route53_zone" "zone" {
  name = "example.com."
  private_zone = false
}

resource "aws_route53_record" "cert_validation" {
  name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
  type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
  zone_id = data.aws_route53_zone.zone.id
  records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
  ttl = 60
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn = aws_acm_certificate.cert.arn
  validation_record_fqdns = [aws_route53_record.cert_validation.fqdn]
}

Answer 2

因为我刚刚遇到问题：证书和资源必须位于同一区域。（@ydaetskcoR 已经提到过这一点）。